1

I have 6 OSSEC installations (5 agents + 1 server, all Debian 8) all configured to block repeated offenders using iptables from 10 minutes to 1 month.

I have the need to restart one or more of the servers from time to time. Every time the iptables rules added by OSSEC are removed. This happends also when restarting ossec (./ossec-control restart)

Is there a easy solution to keeping the rules, or will I have to modify the active response scripts to run iptables-save every time an IP is block/unblocked?

Improve this question

1 Answer 1

Reset to default
0

I think you answered your own question with the latter, of running iptables-save in active-response scripts. But the problem with that is anytime you upgrade OSSEC those changes will get overwritten.

So the best option is to configure iptables-save in cron to your liking.

Improve this answer
1
  • iptables-save in either active-response or cron can have unintended consequences. Some people tend to enter iptables rules that are supposed to be temporary and vanish with the next service iptables restart. They would be surprised if they didn't.
    – kubanczyk
    Commented Feb 7, 2017 at 22:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .