Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Agents connecting to secunia.com host

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
CSI

This thread has been marked as locked.
Mosooving Agents connecting to secunia.com host
Member 11th Feb, 2013 18:24
Ranking: 0
Posts: 11
User Since: 11th Feb, 2013
System Score: N/A
Location: UK
I discovered that my agents, instead of connecting to my server, are connecting to agent.csi6.secunia.com. I used the agent installation instructions explained right inside the server and downloaded the installer therein linked. What's going on?

O.Marin RE: Agents connecting to secunia.com host
Secunia Official 13th Feb, 2013 09:01
Score: 30
Posts: 116
User Since: 4th Aug 2011
System Score: N/A
Location: Copenhagen, DK
Hi,

What version of Secunia CSI are you using?

--
Kind Regards,

Oana Marin
Solution Specialist
Mosooving RE: Agents connecting to secunia.com host
Member 13th Feb, 2013 16:26
Score: 0
Posts: 11
User Since: 11th Feb 2013
System Score: N/A
Location: UK
Secunia CSI Version 6.0
Was this reply relevant?
+0
-0
O.Marin RE: Agents connecting to secunia.com host
Secunia Official 14th Feb, 2013 08:45
Score: 30
Posts: 116
User Since: 4th Aug 2011
System Score: N/A
Location: Copenhagen, DK
That is perfectly normal behaviour. The CSI Agents do not communicate directly with the Secunia CSI Console.

In our technical user manual on page 13 you can find a deployment example that show how the communication is done. You can find the Secunia CSI 6 technical user manual here:
http://secunia.com/resources/product_sheets/

You might also be interested in reading Scan Process How does it work? In the technical user manual at page 8.

--
Kind Regards,

Oana Marin
Solution Specialist
Mosooving RE: Agents connecting to secunia.com host
Member 18th Feb, 2013 19:38
Score: 0
Posts: 11
User Since: 11th Feb 2013
System Score: N/A
Location: UK
Thank you for the help.

When I open the console, I still see "No agents found" when I go to Scanning -> Scanning Via Local Agents -> Single Host Agents. Is there a way to force a retrieval? I can verify that the agent has reported to Secunia by way of the /var/tmp log files.
Was this reply relevant?
+0
-0
Pla_IIS Agents connecting to secunia.com host
Member 19th Feb, 2013 22:10
Last edited on 19th Feb, 2013 22:10 You can try the following:

1. Verify that the Secunia agent can connect to the server properly:
Open a command window (Start -> CMD) and go to the directory where the agent is installed (should be \"C:\\Program Files (x86)\\Secunia\\CSI Agent\" for Win7). Now start the agent in commandline mode: \"csia -c\"
Now you should be able to watch what\'s going on: connecting to the server, doing some handshake, then scanning the local disk and sending the data.
If that is ok, your client connects correctly to the server.
Remark: In the basic configuration, the agent does a scan only once in 7 days; for my installation I changed this to once a day. The default connection interval (checking the server for new commands) is 25 minutes.

2. Checking the connectivity of your console PC:
Be sure that your Secunia console is able to reach the Secunia server via port 443 (some firewalls are blocking that).

3. Enable debug logging in the Secunia console:
Go to menu item \"Configuration -> Settings\" of the Secunia console and set the checkmark for \"enable logging\". Be sure to remember the target directory for the logfile (will be shown after applying the setting; once I was searching for some time to find that file...).
Now try to refresh the status screen for the Single Host Agents: this can be achieved by double clicking in the status bar of the status screen in the progress bar where usually \"Local database is updated...\" is written.
Remark: this will not work during an active database check - you will get a warning message instead.

4. Check the contents of the debug log file for any hints of what is going on (or not going on)...

5. Please do not forget to uncheck the debug log after your tests - otherwise the log file might grow remarkably...

6. For a general verification of the system you could also check a remote scan via CSI: open that menu item, select a name or an IP address of a PC to scan and do the remote scan. This should identify at least one host...

Remark: For tests (and also for operation) the Secunia Console and the Secunia Single Host agent can be installed in parallel on the same PC (in my installation all PCs have an agent installed).

Hope that helps...

Was this reply relevant?
+1
-0
O.Marin RE: Agents connecting to secunia.com host
Secunia Official 20th Feb, 2013 09:01
Score: 30
Posts: 116
User Since: 4th Aug 2011
System Score: N/A
Location: Copenhagen, DK
you can also try to run the CSI Agent with a log file: open command prompt (as administrator) and run the following command csia.exe -i -L -v -d log.txt

--
Kind Regards,

Oana Marin
Solution Specialist
Mosooving RE: Agents connecting to secunia.com host
Member 20th Feb, 2013 15:53
Score: 0
Posts: 11
User Since: 11th Feb 2013
System Score: N/A
Location: UK
Last edited on 20th Feb, 2013 16:16
UPDATE: I rebooted and the below error went away. I will post again.

I get the following output (note the error message):

PS C:\Users\admin\Downloads> .\csia.exe -i -L -v -d log.txt
[02/20 06:49:39.925] Initializing Secunia CSI Agent
[02/20 06:49:39.928] Determining computer name
[02/20 06:49:39.930] Computer name is 'TREL2-SECUNIA'
[02/20 06:49:39.932] Domain Name is 'TENABLERELAB2'
Stopping 'Secunia CSI Agent' service
DeleteService error 1072:The specified service has been marked for deletion.

log.txt ends with "[02/20 06:49:39.934] Installing service"
Was this reply relevant?
+0
-0
Mosooving RE: Agents connecting to secunia.com host
Member 20th Feb, 2013 16:25
Score: 0
Posts: 11
User Since: 11th Feb 2013
System Score: N/A
Location: UK
Last edited on 20th Feb, 2013 16:26
on 19th Feb, 2013 22:10, Pla_IIS wrote:
You can try the following:

1. Verify that the Secunia agent can connect to the server properly:
Open a command window (Start -> CMD) and go to the directory where the agent is installed (should be \"C:\\Program Files (x86)\\Secunia\\CSI Agent\" for Win7).


Neither this directory nor a similar one exists. I followed the installation directions (successfully executing command I posted previously)
Was this reply relevant?
+0
-0
O.Marin RE: Agents connecting to secunia.com host
Secunia Official 20th Feb, 2013 16:31
Score: 30
Posts: 116
User Since: 4th Aug 2011
System Score: N/A
Location: Copenhagen, DK
I think your running the CSI Agent on Mac OS right? What version do you have?

The folder is present on Windows machines when deploying the CSI Agent package with WSUS or SCCM. This step is not related to troubleshooting on Mac OS

--
Kind Regards,

Oana Marin
Solution Specialist
Mosooving RE: Agents connecting to secunia.com host
Member 20th Feb, 2013 16:42
Score: 0
Posts: 11
User Since: 11th Feb 2013
System Score: N/A
Location: UK
I am running from and on Windows. The agent is on the same computer as the console. I also have agents installed on RedHat Linux and Oracle Linux.
Was this reply relevant?
+0
-0
Mosooving RE: Agents connecting to secunia.com host
Member 20th Feb, 2013 19:03
Score: 0
Posts: 11
User Since: 11th Feb 2013
System Score: N/A
Location: UK
Progress!

The Windows Update service is running and I am logged in as a domain administrator, but when I run csia.exe -c

[02/20 09:57:57.679] SCAN STATUS:
[02/20 09:57:57.680] Partial: Windows Update failed
[02/20 09:57:57.680] Check that the Windows Update service is running on the Host and that you use the correct administr
ative login credentials.

NOTE: This means that certain Microsoft products for this Host, are listed with a potential incorrect security state.

Was this reply relevant?
+0
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability