{"action":"created","issue":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/595","labels_url":"https://api.github.com/repos/ossec/ossec-hids/issues/595/labels{/name}","comments_url":"https://api.github.com/repos/ossec/ossec-hids/issues/595/comments","events_url":"https://api.github.com/repos/ossec/ossec-hids/issues/595/events","html_url":"https://github.com/ossec/ossec-hids/issues/595","id":69971649,"number":595,"title":"Unable to configure Agent as 'any'","user":{"login":"clonmac","id":8438213,"avatar_url":"https://avatars.githubusercontent.com/u/8438213?v=3","gravatar_id":"","url":"https://api.github.com/users/clonmac","html_url":"https://github.com/clonmac","followers_url":"https://api.github.com/users/clonmac/followers","following_url":"https://api.github.com/users/clonmac/following{/other_user}","gists_url":"https://api.github.com/users/clonmac/gists{/gist_id}","starred_url":"https://api.github.com/users/clonmac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clonmac/subscriptions","organizations_url":"https://api.github.com/users/clonmac/orgs","repos_url":"https://api.github.com/users/clonmac/repos","events_url":"https://api.github.com/users/clonmac/events{/privacy}","received_events_url":"https://api.github.com/users/clonmac/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ossec/ossec-hids/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/ossec/ossec-hids/labels/win32","name":"win32","color":"fef2c0"}],"state":"open","locked":false,"assignee":{"login":"awiddersheim","id":3237256,"avatar_url":"https://avatars.githubusercontent.com/u/3237256?v=3","gravatar_id":"","url":"https://api.github.com/users/awiddersheim","html_url":"https://github.com/awiddersheim","followers_url":"https://api.github.com/users/awiddersheim/followers","following_url":"https://api.github.com/users/awiddersheim/following{/other_user}","gists_url":"https://api.github.com/users/awiddersheim/gists{/gist_id}","starred_url":"https://api.github.com/users/awiddersheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/awiddersheim/subscriptions","organizations_url":"https://api.github.com/users/awiddersheim/orgs","repos_url":"https://api.github.com/users/awiddersheim/repos","events_url":"https://api.github.com/users/awiddersheim/events{/privacy}","received_events_url":"https://api.github.com/users/awiddersheim/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/ossec/ossec-hids/milestones/3","html_url":"https://github.com/ossec/ossec-hids/milestones/ossec-hids-2.9","labels_url":"https://api.github.com/repos/ossec/ossec-hids/milestones/3/labels","id":593396,"number":3,"title":"ossec-hids-2.9","description":"","creator":{"login":"jrossi","id":58556,"avatar_url":"https://avatars.githubusercontent.com/u/58556?v=3","gravatar_id":"","url":"https://api.github.com/users/jrossi","html_url":"https://github.com/jrossi","followers_url":"https://api.github.com/users/jrossi/followers","following_url":"https://api.github.com/users/jrossi/following{/other_user}","gists_url":"https://api.github.com/users/jrossi/gists{/gist_id}","starred_url":"https://api.github.com/users/jrossi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jrossi/subscriptions","organizations_url":"https://api.github.com/users/jrossi/orgs","repos_url":"https://api.github.com/users/jrossi/repos","events_url":"https://api.github.com/users/jrossi/events{/privacy}","received_events_url":"https://api.github.com/users/jrossi/received_events","type":"User","site_admin":false},"open_issues":11,"closed_issues":120,"state":"open","created_at":"2014-03-11T00:51:28Z","updated_at":"2015-05-11T19:47:32Z","due_on":null,"closed_at":null},"comments":8,"created_at":"2015-04-21T22:50:43Z","updated_at":"2015-05-21T15:20:44Z","closed_at":null,"body":"I just installed version 2.9.0-beta03 on my server (upgraded from latest release on ossec.net). I then removed the extracted source folder and unzipped it again and then proceeded to compile the source for the Windows Agent. I am looking to use a development version of OSSEC so that I can utilize the EventChannel fixes that were put in place from issue #457. I installed the agent on a Windows 7 PC and configured an agent on the server (Ubuntu Server 14.04LTS).\r\n\r\nThe problem is that when configuring an agent on the server, the only way I can get the agent to connect successfully is if I specify the client's IP explicitly. If I use a CIDR address or 'any' the agent won't connect. I receive the following error in ossec.log on the server:\r\n\r\nossec-remoted(1213): WARN: Message from <agentIPhere> not allowed\r\n\r\nOn the client side it shows this in the log:\r\n\r\n2015/04/20 13:08:50 ossec-agent: WARN: Process locked. Waiting for permission...\r\n2015/04/20 13:09:01 ossec-agent(4101): WARN: Waiting for server reply (not started). Tried: '<serverIPhere>'.\r\n2015/04/20 13:09:03 ossec-agent: INFO: Trying to connect to server (<serverIPhere>:1514).\r\n\r\nIf I revert the server and agent back to the original version (official latest release from ossec.net), everything will work fine and I the agent will connect when I use 'any'. There is no firewall blocking anything on the server and it is ossec-remoted that is refusing the connection.\r\n\r\nI have also tried version 2.9.0-beta02 and also the latest master here on github and have the same problem. I am not sure if it is a problem with how I am compiling it or if there is a bug somewhere. Let me know if you need any more information or if I can help with testing. I am in a pre-deployment scenario so I don't mind blowing away the server and starting from scratch. I've done that numerous time so far. When the agent on the server is configured with the static IP, everything works great and the EventChannel logs come across formatted perfectly. Thanks."},"comment":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/comments/104317432","html_url":"https://github.com/ossec/ossec-hids/issues/595#issuecomment-104317432","issue_url":"https://api.github.com/repos/ossec/ossec-hids/issues/595","id":104317432,"user":{"login":"awiddersheim","id":3237256,"avatar_url":"https://avatars.githubusercontent.com/u/3237256?v=3","gravatar_id":"","url":"https://api.github.com/users/awiddersheim","html_url":"https://github.com/awiddersheim","followers_url":"https://api.github.com/users/awiddersheim/followers","following_url":"https://api.github.com/users/awiddersheim/following{/other_user}","gists_url":"https://api.github.com/users/awiddersheim/gists{/gist_id}","starred_url":"https://api.github.com/users/awiddersheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/awiddersheim/subscriptions","organizations_url":"https://api.github.com/users/awiddersheim/orgs","repos_url":"https://api.github.com/users/awiddersheim/repos","events_url":"https://api.github.com/users/awiddersheim/events{/privacy}","received_events_url":"https://api.github.com/users/awiddersheim/received_events","type":"User","site_admin":false},"created_at":"2015-05-21T15:20:43Z","updated_at":"2015-05-21T15:20:43Z","body":"I'm wondernig if this will fix:\r\n\r\n```\r\ndiff --git a/src/Makefile b/src/Makefile\r\nindex e37945d..3946fa2 100644\r\n--- a/src/Makefile\r\n+++ b/src/Makefile\r\n@@ -1213,19 +1213,19 @@ win32/ui/%.o: win32/ui/%.c\r\n        ${OSSEC_CC} ${OSSEC_CFLAGS} -UOSSECHIDS -DARGV0=\\\"ossec-win32ui\\\" -c $^ -o $@\r\n \r\n win32/ossec-agent.exe: win32/icon.o win32/win_agent.o win32/win_service.o ${syscheck_o} ${rootcheck_o} $(filter-out client-agent/main.o, $(filter-out client-agent/agentd.o, $(filter-out client-\r\n-       ${OSSEC_CCBIN} -DARGV0=\\\"ossec-agent\\\" -DOSSECHIDS ${OSSEC_CFLAGS} $^ ${OSSEC_LDFLAGS} -o $@\r\n+       ${OSSEC_CCBIN} -DCLIENT -DARGV0=\\\"ossec-agent\\\" -DOSSECHIDS ${OSSEC_CFLAGS} $^ ${OSSEC_LDFLAGS} -o $@\r\n \r\n win32/ossec-agent-eventchannel.exe: win32/icon.o win32/win_agent.o win32/win_service.o ${syscheck_o} ${rootcheck_o} $(filter-out client-agent/main.o, $(filter-out client-agent/agentd.o, $(filte\r\n-       ${OSSEC_CCBIN} -DARGV0=\\\"ossec-agent\\\" -DOSSECHIDS -DEVENTCHANNEL_SUPPORT ${OSSEC_CFLAGS} $^ ${OSSEC_LDFLAGS} -o $@\r\n+       ${OSSEC_CCBIN} -DCLIENT -DARGV0=\\\"ossec-agent\\\" -DOSSECHIDS -DEVENTCHANNEL_SUPPORT ${OSSEC_CFLAGS} $^ ${OSSEC_LDFLAGS} -o $@\r\n \r\n win32/ossec-rootcheck.exe: win32/icon.o win32/win_service_rk.o ${rootcheck_rk_o} ${ossec_libs}\r\n-       ${OSSEC_CCBIN} -DARGV0=\\\"ossec-rootcheck\\\" ${OSSEC_CFLAGS} $^ ${OSSEC_LDFLAGS} -o $@\r\n+       ${OSSEC_CCBIN} -DCLIENT -DARGV0=\\\"ossec-rootcheck\\\" ${OSSEC_CFLAGS} $^ ${OSSEC_LDFLAGS} -o $@\r\n \r\n win32/manage_agents.exe: win32/win_service_rk.o ${addagent_o} ${ossec_libs} ${ZLIB_LIB}\r\n-       ${OSSEC_CCBIN} -DARGV0=\\\"manage-agents\\\" -DMA ${OSSEC_CFLAGS} $^ ${OSSEC_LDFLAGS} -o $@\r\n+       ${OSSEC_CCBIN} -DCLIENT -DARGV0=\\\"manage-agents\\\" -DMA ${OSSEC_CFLAGS} $^ ${OSSEC_LDFLAGS} -o $@\r\n \r\n win32/setup-windows.exe: win32/win_service_rk.o win32/setup-win.o win32/setup-shared.o ${ossec_libs}\r\n-       ${OSSEC_CCBIN} -DARGV0=\\\"setup-windows\\\" ${OSSEC_CFLAGS} $^ ${OSSEC_LDFLAGS} -o $@\r\n+       ${OSSEC_CCBIN} -DCLIENT -DARGV0=\\\"setup-windows\\\" ${OSSEC_CFLAGS} $^ ${OSSEC_LDFLAGS} -o $@\r\n \r\n win32/setup-syscheck.exe: win32/setup-syscheck.o win32/setup-shared.o ${ossec_libs}\r\n        ${OSSEC_CCBIN} -DARGV0=\\\"setup-syscheck\\\" ${OSSEC_CFLAGS} $^ ${OSSEC_LDFLAGS} -o $@\r\n```"}}