Issue with agent ids starting with zero '0'

[nbent...@gmail.com]

I'm guessing this is a bug with ossec-hids 3.2.0 (I upgraded from 2.4 soo) but when I try and remove an agent I get an error:

Provide the ID of the agent to be removed (or '\q' to quit): 0109

** Invalid ID '109' given. ID is not present.

manage_agents: Exiting.

my agents all start with zero's '0'

In the meantime how can I remove old agents starting with zero?

Thanks, Nate

[dan (ddp)]

On Wed, May 1, 2019 at 6:49 PM <nbent...@gmail.com> wrote:
>
> I'm guessing this is a bug with ossec-hids 3.2.0 (I upgraded from 2.4 soo) but when I try and remove an agent I get an error:
>
> Provide the ID of the agent to be removed (or '\q' to quit): 0109
>
> ** Invalid ID '109' given. ID is not present.
>
> manage_agents: Exiting.
>
> my agents all start with zero's '0'
>

That's very strange. How did that happen?

> In the meantime how can I remove old agents starting with zero?
>

You could try a text editor.


> Thanks, Nate
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups "ossec-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to ossec-dev+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[nbent...@gmail.com]

In my infinite wisdom back in 2009 I thought making my agents four digits long so I started at 0001. So the agent is actually 0109 but it's registering as 109.

Here is a full example:

- Adding a new agent (use '\q' to return to the main menu).

  Please provide the following:

   * A name for the new agent: TEST-1

   * The IP Address of the new agent: 1.1.1.1

   * An ID for the new agent[111]: 0999

Agent information:

   ID:999

   Name:TEST-1

   IP Address:1.1.1.1

Confirm adding it?(y/n): y

Agent added with ID 999.

****************************************

* OSSEC HIDS v3.2.0 Agent manager.     *

* The following options are available: *

****************************************

   (A)dd an agent (A).

   (E)xtract key for an agent (E).

   (L)ist already added agents (L).

   (R)emove an agent (R).

   (Q)uit.

Choose your action: A,E,L,R or Q: q

** You must restart OSSEC for your changes to take effect.

manage_agents: Exiting.

manage_agents: Exiting.

cat /var/ossec/etc/client.keys | grep TEST

999 TEST-1 1.1.1.1 dd795e1db91c27dff8a6377ba09c9d96ce1c643c6fa35882762326763b219ea3

 

On Thursday, May 2, 2019 at 10:20:48 AM UTC-4, ddp...@gmail.com wrote:

On Wed, May 1, 2019 at 6:49 PM <nbent...@gmail.com> wrote:
>
> I'm guessing this is a bug with ossec-hids 3.2.0 (I upgraded from 2.4 soo) but when I try and remove an agent I get an error:
>
> Provide the ID of the agent to be removed (or '\q' to quit): 0109
>
> ** Invalid ID '109' given. ID is not present.
>
> manage_agents: Exiting.
>
> my agents all start with zero's '0'
>

That's very strange. How did that happen?

> In the meantime how can I remove old agents starting with zero?
>

You could try a text editor.


> Thanks, Nate
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups "ossec-dev" group.

> To unsubscribe from this group and stop receiving emails from it, send an email to osse...@googlegroups.com.

[dan (ddp)]

I was able to successfully add agent 0555, and remove agent 555.

555 #*#*#*#*#*#*#*#*#*#*#5ea9d476e9395a498c6b738f7185bbabb05492ec93e546e46630d26

If removing just agent '109' (instead of 0109, which might be
interpreted as an octal number instead of decimal?) doesn't work,
I'd just delete the entries from client.keys manually (or hash them as
in the example above).

>
>
>
> On Thursday, May 2, 2019 at 10:20:48 AM UTC-4, ddp...@gmail.com wrote:
>>
>> On Wed, May 1, 2019 at 6:49 PM <nbent...@gmail.com> wrote:
>> >
>> > I'm guessing this is a bug with ossec-hids 3.2.0 (I upgraded from 2.4 soo) but when I try and remove an agent I get an error:
>> >
>> > Provide the ID of the agent to be removed (or '\q' to quit): 0109
>> >
>> > ** Invalid ID '109' given. ID is not present.
>> >
>> > manage_agents: Exiting.
>> >
>> > my agents all start with zero's '0'
>> >
>>
>> That's very strange. How did that happen?
>>
>> > In the meantime how can I remove old agents starting with zero?
>> >
>>
>> You could try a text editor.
>>
>>
>> > Thanks, Nate
>> >
>> > --
>> >
>> > ---
>> > You received this message because you are subscribed to the Google Groups "ossec-dev" group.
>> > To unsubscribe from this group and stop receiving emails from it, send an email to osse...@googlegroups.com.
>> > For more options, visit https://groups.google.com/d/optout.
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups "ossec-dev" group.

> To unsubscribe from this group and stop receiving emails from it, send an email to ossec-dev+...@googlegroups.com.