ClearFoundation Tracker - ClearOS
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0006721ClearOSsyswatchpublic2015-12-10 08:092016-01-28 12:23
Reporterbchambers 
Assigned Touser2 
PrioritynormalSeveritymajorReproducibilitysometimes
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version7.1.0 
Target Version7.2.0Fixed in Version7.2.0 
Summary0006721: IPS can block ClearOS's WAN IP
DescriptionLogged into a box yesterday where snortsam had created a rule that blocked all traffic from ClearOS's WAN IP.

SID was 3000001.

Darryl thought that in past versions, it was impossible for snortsam to block an IP associated with the server.

Something changed?

Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2015-12-10 08:09bchambersNew Issue
2015-12-10 08:36user2Note Added: 0002401
2015-12-10 19:59user2Note Added: 0002411
2015-12-10 20:00user2Statusnew => confirmed
2015-12-10 20:00user2Categoryapp-intrusion-prevention - Intrusion Prevention => syswatch
2015-12-10 20:06user2Statusconfirmed => resolved
2015-12-10 20:06user2Fixed in Version => 7.1.0 Updates
2015-12-10 20:06user2Resolutionopen => fixed
2015-12-10 20:06user2Assigned To => user2
2015-12-10 20:07user2Fixed in Version7.1.0 Updates => 7.2.0 Beta 1
2015-12-10 20:07user2Target Version => 7.2.0 Beta 1
2015-12-10 20:08user2Note Added: 0002421
2016-01-01 12:56user2Fixed in Version7.2.0 Beta 1 => 7.2.0
2016-01-01 12:59user2Target Version7.2.0 Beta 1 => 7.2.0
2016-01-28 12:23user2Statusresolved => closed

Notes
(0002401)
user2   
2015-12-10 08:36   
WAN IPs, DNS servers, and gateways should be getting added to the Snortsam whitelist. A missed network event? Do you still have access to the system? What's the system name?
(0002411)
user2   
2015-12-10 19:59   
Confirmed. The /etc/snortsam.d/system-autowhitelist.conf was populated, but the system IP list was empty:

# This file is auto-generated by syswatch
# Ping servers
dontblock 54.152.208.245
dontblock 8.8.8.8
# DNS servers
dontblock 192.168.11.4
# System IP addresses
      <--- nada


Syswatch handles the auto-whitelist, though this should really be moved to the clearsync/event system.
(0002421)
user2   
2015-12-10 20:08   
The ifconfig output changed a bit in ClearOS 7 - parser needed an update.