[0.7.0] ossec: resolve journalist notification racing with reboots #3384
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 4 commits
May 9, 2018 21:45
The app server is rebooted every 24h and will send a notification at boot time. The ossec server is also rebooted and will immediately send the email to the journalist, regardless of when the previous mail was sent (mail frequency is not a feature of ossec-maild). Always running the localfile command at boot time is an undocumented OSSEC behavior ossec/ossec-hids#1415 in 2.8.2 as well as 2.9.3. This guarantees exactly one mail will be sent daily. Setting the 25 hours frequency element is a safeguard: * against the following race a) command runs because the 24h period expires, b) the server reboots shortly after because it reboots every 24h, c) command runs again after the server is rebooted, causing two notifications to be sent in a row * in case the server does not reboot for some reason, the notification will still be sent every 25h Fixes: #3367 (cherry picked from commit 91552eb)
(cherry picked from commit 81e9687)
Under some circumstances daily journalist notifications may be grouped with other ossec alerts. In all cases where this transient error was observed, a well formed journalist notification alert was also included in the payload. By changing the regular expression we make the script resilient to payloads that contain unrelated content. Mitigates #3368 (cherry picked from commit 0e5694b)
ghost
added
ghost
requested review from
|
I would merge it if I had permissions but it appears I don't have permission to merge in release/0.7 |
Codecov Report
@@ Coverage Diff @@
## release/0.7 #3384 +/- ##
===============================================
- Coverage 85.81% 85.79% -0.02%
===============================================
Files 34 34
Lines 2157 2154 -3
Branches 238 238
===============================================
- Hits 1851 1848 -3
Misses 250 250
Partials 56 56
Continue to review full report at Codecov.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status
Ready for review
Description of Changes
Backport #3374
Mitigates: #3368
The app server is rebooted every 24h and will send a notification at
boot time. The ossec server is also rebooted and will immediately send
the email to the journalist, regardless of when the previous mail was
sent (mail frequency is not a feature of ossec-maild). Always running
the localfile command at boot time is an undocumented OSSEC behavior
ossec/ossec-hids#1415 in 2.8.2 as well as
2.9.3.
This guarantees exactly one mail will be sent daily.
Setting the 25 hours frequency element is a safeguard:
against the following race a) command runs because the 24h period
expires, b) the server reboots shortly after because it reboots
every 24h, c) command runs again after the server is rebooted,
causing two notifications to be sent in a row
in case the server does not reboot for some reason, the notification
will still be sent every 25h
Fixes: #3367
Testing
Deployment
N/A
Checklist
If you made changes to documentation:
make docs-lint) passed locally