<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"></div></div></div></div></div></div></div></div></div></div></div></div></div> <font color="#0b5394" face="Arial, Helvetica, sans-serif">P<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77);display:inline">lease see inline-</div></font></div><div class="gmail_extra"><font color="#0b5394" face="Arial, Helvetica, sans-serif"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77);display:inline"><br></div></font></div><div class="gmail_extra"><font color="#0b5394" face="Arial, Helvetica, sans-serif"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77);display:inline">regards</div></font></div><div class="gmail_extra"><font color="#0b5394" face="Arial, Helvetica, sans-serif"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77);display:inline"></div></font><br><div class="gmail_quote">On Tue, Oct 3, 2017 at 3:28 AM, Steve Grubb <span dir="ltr"><<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-">On Monday, October 2, 2017 2:55:51 PM EDT Rituraj Buddhisagar wrote:<br> > Hi<br> ><br> > I tried my best to configure the audisp-remote.<br> > I am getting below error on the client machine in /var/log/syslog.<br> ><br> > Oct 2 14:41:15 xxxxxx audisp-remote: Error connecting to <a href="http://192.168.103.7" rel="noreferrer" target="_blank">192.168.103.7</a>:<br> > Connection refused<br> <br> <br> </span>On the server, what do you get for:<br> <br> ausearch --start recent -m DAEMON_ACCEPT -i<br> <br> The server side records some information about why it did not allow a<br> connection.<br> <span class="gmail-"><br></span></blockquote><div><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">I dont see any info in here.</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><div class="gmail_default"># ausearch --start recent -m DAEMON_ACCEPT -i</div><div class="gmail_default"><no matches></div><div><br></div><div>I tried without --start & -i options as well.</div><div><br></div></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">But when I do a tcpdump on central server, I do see requests coming in. (I changed port to 60). </div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"># tcpdump -i eth1 '( port 60 )'</font><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(32,18,77)">08:53:56.597946 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq 4076269451, win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7], length 0</div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(32,18,77)">08:53:56.597980 IP 192.168.103.7.60 > gusm1.60: Flags [R.], seq 0, ack 4076269452, win 0, length 0</div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(32,18,77)">08:53:56.598843 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq 4076287474, win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7], length 0</div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(32,18,77)">08:53:56.598858 IP 192.168.103.7.60 > gusm1.60: Flags [R.], seq 0, ack 18024, win 0, length 0</div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(32,18,77)">08:53:56.599164 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq 4076300652, win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7], length 0</div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(32,18,77)">08:53:56.599175 IP 192.168.103.7.60 > gusm1.60: Flags [R.], seq 0, ack 31202, win 0, length 0</div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(32,18,77)">08:53:56.599657 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq 4076306151, win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7], length 0</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">I think the service is only listening locally and not for remote connections?</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><div class="gmail_default">root@logs:/etc/audit# lsof -i :60</div><div class="gmail_default">COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME</div><div class="gmail_default">audisp-re 1713 root 3u IPv4 17433 0t0 TCP 192.168.103.7:60-><a href="http://192.168.103.7:60">192.168.103.7:60</a> (ESTABLISHED)</div><div><br></div></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">How do I see that I am using libwrap? I have enable_krb5=no in the auditd.conf on the aggregative server.</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-"> > 192.168.103.7 is the IP address of the central log server.<br> ><br> > Notes: My settings are below:<br> ><br> > on server as well on client:<br> > /etc/audisp/audisp-remote<br> ><br> > remote_server = 192.168.103.7<br> > port = 6999<br> > local_port = 6999<br> > transport = tcp<br> > queue_file = /var/spool/audit/remote.log<br> > mode = immediate<br> > queue_depth = 2048<br> > format = ascii<br> > network_retry_time = 100<br> <br> </span>This is probably not your problem but managed is the normal setting for<br> format. And do you have enable_krb5 set to no?<br> <span class="gmail-"><br> > I have enabled name_format=HOSTNAME only in one place (in<br> > /etc/audisp/audispd.conf - and not in /etc/audit/auditd.conf<br> ><br> > entries in auditd.conf:<br> ><br> > rtcp_listen_port = 6999<br> > tcp_listen_queue = 5<br> > tcp_max_per_addr = 10<br> > tcp_client_ports = 0-65535<br> > tcp_client_max_idle = 0<br> <br> </span>What do you have for use_libwrap and enable_krb5?<br> <br> The ausearcn info from the aggregating server should tell the reason why the<br> connection is rejected.<br> <span class="gmail-HOEnZb"><font color="#888888"><br> -Steve<br> </font></span><div class="gmail-HOEnZb"><div class="gmail-h5"><br> > I see the server is listening on the port 6999 as below but its not<br> > accepting client request.<br> > root@logs:/etc# lsof -i :6999<br> > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME<br> > audisp-re 9091 root 3u IPv4 33671 0t0 TCP 192.168.103.7:6999-><br> > <a href="http://192.168.103.7:6999" rel="noreferrer" target="_blank">192.168.103.7:6999</a> (ESTABLISHED)<br> ><br> ><br> ><br> > Best Regards,<br> > Rituraj B<br> <br> <br> </div></div></blockquote></div><br></div></div>