Open-AudIT
https://www.open-audit.org/phpBB3/

audit result submission failed
https://www.open-audit.org/phpBB3/viewtopic.php?f=20&t=6568
Page 1 of 1

Author:  rioz [ Thu Nov 24, 2016 7:44 pm ]
Post subject:  audit result submission failed

Hi,

I have 2 subnets and a firewall in between.
10.1.2.x: open-audit server (linux based) installed.
10.20.3.x: Windows client PC which failed submit the audit result to server.

May I know which port should be released such that submission will be ok?
rioz :roll:

Author:  rioz [ Fri Nov 25, 2016 4:55 pm ]
Post subject:  Re: audit result submission failed

port 80 and 443 are opened in firewall but client audit result still can't submit to server.
Any advice?

Author:  rioz [ Mon Nov 28, 2016 2:48 pm ]
Post subject:  Re: audit result submission failed

One more finding. There is no error for result submission from client PC. But result can't be found in database/web after submission. How to enable more message/error message in result submission?

Author:  jpa [ Tue Nov 29, 2016 2:32 am ]
Post subject:  Re: audit result submission failed

If you're running an audit using the audit script on a Windows pc you can increase the output.

Code:
cscript audit_windows.vbs debugging=3

If you're discovering a device from the interface there is a debug checkbox.

Maybe one of those options can help diagnose the problem.

Author:  rioz [ Fri Feb 03, 2017 8:12 pm ]
Post subject:  Re: audit result submission failed

Below is the log from apache

10.87.10.201 - - [01/Feb/2017:17:51:05 +0800] "GET /open-audit/index.php/login/audit_my_pc HTTP/1.1" 200 326957 "http://10.39.81.100/open-audit/index.php/login/index" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36"
10.65.126.61 - - [01/Feb/2017:17:51:57 +0800] "POST /open-audit/index.php/system/add_system HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"

It shows posting done without problem but there is no data in database. I notice that PC using 10.87 subnet to browse the web but it uses 10.65 subnet to post. Is it the main problem that data can't be stored in database? BTW, there is no error message in running the audit script.

Author:  jpa [ Sat Feb 04, 2017 5:26 am ]
Post subject:  Re: audit result submission failed

Probably the blessed subnets feature.

Author:  rioz [ Sat Feb 04, 2017 3:38 pm ]
Post subject:  Re: audit result submission failed

Do you mean I should add below in my case?

create network
name: 10.65.126.0/24

or both
name: 10.65.126.0/24
name: 10.87.10.0/24

Author:  Mark [ Tue Feb 07, 2017 7:35 am ]
Post subject:  Re: audit result submission failed

Add both.

Author:  rioz [ Tue Feb 07, 2017 5:54 pm ]
Post subject:  Re: audit result submission failed

Is it ok if I add 10.0.0.0/8? Any impact?

Author:  jpa [ Wed Feb 08, 2017 2:03 am ]
Post subject:  Re: audit result submission failed

Beyond the obvious impact of allowing all 10.* I don't think this will be a problem. You could also turn off the Blessed Subnets feature in the config.

Page 1 of 1 All times are UTC + 10 hours
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/