Mac client cant register

[Taylor Loyd]

I am getting an error when trying to run the agent or register below is the error. Im running 10.12.6 Sierra

dyld: Library not loaded: /Library/Ossec/lib/libssl.1.0.0.dylib

  Referenced from: /Library/Ossec/bin/ossec-agentd

  Reason: image not found

[Victor Fernandez]

Hi Taylor,

I'm sorry you're having problems with macOS. I've tested the agent-auth tool in both macOS Sierra and High Sierra and got no problems.

Are you using the Wazuh Agent installer for macOS from https://documentation.wazuh.com/current/installation-guide/packages-list/index.html#mac-os-x? The latest version is currently v2.1.1-1.

This is an execution example after installing the Agent package:

MacBook-Pro:~ user$ sudo su

sh-3.2# /Library/Ossec/bin/agent-auth -m 192.168.2.2

2017/10/18 19:36:28 agent-auth: INFO: Started (pid: 42673).

WARN: No authentication password provided.

INFO: Connected to 192.168.2.2:1515

INFO: Using agent name as: MacBook-Pro.local

INFO: Send request to manager. Waiting for reply.

INFO: Received response with agent key

INFO: Valid key created. Finished.

INFO: Connection closed.

Please confirm that you are using that package. If this problem persists tell us what steps are you following and we'll be happy to help you.

Best regards.

Victor.

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/59edccef-c840-4d3a-953f-cb37c0f21726%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Victor M. Fernandez-Castro

IT Security Engineer

Wazuh Inc.

[Taylor Loyd]

Victor,

I installed the agent using the installer. It appears that for some reason for me the two libraries and files were not added during the installation. I have since been able to fix that issue but now I can not get my client to connect to the server. I was able to register using /Library/Ossec/bin/agent-auth -m 10.0.0.11 but on the console it shows the name and ID but not with the address and status is never connected. Any tips would be appreciated.

[Victor Fernandez]

Hi Taylor,

I'm glad you've got your agent connected. Have you configured the manager address in the ossec.conf file?

This is an example configuration:

# cd /Library/Ossec
# nano etc/ossec.conf

  <client>

    <server-ip>192.168.2.2</server-ip>

    <config-profile>darwin, darwin16, darwin16.6</config-profile>

    <protocol>udp</protocol>

  </client>

After setting the manager IP, restart the agent:

# bin/ossec-control restart

Now, you should see a log like this one at etc/ossec.log:

2017/10/19 02:41:37 ossec-agentd: INFO: Trying to connect to server (192.168.2.2:1514).

2017/10/19 02:41:38 ossec-agentd: INFO: (4102): Connected to the server (192.168.2.2:1514).

On the other hand, a new alert should appear in the manager (/var/ossec/logs/alerts/alerts.log):

** Alert 1508373708.31077: mail  - ossec,pci_dss_10.6.1,

2017 Oct 18 17:41:48 (Vikmans-MacBook-Pro.local) any->ossec

Rule: 501 (level 3) -> 'New ossec agent connected.'

ossec: Agent started: 'MacBook-Pro.local->any'.

If any error occurs, take a look at /var/ossec/logs/ossec.log in the manager and /Library/Ossec/logs/ossec.log in the agent.

Hope it help.

Victor.

--

You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/aef8da6b-f22d-4329-b2e1-2e46ae081fac%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Luke Lee]

Taylor Loyd,  May I know how did you configure and open the firewall port on your Mac? Mine is unable to connect to the server. Please help.