GithubHelp home page GithubHelp logo

cnit470's People

Contributors

phabbits avatar

Watchers

James Cloos avatar avatar

cnit470's Issues

Remove all snapshots

Snapshots now have a maximum time of 48 hours, or will be forcibly removed. We need to remove any we have so far and use clones if we want to achieve a VM backup.

Synchronize time on all machines

In order for the created logs to be more useful, we should synchronize the time on all the machines using NTP. The procedure I would suggest:

  1. Set one of our new VMs to act as a local NTP server getting it's time from other NTP servers.
  2. Have all other machines reference our local NTP server.

Index.html connection refusing

Finished everything else left for nginx.

There was an issue with index.html for 5.2.1 where connection keeps refusing not sure what's going on

Cannot `yum update` on new CentOS machine

When running sudo yum update for the first time on the new CentOS machine the relevant output was:

Not using downloaded base/repomd.xml because it is older than what we have:
  Current   : Thu May  3 20:17:37 2018
  Downloaded: Tue Aug  4 14:22:51 2009

...

Not using downloaded extras/repomd.xml because it is older than what we have:
  Current   : Tue Oct  2 14:47:48 2018
  Downloaded: Sun May 15 13:41:21 2011

...

Error: Package: centos-release-scl-rh-2-2.el7.centos.noarch (@extras)
           Requires: system-release
           Removing: centos-release-7-5.1804.4.el7.centos.x86_64 (@CentOS-Updates)
               system-release = 7.5-8
           Updated By: 6:centos-release-4-9.1.x86_64 (update)
               Not found
           Available: centos-release-7-5.1804.el7.centos.x86_64 (base)
               system-release = 7.5-8
           Available: 6:centos-release-4-9.x86_64 (update)
               Not found
Error: Package: setup-2.8.71-9.el7.noarch (@anaconda)
           Requires: system-release
           Removing: centos-release-7-5.1804.4.el7.centos.x86_64 (@CentOS-Updates)
               system-release = 7.5-8
           Updated By: 6:centos-release-4-9.1.x86_64 (update)
               Not found
           Available: centos-release-7-5.1804.el7.centos.x86_64 (base)
               system-release = 7.5-8
           Available: 6:centos-release-4-9.x86_64 (update)
               Not found
Error: Package: grubby-8.28-23.el7.x86_64 (@anaconda)
           Requires: system-release
           Removing: centos-release-7-5.1804.4.el7.centos.x86_64 (@CentOS-Updates)
               system-release = 7.5-8
           Updated By: 6:centos-release-4-9.1.x86_64 (update)
               Not found
           Available: centos-release-7-5.1804.el7.centos.x86_64 (base)
               system-release = 7.5-8
           Available: 6:centos-release-4-9.x86_64 (update)
               Not found
Error: initscripts conflicts with 6:centos-release-4-9.1.x86_64

Cannot `yum update`

When trying to run sudo yum update there are the following errors:

Error: Package: python-linux-procfs-0.4.9-5.el6.noarch (base)
           Requires: python(abi) = 2.6
           Installed: python-2.7.5-69.el7_5.x86_64 (@CentOS-Updates)
               python(abi) = 2.7
               python(abi) = 2.7
           Available: python-2.6.6-66.el6_8.x86_64 (base)
               python(abi) = 2.6
           Available: python-2.6.6-68.el6_10.x86_64 (update)
               python(abi) = 2.6
           Available: python34-3.4.10-8.el7.x86_64 (epel)
               python(abi) = 3.4
Error: Package: libquadmath-devel-4.8.5-28.el7_5.1.x86_64 (@updates)
           Requires: libquadmath = 4.8.5-28.el7_5.1
           Removing: libquadmath-4.8.5-28.el7_5.1.x86_64 (@updates)
               libquadmath = 4.8.2-16.el7_5
               libquadmath = 4.8.5-28.el7_5.1
           Updated By: libquadmath-8.2.1-1.3.1.el6_10.x86_64 (update)
               libquadmath = 8.2.1-1.3.1.el6_10
           Available: libquadmath-7.2.1-1.2.1.el6.i686 (base)
               libquadmath = 7.2.1-1.2.1.el6
Error: Package: gcc-gfortran-4.8.5-28.el7_5.1.x86_64 (@updates)
           Requires: libquadmath = 4.8.5-28.el7_5.1
           Removing: libquadmath-4.8.5-28.el7_5.1.x86_64 (@updates)
               libquadmath = 4.8.2-16.el7_5
               libquadmath = 4.8.5-28.el7_5.1
           Updated By: libquadmath-8.2.1-1.3.1.el6_10.x86_64 (update)
               libquadmath = 8.2.1-1.3.1.el6_10
           Available: libquadmath-7.2.1-1.2.1.el6.i686 (base)
               libquadmath = 7.2.1-1.2.1.el6
Error: Package: 2:vim-enhanced-7.4.629-5.el6_10.2.x86_64 (update)
           Requires: perl(:MODULE_COMPAT_5.10.1)
           Available: 4:perl-5.10.1-144.el6.x86_64 (base)
               perl(:MODULE_COMPAT_5.10.1)
           Installed: 4:perl-5.16.3-292.el7.x86_64 (@anaconda)
              ~perl(:MODULE_COMPAT_5.16.0)
              ~perl(:MODULE_COMPAT_5.16.1)
              ~perl(:MODULE_COMPAT_5.16.2)
              ~perl(:MODULE_COMPAT_5.16.3)
Error: Package: satyr-0.16-2.el6.x86_64 (base)
           Requires: librpm.so.1()(64bit)
           Available: rpm-libs-4.8.0-59.el6.x86_64 (base)
               librpm.so.1()(64bit)
           Installed: rpm-libs-4.11.3-32.el7.x86_64 (@anaconda)
              ~librpm.so.3()(64bit)
Error: Package: libgfortran-4.8.5-28.el7_5.1.x86_64 (@updates)
           Requires: libquadmath = 4.8.5-28.el7_5.1
           Removing: libquadmath-4.8.5-28.el7_5.1.x86_64 (@updates)
               libquadmath = 4.8.2-16.el7_5
               libquadmath = 4.8.5-28.el7_5.1
           Updated By: libquadmath-8.2.1-1.3.1.el6_10.x86_64 (update)
               libquadmath = 8.2.1-1.3.1.el6_10
           Available: libquadmath-7.2.1-1.2.1.el6.i686 (base)
               libquadmath = 7.2.1-1.2.1.el6
Error: Package: grep-2.20-6.el6.x86_64 (base)
           Requires: libpcre.so.0()(64bit)
           Available: pcre-7.8-7.el6.x86_64 (base)
               libpcre.so.0()(64bit)
           Installed: pcre-8.32-17.el7.x86_64 (@anaconda)
              ~libpcre.so.1()(64bit)
              ~libpcre16.so.0()(64bit)
              ~libpcre32.so.0()(64bit)

HIDS clients won't connect

Running sudo /var/ossec/bin/manage_agents, and listing agents, we see all agents are added:

Available agents: 
   ID: 001, Name: Centos7_F21, IP: 10.51.20.10
   ID: 004, Name: Win2008_F21, IP: 10.51.20.40
   ID: 007, Name: Win10, IP: 10.51.20.70
   ID: 005, Name: Win2019, IP: 10.51.20.50
   ID: 002, Name: Debian9_F21, IP: 10.51.20.20
   ID: 003, Name: Ubuntu_F21, IP: 10.51.20.30

To check if an agent is connected, we run sudo /var/ossec/bin/agent_control -i 004 which reports:

OSSEC HIDS agent_control. Agent information:
   Agent ID:   004
   Agent Name: Win2008_F21
   IP address: 10.51.20.40/32
   Status:     Never connected

   Operating system:    Unknown
   Client version:      Unknown
   Last keep alive:     Unknown

   Syscheck last started  at: Unknown
   Rootcheck last started at: Unknown

The key is added on Win2008, and the agent is running.

Error when importing OSSEC key 

Paste it here (or '\q' to quit): MDAyIERlYmlhbjlfRjIxIDEwLjUxLjIwLjIwIGEwYjE3YjRkODkyNzg1ODc1YmMzMmFlMDYyODZhZjgwZTg5ZWIxZTFhOGViNDEwYTAyMGEzNWY5MzlkMGUwMzk=

Agent information:
   ID:002
   Name:Debian9_F21
   IP Address:10.51.20.20

Confirm adding it?(y/n): y
2021/10/30 14:51:50 manage_agents: ERROR: Cannot unlink /queue/rids/sender: No such file or directory
Added.
** Press ENTER to return to the main menu.

MariaDB stopped

sudo systemctl restart mariadb
Job for mariadb.service failed because the control process exited with error code. See "systemctl status mariadb.service" and "journalctl -xe" for details.

Port for logstash is closed eventhough service is running

Running nmap 10.51.20.61 -p- gives:

Nmap scan report for 10.51.20.61
Host is up (0.00031s latency).
Not shown: 65531 filtered ports
PORT     STATE  SERVICE
80/tcp   open   http
443/tcp  closed https
5044/tcp closed lxi-evntsvc
5601/tcp closed esmagent

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.