SCA module doesn't scans

1,953 views

Skip to first unread message

Carlos Lopez

unread,

May 20, 2019, 2:31:07 AM5/20/19

to wazuh

Hi all,

I have detected certain anomalies in the SCA module. My current configuration is:

<policies>
<policy>cis_rhel7_linux_rcl.yml</policy>
<policy>system_audit_rcl.yml</policy>
<policy>system_audit_ssh.yml</policy>
<policy>system_audit_pw.yml</policy>
</policies>
</sca>

It is the same config for my manager, all workers and all agents (I am using centralized configuration for my agents). Surprisingly, scanning does not occur on servers or agents as you can see in the attached screenshot.

Both the OpenSCAP and vulnerability detector modules don't present problems.

is this a bug or a configuration error?

Regards,
C. L. Martinez

sca.png

Sergio Cervilla

unread,

May 20, 2019, 5:53:54 AM5/20/19

to Carlos Lopez, wazuh

Hi Carlos,

I have been trying to reproduce your issue without success. I've set your configuration and I can see the alerts on Kibana.

First of all, let's check if you have any error or warning on your elasticsearch cluster:

# cat /var/log/elasticsearch/<cluster-name>.log | grep -i -E "warn|error|critical"

Now, let's check if the Security Configuration Assessment module is working properly. You can achieve this using the following command:

# cat /var/ossec/logs/ossec.log | grep -i -E "security configuration assessment"

In addition, could you search in the ossec.log for errors or warnings too?

# cat /var/ossec/logs/ossec.log | grep -i -E "warn|error|critical"

You can see if the agents or the manager has data about SCA scans using the API with the following command:

curl -u <user:password> -k -X GET "https://<manager_ip>:55000/sca/<agent_id>?pretty"

I'm waiting for your response.

Regards,

Sergio Cervilla 
IT Engineer — Wazuh, Inc.

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/VI1PR10MB2253B7A1C7A542B478FC943CDB060%40VI1PR10MB2253.EURPRD10.PROD.OUTLOOK.COM.
For more options, visit https://groups.google.com/d/optout.

Carlos Lopez

unread,

May 20, 2019, 10:25:36 AM5/20/19

to Sergio Cervilla, wazuh

Hi Sergio,

Outputs:

cat /var/log/elasticsearch/<cluster-name>.log | grep -i -E "warn|error|critical"

None

cat /var/ossec/logs/ossec.log | grep -i -E "security configuration assessment"

2019/05/20 09:55:19 sca: INFO: Starting Security Configuration Assessment scan.
2019/05/20 09:55:36 sca: INFO: Security Configuration Assessment scan finished. Duration: 17 seconds.

cat /var/ossec/logs/ossec.log | grep -i -E "warn|error|critical"

No output.

curl -u <user:password> -k -X GET "https://<manager_ip>:55000/sca/<agent_id>?pretty"

* About to connect() to 127.0.0.1 port 55000 (#0)
* Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 55000 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* NSS error -5938 (PR_END_OF_FILE_ERROR)
* Encountered end of file
* Closing connection 0
curl: (35) Encountered end of file

UHmm ... It doesn't work ...

Regards,
C. L. Martinez

________________________________________
From: Sergio Cervilla <sergio....@wazuh.com>
Sent: 20 May 2019 11:53
To: Carlos Lopez
Cc: wazuh
Subject: Re: SCA module doesn't scans

Hi Carlos,

I have been trying to reproduce your issue without success. I've set your configuration and I can see the alerts on Kibana.

First of all, let's check if you have any error or warning on your elasticsearch cluster:

# cat /var/log/elasticsearch/<cluster-name>.log | grep -i -E "warn|error|critical"

Now, let's check if the Security Configuration Assessment module is working properly. You can achieve this using the following command:

# cat /var/ossec/logs/ossec.log | grep -i -E "security configuration assessment"

In addition, could you search in the ossec.log for errors or warnings too?

# cat /var/ossec/logs/ossec.log | grep -i -E "warn|error|critical"

You can see if the agents or the manager has data about SCA scans using the API with the following command:

curl -u <user:password> -k -X GET "https://<manager_ip>:55000/sca/<agent_id>?pretty"

I'm waiting for your response.

Regards,
Sergio Cervilla
IT Engineer — Wazuh, Inc.

[https://www.google.com/a/cpanel/wazuh.com/images/logo.gif?alpha=1&service=google_default]<https://wazuh.com/>

On Mon, May 20, 2019 at 8:31 AM Carlos Lopez <clo...@outlook.com<mailto:clo...@outlook.com>> wrote:
Hi all,

I have detected certain anomalies in the SCA module. My current configuration is:

<policies>
<policy>cis_rhel7_linux_rcl.yml</policy>
<policy>system_audit_rcl.yml</policy>
<policy>system_audit_ssh.yml</policy>
<policy>system_audit_pw.yml</policy>
</policies>
</sca>

Both the OpenSCAP and vulnerability detector modules don't present problems.

is this a bug or a configuration error?

Regards,
C. L. Martinez

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com<mailto:wazuh%2Bunsu...@googlegroups.com>.
To post to this group, send email to wa...@googlegroups.com<mailto:wa...@googlegroups.com>.

Sergio Cervilla

unread,

May 21, 2019, 2:51:14 AM5/21/19

to Carlos Lopez, wazuh

Hi Carlos,

Since there are no errors or warnings in the logs, we must check if your database has data about SCA scans.

Try to execute the API call again but this time, using the http protocol instead of https because your API appears to be running with the first option.

curl -u foo:bar -k "http://127.0.0.1:55000/sca/000?pretty"

Furthermore, the agent will send only those checks which status have changed from previous scans in order to save network traffic and decreasing manager load.

If your database it's not empty, this could be the reason that you aren't seeing any alerts on your manager in that timeframe. To discard this scenario, you can change

the time range to a wider one.

Best regards,

Sergio Cervilla 
IT Engineer — Wazuh, Inc.

Carlos Lopez

unread,

May 21, 2019, 7:03:55 AM5/21/19

to Sergio Cervilla, wazuh

Thanks Sergio. Here is the output:

{
"error": 0,
"data": {
"totalItems": 4,
"items": [
{
"description": "Guidance for establishing a secure configuration for SSH service vulnerabilities.",
"total_checks": 9,
"hash_file": "4c7d05c9501ea38910e20ae22b1670b4f778669bd488482b4a19d179da9556ea",
"references": "https://www.ssh.com/ssh/",
"name": "System audit for SSH hardening",
"start_scan": "2019-05-20 09:55:29",
"score": 22,
"pass": 2,
"fail": 7,
"policy_id": "system_audit_ssh",
"invalid": 0,
"end_scan": "2019-05-20 09:55:29"
},
{
"description": "Guidance for establishing a secure configuration for password vulnerabilities.",
"total_checks": 4,
"hash_file": "1803ba1239bef3a052d7866a43af0518000b2db9c54809ff1a3def2796394685",
"references": "https://www.cisecurity.org/cis-benchmarks/",
"name": "System audit for password-related vulnerabilities",
"start_scan": "2019-05-20 09:55:32",
"score": 25,
"pass": 1,
"fail": 3,
"policy_id": "system_audit_pw",
"invalid": 0,
"end_scan": "2019-05-20 09:55:32"
},
{
"description": "Guidance for establishing a secure configuration for web-related vulnerabilities.",
"total_checks": 16,
"hash_file": "a4ad3c3a1409e04217eabb884589717861b9389b68eba897093a5571a7671e2f",
"name": "System audit for web-related vulnerabilities",
"start_scan": "2019-05-20 09:55:26",
"score": 0,
"pass": 0,
"fail": 0,
"policy_id": "system_audit",
"invalid": 16,
"end_scan": "2019-05-20 09:55:26"
},
{
"description": "This document provides prescriptive guidance for establishing a secure configuration posture for Red Hat Enterprise Linux 7 systems running on x86 and x64 platforms. This document was tested against Red Hat Enterprise Linux 7.4.",
"total_checks": 75,
"hash_file": "c4cf49ae248ddb5a3f0cd89fa659d64c0d6f90f9fdfcfc41defd8b0e916f1281",
"references": "https://www.cisecurity.org/cis-benchmarks/",
"name": "CIS Benchmark for Red Hat Enterprise Linux 7",
"start_scan": "2019-05-20 09:55:23",
"score": 62,
"pass": 33,
"fail": 20,
"policy_id": "cis_rhel7",
"invalid": 22,
"end_scan": "2019-05-20 09:55:23"
}
]
}
}

I have changed time range in Kibana, but result is the same. I've done another test with the SCA module. I have changed the option from <interval> to <time> and everything has started working correctly.

Regards,
C. L. Martinez

________________________________________
From: Sergio Cervilla <sergio....@wazuh.com>

Sent: 21 May 2019 08:50

To: Carlos Lopez
Cc: wazuh
Subject: Re: SCA module doesn't scans

Hi Carlos,

Since there are no errors or warnings in the logs, we must check if your database has data about SCA scans.

Try to execute the API call again but this time, using the http protocol instead of https because your API appears to be running with the first option.

curl -u foo:bar -k "http://127.0.0.1:55000/sca/000?pretty"

Furthermore, the agent will send only those checks which status have changed from previous scans in order to save network traffic and decreasing manager load.
If your database it's not empty, this could be the reason that you aren't seeing any alerts on your manager in that timeframe. To discard this scenario, you can change
the time range to a wider one.

Best regards,

Sergio Cervilla
IT Engineer — Wazuh, Inc.

[https://www.google.com/a/cpanel/wazuh.com/images/logo.gif?alpha=1&service=google_default]<https://wazuh.com/>

On Mon, May 20, 2019 at 4:25 PM Carlos Lopez <clo...@outlook.com<mailto:clo...@outlook.com>> wrote:
Hi Sergio,

Outputs:
cat /var/log/elasticsearch/<cluster-name>.log | grep -i -E "warn|error|critical"
None

cat /var/ossec/logs/ossec.log | grep -i -E "security configuration assessment"
2019/05/20 09:55:19 sca: INFO: Starting Security Configuration Assessment scan.
2019/05/20 09:55:36 sca: INFO: Security Configuration Assessment scan finished. Duration: 17 seconds.

cat /var/ossec/logs/ossec.log | grep -i -E "warn|error|critical"
No output.

curl -u <user:password> -k -X GET "https://<manager_ip>:55000/sca/<agent_id>?pretty"
* About to connect() to 127.0.0.1 port 55000 (#0)
* Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 55000 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* NSS error -5938 (PR_END_OF_FILE_ERROR)
* Encountered end of file
* Closing connection 0
curl: (35) Encountered end of file

UHmm ... It doesn't work ...

Regards,
C. L. Martinez

________________________________________
From: Sergio Cervilla <sergio....@wazuh.com<mailto:sergio....@wazuh.com>>

Sent: 20 May 2019 11:53
To: Carlos Lopez
Cc: wazuh
Subject: Re: SCA module doesn't scans