okynos
commented
2 years ago HP-UX tests
- Build: First time failed 🔴 https://ci.wazuh.info/view/Packages/job/Packages_builder_special/554/, Second time OK 🟢 https://ci.wazuh.info/view/Packages/job/Packages_builder_special/558/
- Install OK 🟢:
# tar -xvf wazuh-agent-4.3.8-1-hpux-11v3-ia64.tar x /var/ossec/logs/ossec.log, 0 bytes, 0 tape blocks x /var/ossec/logs/ossec.json, 0 bytes, 0 tape blocks x /var/ossec/logs/active-responses.log, 0 bytes, 0 tape blocks x /var/ossec/bin/wazuh-logcollector, 1560952 bytes, 3049 tape blocks x /var/ossec/bin/wazuh-syscheckd, 1848692 bytes, 3611 tape blocks x /var/ossec/bin/wazuh-execd, 1423588 bytes, 2781 tape blocks x /var/ossec/bin/manage_agents, 437940 bytes, 856 tape blocks x /var/ossec/bin/wazuh-control, 7148 bytes, 14 tape blocks x /var/ossec/bin/wazuh-modulesd, 1419492 bytes, 2773 tape blocks x /var/ossec/bin/wazuh-agentd, 1496872 bytes, 2924 tape blocks x /var/ossec/bin/agent-auth, 373124 bytes, 729 tape blocks x /var/ossec/lib/libwazuhext.so, 9737500 bytes, 19019 tape blocks x /var/ossec/lib/libwazuhshared.so, 218936 bytes, 428 tape blocks x /var/ossec/queue/syscollector/norm_config.json, 4206 bytes, 9 tape blocks x /var/ossec/ruleset/sca/sca_unix_audit.yml, 19069 bytes, 38 tape blocks x /var/ossec/wodles/__init__.py, 0 bytes, 0 tape blocks x /var/ossec/wodles/utils.py, 2075 bytes, 5 tape blocks x /var/ossec/wodles/aws/aws-s3, 171546 bytes, 336 tape blocks x /var/ossec/wodles/gcloud/pubsub/subscriber.py, 5143 bytes, 11 tape blocks x /var/ossec/wodles/gcloud/buckets/bucket.py, 13648 bytes, 27 tape blocks x /var/ossec/wodles/gcloud/buckets/access_logs.py, 1841 bytes, 4 tape blocks x /var/ossec/wodles/gcloud/gcloud, 4261 bytes, 9 tape blocks x /var/ossec/wodles/gcloud/integration.py, 2889 bytes, 6 tape blocks x /var/ossec/wodles/gcloud/tools.py, 5418 bytes, 11 tape blocks x /var/ossec/wodles/docker/DockerListener, 4705 bytes, 10 tape blocks x /var/ossec/etc/TIMEZONE, 21 bytes, 1 tape blocks x /var/ossec/etc/internal_options.conf, 13478 bytes, 27 tape blocks x /var/ossec/etc/local_internal_options.conf, 320 bytes, 1 tape blocks x /var/ossec/etc/client.keys, 0 bytes, 0 tape blocks x /var/ossec/etc/ossec.conf, 4855 bytes, 10 tape blocks x /var/ossec/etc/shared/cis_apache2224_rcl.txt, 28411 bytes, 56 tape blocks x /var/ossec/etc/shared/cis_debian_linux_rcl.txt, 12576 bytes, 25 tape blocks x /var/ossec/etc/shared/cis_mysql5-6_community_rcl.txt, 7609 bytes, 15 tape blocks x /var/ossec/etc/shared/cis_mysql5-6_enterprise_rcl.txt, 10297 bytes, 21 tape blocks x /var/ossec/etc/shared/cis_rhel5_linux_rcl.txt, 35781 bytes, 70 tape blocks x /var/ossec/etc/shared/cis_rhel6_linux_rcl.txt, 33870 bytes, 67 tape blocks x /var/ossec/etc/shared/cis_rhel7_linux_rcl.txt, 36957 bytes, 73 tape blocks x /var/ossec/etc/shared/cis_rhel_linux_rcl.txt, 17658 bytes, 35 tape blocks x /var/ossec/etc/shared/cis_sles11_linux_rcl.txt, 34376 bytes, 68 tape blocks x /var/ossec/etc/shared/cis_sles12_linux_rcl.txt, 35081 bytes, 69 tape blocks x /var/ossec/etc/shared/cis_win2012r2_domainL1_rcl.txt, 94877 bytes, 186 tape blocks x /var/ossec/etc/shared/cis_win2012r2_domainL2_rcl.txt, 28006 bytes, 55 tape blocks x /var/ossec/etc/shared/cis_win2012r2_memberL1_rcl.txt, 100530 bytes, 197 tape blocks x /var/ossec/etc/shared/cis_win2012r2_memberL2_rcl.txt, 376002 bytes, 735 tape blocks x /var/ossec/etc/shared/rootkit_files.txt, 16174 bytes, 32 tape blocks x /var/ossec/etc/shared/rootkit_trojans.txt, 5548 bytes, 11 tape blocks x /var/ossec/etc/shared/system_audit_rcl.txt, 4466 bytes, 9 tape blocks x /var/ossec/etc/shared/system_audit_ssh.txt, 3285 bytes, 7 tape blocks x /var/ossec/etc/shared/win_applications_rcl.txt, 5214 bytes, 11 tape blocks x /var/ossec/etc/shared/win_audit_rcl.txt, 4277 bytes, 9 tape blocks x /var/ossec/etc/shared/win_malware_rcl.txt, 7314 bytes, 15 tape blocks x /var/ossec/etc/wpk_root.pem, 1367 bytes, 3 tape blocks x /var/ossec/active-response/bin/restart.sh, 695 bytes, 2 tape blocks x /var/ossec/active-response/bin/kaspersky.py, 14429 bytes, 29 tape blocks x /var/ossec/active-response/bin/firewall-drop, 74444 bytes, 146 tape blocks x /var/ossec/active-response/bin/default-firewall-drop, 74444 bytes, 146 tape blocks x /var/ossec/active-response/bin/pf, 74040 bytes, 145 tape blocks x /var/ossec/active-response/bin/npf, 73972 bytes, 145 tape blocks x /var/ossec/active-response/bin/ipfw, 74028 bytes, 145 tape blocks x /var/ossec/active-response/bin/firewalld-drop, 74052 bytes, 145 tape blocks x /var/ossec/active-response/bin/disable-account, 73932 bytes, 145 tape blocks x /var/ossec/active-response/bin/host-deny, 74152 bytes, 145 tape blocks x /var/ossec/active-response/bin/ip-customblock, 73888 bytes, 145 tape blocks x /var/ossec/active-response/bin/restart-wazuh, 73680 bytes, 144 tape blocks x /var/ossec/active-response/bin/route-null, 73868 bytes, 145 tape blocks x /var/ossec/active-response/bin/kaspersky, 73728 bytes, 144 tape blocks x /var/ossec/active-response/bin/wazuh-slack, 73960 bytes, 145 tape blocks x /var/ossec/agentless/main.exp, 2453 bytes, 5 tape blocks x /var/ossec/agentless/register_host.sh, 2406 bytes, 5 tape blocks x /var/ossec/agentless/ssh.exp, 1476 bytes, 3 tape blocks x /var/ossec/agentless/ssh_asa-fwsmconfig_diff, 5283 bytes, 11 tape blocks x /var/ossec/agentless/ssh_foundry_diff, 5403 bytes, 11 tape blocks x /var/ossec/agentless/ssh_generic_diff, 898 bytes, 2 tape blocks x /var/ossec/agentless/ssh_integrity_check_bsd, 1091 bytes, 3 tape blocks x /var/ossec/agentless/ssh_integrity_check_linux, 1099 bytes, 3 tape blocks x /var/ossec/agentless/ssh_nopass.exp, 1616 bytes, 4 tape blocks x /var/ossec/agentless/ssh_pixconfig_diff, 5265 bytes, 11 tape blocks x /var/ossec/agentless/sshlogin.exp, 915 bytes, 2 tape blocks x /var/ossec/agentless/su.exp, 1381 bytes, 3 tape blocks x /sbin/init.d/wazuh-agent, 691 bytes, 2 tape blocks x /sbin/rc2.d/S97wazuh-agent symbolic link to /sbin/init.d/wazuh-agent x /sbin/rc3.d/S97wazuh-agent symbolic link to /sbin/init.d/wazuh-agent - Remove OK 🟢:
# /var/ossec/bin/wazuh-control stop Killing wazuh-modulesd... Killing wazuh-logcollector... Killing wazuh-syscheckd... Killing wazuh-agentd... Killing wazuh-execd... Wazuh v4.3.8 Stopped # groupdel wazuh # userdel wazuh # rm -rf /var/ossec - TCP and UDP OK connected and working 🟢
- No errors or warnings found 🟢
- Alerts found in manager 🟢:
{"timestamp":"2022-09-14T11:11:20.932+0000","rule":{"level":7,"description":"Host-based anomaly detection event (rootcheck).","id":"510","firedtimes":1,"mail":false,"groups":["ossec","rootcheck"],"pci_dss":["10.6.1"],"gdpr":["IV_35.7.d"]},"agent":{"id":"009","name":"sovmh315"},"manager":{"name":"ip-172-31-94-2.ec2.internal"},"id":"1663153880.63336","full_log":"File '/tmp/.kc.trace' is owned by root and has written permissions to anyone.","decoder":{"name":"rootcheck"},"data":{"title":"File is owned by root and has written permissions to anyone.","file":"/tmp/.kc.trace"},"location":"rootcheck"} - Users OK 🟢:
# ls -la /var/ossec/ total 128 drwxr-x--- 15 root wazuh 8192 Sep 14 04:44 . dr-xr-xr-x 28 bin bin 8192 Sep 14 05:13 .. drwxrwx--- 2 root wazuh 96 Sep 14 04:44 .ssh drwxr-x--- 3 root wazuh 96 Sep 14 04:44 active-response drwxr-x--- 2 root wazuh 8192 Sep 14 04:44 agentless drwxr-x--- 2 root wazuh 96 Sep 14 04:44 backup drwxr-x--- 2 root root 8192 Sep 14 04:44 bin drwxrwx--- 3 wazuh wazuh 8192 Sep 14 05:18 etc drwxr-x--- 2 root wazuh 96 Sep 14 04:44 lib drwxrwx--- 3 wazuh wazuh 96 Sep 14 04:44 logs drwxr-x--- 9 root wazuh 8192 Sep 14 04:44 queue drwxr-x--- 3 root wazuh 96 Sep 14 04:44 ruleset drwxrwx--T 2 root wazuh 96 Sep 14 05:41 tmp drwxr-x--- 7 root wazuh 8192 Sep 14 05:41 var drwxr-x--- 5 root wazuh 8192 Sep 14 04:44 wodles # cat /etc/passwd root:soSRAsp6Gmkdc:0:3::/:/sbin/sh daemon:*:1:5::/:/sbin/sh bin:*:2:2::/usr/bin:/sbin/sh sys:*:3:3::/: adm:*:4:4::/var/adm:/sbin/sh uucp:*:5:3::/var/spool/uucppublic:/usr/lbin/uucp/uucico lp:*:9:7::/var/spool/lp:/sbin/sh nuucp:*:11:11::/var/spool/uucppublic:/usr/lbin/uucp/uucico hpdb:*:27:1:ALLBASE:/:/sbin/sh nobody:*:-2:-2::/: www:*:30:1::/: cimsrvr:*:101:101:WBEM Services:/var/opt/wbem:/sbin/sh smbnull:*:102:102:DO NOT USE OR DELETE - needed by Samba:/var/opt/samba/nologin:/bin/false opc_op:*:777:177:OVO default operator:/home/opc_op:/sbin/sh hpsmh:*:103:103:System Management Homepage:/var/opt/hpsmh:/sbin/sh sfmdb:*:104:20::/home/sfmdb:/sbin/sh sshd:*:105:104:sshd privsep:/var/empty:/bin/false iwww:*:106:1::/home/iwww:/sbin/sh owww:*:107:1::/home/owww:/sbin/sh dfrench:Msz7PqZM8LnCk:49264:20:SO_Dana_French:/home/dfrench:/sbin/sh mfeha:soSRAsp6Gmkdc:59498:20:SO_Random_User_Name:/home/mfeha:/sbin/sh wazuh:*:108:20::/home/wazuh:/sbin/sh
rauldpm
fcaffieri
Packages tests metrics information
Build packages
Test packages
PPC64EL packages
OVA/AMI specific tests
Result legend: X - Not supported/Not done (delegated to basic package) ⚫ - Not started 🕐 - Pending/In progress ✔️ - Results Ready ⚠️ - Review required
Status legend: ⚫ - None 🔴 - Rejected 🟢 - Approved