ASL 3.0 Feedback

sophinfo · **Posted:** Wed Jul 20, 2011 8:21 am

Hi,

i've update my asl to version 3.0

Be carreful with the command asl -u
php and mysql will be update too

My yum.log :

Code:

Updated: php-common-5.3.6-3.el5.art.x86_64
Installed: mysqlclient15-5.0.90-1.el5.art.x86_64
Installed: tortixd-2.2.3-43.4.el5.art.x86_64
Installed: 1:tortixd-mod_ssl-2.2.3-43.4.el5.art.x86_64
Updated: php-pdo-5.3.6-3.el5.art.x86_64
Installed: libedit-20090923-3.0_1.el5.rf.x86_64
Updated: php-cli-5.3.6-3.el5.art.x86_64
Installed: libtool-ltdl-1.5.22-7.el5_4.x86_64
Updated: gradm-2.2.2-1.el5.art.x86_64
Updated: php-mcrypt-5.3.6-3.el5.art.x86_64
Updated: php-5.3.6-3.el5.art.x86_64
Updated: php-xml-5.3.6-3.el5.art.x86_64
Updated: php-gd-5.3.6-3.el5.art.x86_64
Updated: php-mbstring-5.3.6-3.el5.art.x86_64
Updated: php-imap-5.3.6-3.el5.art.x86_64
Updated: ossec-hids-2.6-0.10.el5.art.x86_64
Updated: 1:asl-3.0-1.el5.art.x86_64
Updated: mysql-5.1.58-1.el5.art.x86_64
Installed: mysql-libs-5.1.58-1.el5.art.x86_64
Updated: perl-DBD-MySQL-4.014-1.el5.rfx.x86_64
Updated: mysql-server-5.1.58-1.el5.art.x86_64
Updated: ossec-hids-server-2.6-0.10.el5.art.x86_64
Updated: php-mysql-5.3.6-3.el5.art.x86_64
Updated: 1:asl-web-3.0-1.el5.art.x86_64
Erased: asl-mod_ssl
Erased: asl-httpd

MYSQL PROBLEMS #mysql50#

If you’ve upgraded from a MySQL version prior to 5.1, to a MySQL version of 5.1 or later, you might find some of your databases have their names altered to “#mysql50#dbname“, where it used to be just “dbname“.

This is because in MySQL 5.1 the data directory structure changed.

You can either alter your queries, so you retrieve from the database “#mysql50#dbname”, or you can be sane and do the following query to upgrade the data directory structure.

Code:

mysql > ALTER DATABASE `#mysql50#dbname` UPGRADE DATA DIRECTORY NAME;

Details here

ASL WEB GUI

Since the upgrade to ASL 3.0. The web interface is very slow, not just the first load. We now have 4 section in the menu of the web interface.

For the "ASL": All pages are chargenet quickly, except for "Security Event" that remains empty
For the "Firewall": The "connections" works fine but the page "Firewall Rules" displays the loading animation continuously.
For the section "Configuration": Load very long for all parties except for "Rules Management" that appears normally "

In summary, the update "ASL" has resulted in the update php and mysql without any warning message, this has caused problems when updating mysql database. In addition I haven't access to "Security Events" because it is blank. The update of yesterday evening and since anything new

Have you also problems with version 3.0 ?

Marc.

mikeshinn · **Posted:** Wed Jul 20, 2011 11:43 am

Quote:

Be carreful with the command asl -u
php and mysql will be update too

Thank you for this report, that should not happen. The upgrade event is literal, "yum upgrade asl asl-web mod_security" when "asl -u" is called. So that shouldn't occur.

Can you provide some more details about your system, for example what version of your distribution you were running (Example: Centos 5.1), what version of php and mysql you had installed, and did you have any incomplete yum updates or upgrades?

Quote:

Since the upgrade to ASL 3.0. The web interface is very slow, not just the first load. We now have 4 section in the menu of the web interface.

Could you be more specific? Is there a particular window that is slower, some specific event that is slower?

Quote:

"Security Event" that remains empty

If you have no events in your Security Event window, please make sure you have cleared your cache and then relogin to the GUI. If you have done that, then one of two things is occuring:

1) You have a serious database error, and the database events are not being loaded. Please check your mysql logs for any errors and let us know.
2) You dont have any events (very very unlikely).

Quote:

For the "Firewall": The "connections" works fine but the page "Firewall Rules" displays the loading animation continuously.

Could you open a case for this, send us your firewall rules as well (iptables -L -n).

Quote:

For the section "Configuration": Load very long for all parties except for "Rules Management" that appears normally "

So does it eventually load? If so, whats the load like on your system when this occurs?

It sounds like your GUI may not have been completely upgraded. Please log into mysql, and run these commands:

mysql> use database tortix;
mysql> update pgui_system_var set value='0' where name='pgui_installed';

scott · **Posted:** Wed Jul 20, 2011 11:48 am

Was there any chance you had stopped a yum upgrade event before it finished prior to running asl -u?

sophinfo · **Posted:** Wed Jul 20, 2011 12:28 pm

Thank you for your reply. Here are details:

Quote:

Thank you for this report, that should not happen. The upgrade event is literal, "yum upgrade asl asl-web mod_security" when "asl -u" is called. So that shouldn't occur.

The command used is asl-u
Once updated, I disable four rules with the following command

Code:

/var/asl/bin/asl-dr id_of_rules

After the update I made the following

Quote:

asl-s-f

Here my yum.log After the asl-u command, you can see that php-commun is updated before install tortixd.

Code:

Jul 19 22:50:47 Updated: php-common-5.3.6-3.el5.art.x86_64
Jul 19 22:50:50 Installed: mysqlclient15-5.0.90-1.el5.art.x86_64
Jul 19 22:50:52 Installed: tortixd-2.2.3-43.4.el5.art.x86_64
Jul 19 22:50:52 Installed: 1:tortixd-mod_ssl-2.2.3-43.4.el5.art.x86_64
Jul 19 22:50:52 Updated: php-pdo-5.3.6-3.el5.art.x86_64
Jul 19 22:50:52 Installed: libedit-20090923-3.0_1.el5.rf.x86_64
Jul 19 22:50:53 Updated: php-cli-5.3.6-3.el5.art.x86_64
Jul 19 22:50:53 Installed: libtool-ltdl-1.5.22-7.el5_4.x86_64
Jul 19 22:51:10 Updated: gradm-2.2.2-1.el5.art.x86_64
Jul 19 22:51:10 Updated: php-mcrypt-5.3.6-3.el5.art.x86_64
Jul 19 22:51:10 Updated: php-5.3.6-3.el5.art.x86_64
Jul 19 22:51:10 Updated: php-xml-5.3.6-3.el5.art.x86_64
Jul 19 22:51:10 Updated: php-gd-5.3.6-3.el5.art.x86_64
Jul 19 22:51:10 Updated: php-mbstring-5.3.6-3.el5.art.x86_64
Jul 19 22:51:10 Updated: php-imap-5.3.6-3.el5.art.x86_64
Jul 19 22:51:11 Updated: ossec-hids-2.6-0.10.el5.art.x86_64
Jul 19 22:51:11 Updated: 1:asl-3.0-1.el5.art.x86_64
Jul 19 22:51:12 Updated: mysql-5.1.58-1.el5.art.x86_64
Jul 19 22:51:12 Installed: mysql-libs-5.1.58-1.el5.art.x86_64
Jul 19 22:51:13 Updated: perl-DBD-MySQL-4.014-1.el5.rfx.x86_64
Jul 19 22:51:14 Updated: mysql-server-5.1.58-1.el5.art.x86_64
Jul 19 22:51:27 Updated: ossec-hids-server-2.6-0.10.el5.art.x86_64
Jul 19 22:51:27 Updated: php-mysql-5.3.6-3.el5.art.x86_64
Jul 19 22:51:28 Updated: 1:asl-web-3.0-1.el5.art.x86_64
Jul 19 22:51:36 Erased: asl-mod_ssl
Jul 19 22:51:37 Erased: asl-httpd

Quote:

Can you provide some more details about your system, for example what version of your distribution you were running (Example: Centos 5.1), what version of php and mysql you had installed, and did you have any incomplete yum updates or upgrades?

My system

CentOS release 5.5 (Final)
+ Plesk 9.5.4

Maybe that i've cancel the asl-s-f command, I do not remember

Quote:

Since the upgrade to ASL 3.0. The web interface is very slow, not just the first load. We now have 4 section in the menu of the web interface.

Quote:

Could you be more specific? Is there a particular window that is slower, some specific event that is slower?

After the login page, the main page is open quickly but dashboard, security Events and Vulnerability is loading for about 5 minutes.

After 2 minutes i've this

And after about 2 minutes i've this

Quote:

"Security Event" that remains empty

Quote:

If you have no events in your Security Event window, please make sure you have cleared your cache and then relogin to the GUI. If you have done that, then one of two things is occuring:

i have done that.

Quote:

1) You have a serious database error, and the database events are not being loaded. Please check your mysql logs for any errors and let us know.
2) You dont have any events (very very unlikely).

I will check mysql logs

Quote:

For the "Firewall": The "connections" works fine but the page "Firewall Rules" displays the loading animation continuously.

Quote:

Could you open a case for this, send us your firewall rules as well (iptables -L -n).

Code:

Chain INPUT (policy DROP)
target     prot opt source               destination
ASL-BLACKLIST  all  --  213.92.118.133       0.0.0.0/0
DROP       all  --  14.63.253.154        0.0.0.0/0
fail2ban-Apache-w00tw00t  tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            64.131.90.38        tcp dpt:5224
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:20
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:21
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:25
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:110
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:143
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:30000
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:4949

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:21
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:53
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:123
ACCEPT     tcp  --  0.0.0.0/0            64.131.90.38        tcp dpt:5224
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:25
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:110
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:143
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:30000
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:4949

Chain ASL-BLACKLIST (1 references)
target     prot opt source               destination
DROP       all  --  0.0.0.0/0            0.0.0.0/0

Chain fail2ban-Apache-w00tw00t (1 references)
target     prot opt source               destination
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Quote:

For the section "Configuration": Load very long for all parties except for "Rules Management" that appears normally "

Code:

So does it eventually load?  If so, whats the load like on your system when this occurs?

The cpu charge don't change. No problem.

Quote:

It sounds like your GUI may not have been completely upgraded. Please log into mysql, and run these commands:

mysql> use database tortix;
mysql> update pgui_system_var set value='0' where name='pgui_installed';

I will try

JnascECSI · **Posted:** Wed Jul 20, 2011 12:36 pm

I'm having issues with certain popup's loading also, below is the list of what i have going on with the spinning turtle icon. I'm not having problems with the security events,dashboard or vulnerability detail widgets they are working fine.

ASL Section:
All Sections Load fine

Firewall Section:
Connections - Loads Fine
Firewall Rules - Loads Fine but everything is empty with a little thing saying "parseJSON -> parseJSON"

Reports Section:
Web Attacks - Just Spins on Loading
Top Stats - Just Spins on Loading
Login Failures - Just Spins on Loading

Configuration Section:
ASL Configuration - Just Spins on Loading
ASL Web Settings - Just Spins on Loading
Rules Management - No Issues loads and works correctly
User Groups - Just Spins on Loading
User Management - Just Spins on Loading

DarkF@der · **Joined:** Thu May 07, 2009 12:46 pm **Posts:** 219

I have this also problem i have notice if you change something in the asl config or web template and push update then it will happen and after that it will be spinning the whole time.

mikeshinn · **Posted:** Wed Jul 20, 2011 1:27 pm

These sound like partial upgrades, please do the following:

1) Check to make sure your upgrade is complete, please follow the manual upgrade process (its safe to re-run the upgrade, you wont break anything):

https://www.atomicorp.com/wiki/index.ph ... al_Upgrade

2) Close your browser, reopen it, clear the cache and then log in (you may be caching older javascript files from the 2.2 GUI).

If neither of these work, then log into mysql, and run these commands:

mysql> use database tortix;
mysql> update pgui_system_var set value='0' where name='pgui_installed';

Repeat closing out the browser, and log back in again with a clear cache.

DarkF@der · **Joined:** Thu May 07, 2009 12:46 pm **Posts:** 219

Yes then it will work fine.
But when you change something and press update it will say that the browser need to be refresh if you do that you can't acces it anymore then it will still spinning

sophinfo · **Posted:** Wed Jul 20, 2011 1:59 pm

mikeshinn wrote:

These sound like partial upgrades, please do the following:

1) Check to make sure your upgrade is complete, please follow the manual upgrade process (its safe to re-run the upgrade, you wont break anything):

https://www.atomicorp.com/wiki/index.ph ... al_Upgrade

2) Close your browser, reopen it, clear the cache and then log in (you may be caching older javascript files from the 2.2 GUI).

If neither of these work, then log into mysql, and run these commands:

mysql> use database tortix;
mysql> update pgui_system_var set value='0' where name='pgui_installed';

Repeat closing out the browser, and log back in again with a clear cache.

When i run asl -u

Code:

 asl -u

Notice: corrupt serialized data at offset 1:  in lib/lib.PGUIValidate.php on line 75
Checking for updates..
  ASL version is current: 3.0                              [OK]
  APPINV rules are current: 201008021738                   [OK]
  CLAMAV rules are current: 201107191237                   [OK]
  GEOMAP rules are current: 201107191220                   [OK]

and nothing else, the command freeze, i've to do a ctr+c to stop it

asl -ck return :

Code:

Notice: corrupt serialized data at offset 1:  in lib/lib.PGUIValidate.php on line 75
Checking for updates..
  ASL version is current: 3.0                              [OK]
  APPINV rules are current: 201008021738                   [OK]
  CLAMAV rules are current: 201107191237                   [OK]
  GEOMAP rules are current: 201107191220                   [OK]
  MODSEC rule updates are available: 201107191723          [INFO]
  OSSEC rules are current: 201107011206                    [OK]

I've already clear cache and execute the query update pgui_system_var set value='0' where name='pgui_installed' but the problem is still here.

tks for your help.

mikeshinn · **Posted:** Wed Jul 20, 2011 2:34 pm

What happens when you follow the manual upgrade process I linked to above (heres the link again):

https://www.atomicorp.com/wiki/index.ph ... al_Upgrade

"Step 1) yum upgrade asl asl-web mod_security

Step 2) asl -u

Step 3) asl -s -f

Step 4) Please see the release notes, which includes additional information when upgrading from 2.2 to 3.0:

https://www.atomicorp.com/wiki/index.ph ... ease_Notes"

sophinfo · **Posted:** Wed Jul 20, 2011 2:48 pm

mikeshinn wrote:

What happens when you follow the manual upgrade process I linked to above (heres the link again):

https://www.atomicorp.com/wiki/index.ph ... al_Upgrade

"Step 1) yum upgrade asl asl-web mod_security

Code:
yum upgrade asl asl-web mod_security
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* addons: centos.crazyfrogs.org
* atomic: www7.atomicorp.com
* base: centos.crazyfrogs.org
* extras: centos.crazyfrogs.org
* rpmforge: ftp-stud.fht-esslingen.de
* rpmforge-extras: ftp-stud.fht-esslingen.de
* updates: centos.crazyfrogs.org
https://atomicorp.com/channels/asl-2.0/centos/5/x86_64/repodata/repomd.xml: [Errno 12] Timeout: <urlopen error timed out>
Trying other mirror.
Setting up Upgrade Process
No Packages marked for Update

mikeshinn wrote:
Step 2) asl -u

Code:
asl -u

Notice: corrupt serialized data at offset 1: in lib/lib.PGUIValidate.php on line 75
Checking for updates..
ASL version is current: 3.0 [OK]
APPINV rules are current: 201008021738 [OK]
CLAMAV rules are current: 201107191237 [OK]
GEOMAP rules are current: 201107191220 [OK]

mikeshinn wrote:
Step 3) asl -s -f

Code:
asl -s -f

Notice: corrupt serialized data at offset 1: in lib/lib.PGUIValidate.php on line 75
Starting Atomic Secured Linux scan, please be patient...

PRIVATE
Stopping Clam AntiVirus Daemon: [ OK ]
Starting Clam AntiVirus Daemon: [ OK ]

Generating Report: Complete

mikeshinn wrote:

Step 4) Please see the release notes, which includes additional information when upgrading from 2.2 to 3.0:

https://www.atomicorp.com/wiki/index.ph ... ease_Notes"

JnascECSI · **Posted:** Wed Jul 20, 2011 2:58 pm

Mike,
I did what you requested and when running the manual upgrade it all came back no upgrades available . Now when i went and changed the "mysql> update pgui_system_var set value='0' where name='pgui_installed';" and logged in the asl everything was working fine again. Once i changed the ASL Web settings to resize and move around the boxes to my liking it all started all over again.

I then again went back and fixed the system_var set value to 0 and it all came back to normal and working. Seems that anytime you change the ASL Web Settings and start resizing and moving things around that's when the loading issues start. I did clear my cache everytime before re-logging in to the asl gui.

mikeshinn · **Posted:** Wed Jul 20, 2011 3:04 pm

Quote:

Mike,
I did what you requested and when running the manual upgrade it all came back no upgrades available . Now when i went and changed the "mysql> update pgui_system_var set value='0' where name='pgui_installed';" and logged in the asl everything was working fine again. Once i changed the ASL Web settings to resize and move around the boxes to my liking it all started all over again.

I then again went back and fixed the system_var set value to 0 and it all came back to normal and working. Seems that anytime you change the ASL Web Settings and start resizing and moving things around that's when the loading issues start. I did clear my cache everytime before re-logging in to the asl gui.

Thank you for the reply, I've got the GUI team looking into this now.

mikeshinn · **Posted:** Wed Jul 20, 2011 3:05 pm

Quote:

https://atomicorp.com/channels/asl-2.0/centos/5/x86_64/repodata/repomd.xml: [Errno 12] Timeout: <urlopen error timed out>

OK, so you cant connect, so you probably arent fully upgraded. Can you do me a favor and see if you can connect to port 80 on atomicorp.com from your system? And if you can't, whats your IP?

DarkF@der · **Joined:** Thu May 07, 2009 12:46 pm **Posts:** 219

JnascECSI wrote:

Mike,
I did what you requested and when running the manual upgrade it all came back no upgrades available . Now when i went and changed the "mysql> update pgui_system_var set value='0' where name='pgui_installed';" and logged in the asl everything was working fine again. Once i changed the ASL Web settings to resize and move around the boxes to my liking it all started all over again.

I then again went back and fixed the system_var set value to 0 and it all came back to normal and working. Seems that anytime you change the ASL Web Settings and start resizing and moving things around that's when the loading issues start. I did clear my cache everytime before re-logging in to the asl gui.

exacly that is the problem one change and we can start over!

ASL 3.0 Feedback

Who is online