OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
Seems to stop generating the errors after ~40 seconds. This is on a Windows 10 (latest patches) host. Linux clients using the auth agent appear to have no similar issue.
When a client attempts to register for a key with the command:
agent-auth.exe -m
it appears to hang on the client side, and on the server side, we're seeing the following messages:
2022/08/11 19:00:55 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:00:55 ossec-authd: DEBUG: Process 31156 exited 2022/08/11 19:00:55 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:00:56 ossec-authd: DEBUG: Process 31157 exited 2022/08/11 19:00:56 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:00:56 ossec-authd: DEBUG: Process 31158 exited 2022/08/11 19:00:56 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:00:56 ossec-authd: DEBUG: Process 31152 exited 2022/08/11 19:00:56 ossec-authd: DEBUG: Process 31159 exited 2022/08/11 19:00:56 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:00:56 ossec-authd: DEBUG: Process 31160 exited 2022/08/11 19:00:56 ossec-authd: DEBUG: Process 31155 exited 2022/08/11 19:00:56 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:00:56 ossec-authd: DEBUG: Process 31161 exited 2022/08/11 19:00:56 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:00:57 ossec-authd: DEBUG: Process 31162 exited 2022/08/11 19:00:57 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:00:57 ossec-authd: DEBUG: Process 31163 exited 2022/08/11 19:00:58 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:00:58 ossec-authd: DEBUG: Process 31164 exited 2022/08/11 19:00:59 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:00:59 ossec-authd: DEBUG: Process 31165 exited 2022/08/11 19:01:00 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:00 ossec-authd: DEBUG: Process 31166 exited 2022/08/11 19:01:00 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:00 ossec-authd: DEBUG: Process 31167 exited 2022/08/11 19:01:00 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:00 ossec-authd: DEBUG: Process 31168 exited 2022/08/11 19:01:01 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:01 ossec-authd: DEBUG: Process 31169 exited 2022/08/11 19:01:01 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:01 ossec-authd: DEBUG: Process 31170 exited 2022/08/11 19:01:01 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:01 ossec-authd: DEBUG: Process 31171 exited 2022/08/11 19:01:01 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:02 ossec-authd: DEBUG: Process 31188 exited 2022/08/11 19:01:03 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:03 ossec-authd: DEBUG: Process 31189 exited 2022/08/11 19:01:03 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:03 ossec-authd: DEBUG: Process 31190 exited 2022/08/11 19:01:03 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:03 ossec-authd: DEBUG: Process 31191 exited 2022/08/11 19:01:04 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:04 ossec-authd: DEBUG: Process 31192 exited 2022/08/11 19:01:06 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:07 ossec-authd: DEBUG: Process 31193 exited 2022/08/11 19:01:09 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:09 ossec-authd: DEBUG: Process 31194 exited 2022/08/11 19:01:09 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:09 ossec-authd: DEBUG: Process 31195 exited 2022/08/11 19:01:09 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:10 ossec-authd: DEBUG: Process 31196 exited 2022/08/11 19:01:10 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:10 ossec-authd: DEBUG: Process 31197 exited 2022/08/11 19:01:12 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:12 ossec-authd: DEBUG: Process 31198 exited 2022/08/11 19:01:12 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:12 ossec-authd: DEBUG: Process 31199 exited 2022/08/11 19:01:13 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:14 ossec-authd: DEBUG: Process 31200 exited 2022/08/11 19:01:16 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:16 ossec-authd: DEBUG: Process 31201 exited 2022/08/11 19:01:17 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:17 ossec-authd: DEBUG: Process 31202 exited 2022/08/11 19:01:20 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:20 ossec-authd: DEBUG: Process 31203 exited 2022/08/11 19:01:36 ossec-authd: ERROR: SSL Error (0) 2022/08/11 19:01:36 ossec-authd: DEBUG: Process 31212 exited
Seems to stop generating the errors after ~40 seconds. This is on a Windows 10 (latest patches) host. Linux clients using the auth agent appear to have no similar issue.