jnasselle
commented
1 year ago Analysis report - AIX :green_circle:
System info
``` bash-4.4$ hostname soaxp078 bash-4.4$ uname -a AIX soaxp078 1 6 00CADA644C00 ```Build :green_circle:
[aix-4.4.0-rc2-compilation.log](https://github.com/wazuh/wazuh/files/11017316/aix-4.4.0-rc2-compilation.log)Install :green_circle:
- Wazuh agent ``` bash-4.4$ curl -k -LO https://packages-dev.wazuh.com/pre-release/aix/wazuh-agent-4.4.0-1.aix.ppc.rpm % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 8261k 100 8261k 0 0 4473k 0 0:00:01 0:00:01 --:--:-- 4475k bash-4.4$ ls wazuh-agent-4.4.0-1.aix.ppc.rpm bash-4.4$ rpm -qip wazuh-agent-4.4.0-1.aix.ppc.rpm Name : wazuh-agent Relocations: (not relocateable) Version : 4.4.0 Vendor: Wazuh, IncAlerts :green_circle:
   ``` [root@wazuh-server wazuh-user]# grep "1679313455.96078" /var/ossec/logs/alerts/alerts.json {"timestamp":"2023-03-20T11:57:35.478+0000","rule":{"level":9,"description":"SCA summary: System audit for Unix based systems: Score less than 30% (0)","id":"19005","firedtimes":2,"mail":false,"groups":["sca"],"gdpr":["IV_35.7.d"],"pci_dss":["2.2"],"nist_800_53":["CM.1"],"tsc":["CC7.1","CC7.2"]},"agent":{"id":"001","name":"soaxp078"},"manager":{"name":"wazuh-server"},"id":"1679313455.96078","decoder":{"name":"sca"},"data":{"sca":{"type":"summary","scan_id":"20173","policy":"System audit for Unix based systems","description":"Guidance for establishing a secure configuration for Unix based systems.","policy_id":"unix_audit","passed":"0","failed":"10","invalid":"13","total_checks":"23","score":"0","file":"sca_unix_audit.yml"}},"location":"sca"} ``` - TCP connection OK - UDP connection OK ``` bash-4.4# grep "tcp" /var/ossec/logs/ossec.log 2023/03/20 06:39:49 wazuh-agentd: INFO: Trying to connect to server ([xxx.xxx.xxx.xxx]:1514/tcp). 2023/03/20 06:39:49 wazuh-agentd: INFO: (4102): Connected to the server ([xxx.xxx.xxx.xxx]:1514/tcp). bash-4.4# grep "udp" /var/ossec/logs/ossec.log 2023/03/20 07:03:12 wazuh-agentd: INFO: Trying to connect to server ([xxx.xxx.xxx.xxx]:1514/udp). 2023/03/20 07:03:12 wazuh-agentd: INFO: (4102): Connected to the server ([xxx.xxx.xxx.xxx]:1514/udp). ```Remove :red_circle:
``` bash-4.4# rpm -e wazuh-agent rmdir of /var/ossec/tmp/src/init failed: No such file or directory rmdir of /var/ossec/tmp/etc/templates/config/generic/localfile-logs failed: No such file or directory rmdir of /var/ossec/tmp/etc/templates/config/generic failed: No such file or directory rmdir of /var/ossec/tmp/etc/templates/config failed: No such file or directory rmdir of /var/ossec/tmp/etc/templates failed: No such file or directory cannot remove /var/ossec/queue/syscollector/db - directory not empty cannot remove /var/ossec/queue/syscollector - directory not empty cannot remove /var/ossec/queue/logcollector - directory not empty cannot remove /var/ossec/queue/fim/db - directory not empty cannot remove /var/ossec/queue/fim - directory not empty cannot remove /var/ossec/queue - directory not empty removal of /var/ossec/logs/ossec.json failed: No such file or directory cannot remove /var/ossec/etc/shared - directory not empty cannot remove /var/ossec/etc - directory not empty cannot remove /var/ossec - directory not empty bash-4.4# ps -ef | grep wazuh bash-4.4# ls -l /var/ossec/ total 182408 -rw------- 1 root system 93389432 Mar 20 06:39 core drwxrwx--- 3 208 207 256 Mar 20 07:06 etc drwxr-x--- 5 root 207 256 Mar 20 07:06 queue bash-4.4# ls -la /var/ossec/core -rw------- 1 root system 93389432 Mar 20 06:39 /var/ossec/core ``` ERROR: It's seems to be that during uninstalling procedure, a core dump was generated by modulesdUpgrade 4.3.10 -> 4.4.0 :green_circle:
``` bash-4.4# curl -k -LO WAZUH_MANAGER="xxx.xxx.xxx.xxx" rpm -ivh wazuh-agent-4.3.10-1.aix.ppc.rpm^C bash-4.4# curl -k -LO https://packages.wazuh.com/4.x/aix/wazuh-agent-4.3.10-1.aix.ppc.rpm % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 8080k 100 8080k 0 0 4739k 0 0:00:01 0:00:01 --:--:-- 4739k bash-4.4# WAZUH_MANAGER="44.192.45.229" rpm -ivh wazuh-agent-4.3.10-1.aix.ppc.rpm wazuh-agent ################################################## bash-4.4# /var/ossec/bin/wazuh-control info WAZUH_VERSION="v4.3.10" WAZUH_REVISION="40323" WAZUH_TYPE="agent" bash-4.4# /var/ossec/bin/wazuh-control start Starting Wazuh v4.3.10... Started wazuh-execd... Started wazuh-agentd... Started wazuh-syscheckd... Started wazuh-logcollector... Started wazuh-modulesd... Completed. bash-4.4# /var/ossec/bin/wazuh-control status wazuh-modulesd is running... wazuh-logcollector is running... wazuh-syscheckd is running... wazuh-agentd is running... wazuh-execd is running... ```  ``` bash-4.4# curl -k -LO https://packages-dev.wazuh.com/pre-release/aix/wazuh-agent-4.4.0-1.aix.ppc.rpm % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 8261k 100 8261k 0 0 4753k 0 0:00:01 0:00:01 --:--:-- 4753k bash-4.4# rpm -U wazuh-agent-4.4.0-1.aix.ppc.rpm bash-4.4# /var/ossec/bin/wazuh-control info WAZUH_VERSION="v4.4.0" WAZUH_REVISION="40404" WAZUH_TYPE="agent" bash-4.4# /var/ossec/bin/wazuh-control status wazuh-modulesd is running... wazuh-logcollector is running... wazuh-syscheckd is running... wazuh-agentd is running... wazuh-execd is running... bash-4.4# grep -Ei "ERROR|CRITICAL|FATAL|WARNING" /var/ossec/logs/ossec.log bash-4.4# ```  Findings: Modulesd crash during AIX package uninstall #16469
rauldpm
c-bordon
Packages tests metrics information
Build packages
Test packages
PPC64EL packages
OVA/AMI specific tests
Status legend: :black_circle: - Pending/In progress :white_circle: - Skipped :red_circle: - Rejected :yellow_circle: - Ready to review :green_circle: - Approved
Auditor's validation
In order to close and proceed with the release or the next candidate version, the following auditors must give the green light to this RC.