{"id":1479,"date":"2013-06-14T12:41:53","date_gmt":"2013-06-14T16:41:53","guid":{"rendered":"http:\/\/mossiso.com\/?p=1479"},"modified":"2014-09-22T14:36:14","modified_gmt":"2014-09-22T18:36:14","slug":"ossec-suhosin-and-wordpress","status":"publish","type":"post","link":"https:\/\/mossiso.com\/2013\/06\/14\/ossec-suhosin-and-wordpress\/","title":{"rendered":"OSSEC, Suhosin, and WordPress"},"content":{"rendered":"

I had a problem show up on some of our servers. Visiting sites would work fine, but as soon as you log in to a WordPress site, then your IP was blocked at the firewall level. It took a bit of hunting around the OSSEC logs to figure out the cause, and then finally tipped off<\/a> to a local rule to combat the blockage. I outline the process of figuring out what was wrong, and how to fix it below.<\/p>\n

DENIED!<\/h2>\n

\"gareth-davies-logo3\"<\/a>So initially, this was quite confusing. All of a sudden people would have their IP blocked. I checked the different sites, and seemed to have no problem. Then when I logged in to the back end, BAM, blocked as well. We have Shorewall<\/a> running, so doing:<\/p>\n

shorewall show dynamic<\/pre>\n
Showed all of the IPs that Shorewall had blocked. This could also be done by using iptables<\/p>\n
iptables -nL --line-numbers<\/pre>\n
Sure enough, my IP had been blocked. I unblocked my IP with:<\/p>\n
shorewall allow ip.ad.dr.es<\/pre>\n
Or could also do<\/p>\n
iptables -D INPUT 2<\/pre>\n
where INPUT is the position or section of the firewall chain, and “2” is the line number containing my IP address.<\/p>\n
Then I checked with other web applications on that server. Where they also causing an issue? I logged in to an Omeka install. No problems.<\/p>\n
FOUND IT!<\/h2>\n
\"ossec_logo\"<\/a>OK. I know OSSEC<\/a> is to blame some how. It’s an awesome HIDS (Host Intrusion Detection Software) that actively responds to issues on the server based on scanning through the system logs and various rules.<\/p>\n
OSSEC keeps itself chroot’ed to \/var\/ossec\/, so all of the ossec logs are located in \/var\/ossec\/logs\/.<\/p>\n
I first looked in the \/var\/ossec\/logs\/active-responses.log. Sure enough, a couple of lines like this show my IP being completely blocked to the server.<\/p>\n
Fri Jun 14 06:50:47 EDT 2013 \/var\/ossec\/active-response\/bin\/host-deny.sh add - XXX.XX.XX.XX 1371207047.5913585 20101\r\nFri Jun 14 06:50:47 EDT 2013 \/var\/ossec\/active-response\/bin\/firewall-drop.sh add - XXX.XX.XX.XX 1371207047.5913585 20101\r\n<\/pre>\n
So, there we are. OSSEC blocking the IP for some reason. Now why is it blocking the IP?<\/span><\/p>\n
Taking a look in the \/var\/ossec\/logs\/alerts\/alerts.log file to see why it thinks it needs to block the IP…<\/p>\n
** Alert 1371206381.5698606: - ids,\r\n2013 Jun 14 06:39:41 (server1) 127.0.0.1->\/var\/log\/messages\r\nRule: 20101 (level 6) -> 'IDS event.'\r\nSrc IP: XXX.XX.XX.XX\r\nJun 14 06:39:40 server1 suhosin[18563]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker 'XXX.XX.XX.XX', file '\/var\/html\/wp-admin\/admin.php', line 109)<\/pre>\n
There were other lines in there with my IP, but nothing would\/should have caused blocking, like a WordPress login event, or an SSH login event. Also, the error above is categorized as an IDS event with level 6, which by default OSSEC rules means it gets blocked.<\/p>\n
HOW TO FIX IT!<\/h2>\n
As a quick fix, I changed the “suhosin.memory_limit” option in \/etc\/php.d\/suhosin.ini to 256M, and the “memory_limit” in \/etc\/php.ini to 256M so that no error would be generated.<\/p>\n
Now came the hard part of finding out how to fix it for real. OSSEC is a pretty big beast to tackle, so I turned to my friendly web search engine to help out.<\/p>\n
To fix the issue, I would need to write a decoder or new rule to ignore the suhosin rule causing the problem. OSSEC has descent documentation to get you started, but fortunately the blog linked above had the solution already. https:\/\/www.atomicorp.com\/forum\/viewtopic.php?f=3&t=5612<\/a><\/p>\n
From user ‘faris’ in the forum linked above:<\/p>\n
Add the following lines the the \/var\/ossec\/etc\/rules.d\/local_rules.xml file.
\n<\/b><\/p>\n
<group name=\"local,ids,\">\r\n  <!-- First Time Suhosin event rule -->\r\n  <rule id=\"101006\" level=\"14\">\r\n    <if_sid>20100<\/if_sid>\r\n    <decoded_as>suhosin<\/decoded_as>\r\n    <description>First Time Suhosin Event<\/description>\r\n  <\/rule>\r\n  <!-- Generic Suhosin event rule -->\r\n  <rule id=\"101007\" level=\"12\">\r\n    <if_sid>20101<\/if_sid>\r\n    <decoded_as>suhosin<\/decoded_as>\r\n    <description>Suhosin Event<\/description>\r\n  <\/rule>\r\n  <!-- Specific Suhosin event rule -->\r\n  <rule id=\"101008\" level=\"5\">\r\n    <if_sid>101006,101007<\/if_sid>\r\n    <match>script tried to increase memory<\/match>\r\n    <description>Suhosin Memory Increase Event<\/description>\r\n  <\/rule>\r\n<\/group>\r\n<\/pre>\n
What these new rules do is change the level of the default rules that were tagged\/decoded as being suhosin errors. In the first rule, if the default error is 20100, and is decoded (or tagged, or matches) as suhosin, then set the level to 14 instead of the default 8.<\/span><\/p>\n
The second rule detects if the default error 20101 is decoded as coming from suhosin and sets the level to 12 instead of the default 6.<\/p>\n
The third new rule looks at any error tagged as suhosin and if the error has the matching text in it, then it sets the error level to 5 (below the limit for firing an active response).<\/p>\n
So, just add that group of rules to the local_rules.xml file and restart the OSSEC service. BA-DA-BING! no more blocking the IP when logging in to WordPress.<\/p>\n","protected":false},"excerpt":{"rendered":"
I had a problem show up on some of our servers. Visiting sites would work fine, but as soon as you log in to a WordPress site, then your IP was blocked at the firewall level. It took a bit of hunting around the OSSEC logs to figure out the cause, and then finally tipped … Continue reading OSSEC, Suhosin, and WordPress<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":1498,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[259,167,10],"tags":[262,263,260,261,223,278],"class_list":["post-1479","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-systems-administration-technical","category-technical","category-wordpress","tag-firewall","tag-iptables","tag-ossec","tag-shorewall","tag-systems-administration","tag-wordpress"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/mossiso.com\/wp-content\/uploads\/2013\/06\/Access_Denied_-_geograph.org_.uk_-_1197284.jpg","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9wosP-nR","_links":{"self":[{"href":"https:\/\/mossiso.com\/wp-json\/wp\/v2\/posts\/1479"}],"collection":[{"href":"https:\/\/mossiso.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mossiso.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mossiso.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mossiso.com\/wp-json\/wp\/v2\/comments?post=1479"}],"version-history":[{"count":24,"href":"https:\/\/mossiso.com\/wp-json\/wp\/v2\/posts\/1479\/revisions"}],"predecessor-version":[{"id":1653,"href":"https:\/\/mossiso.com\/wp-json\/wp\/v2\/posts\/1479\/revisions\/1653"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mossiso.com\/wp-json\/wp\/v2\/media\/1498"}],"wp:attachment":[{"href":"https:\/\/mossiso.com\/wp-json\/wp\/v2\/media?parent=1479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mossiso.com\/wp-json\/wp\/v2\/categories?post=1479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mossiso.com\/wp-json\/wp\/v2\/tags?post=1479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}