Salt does not seem to be updating local sensor wazuh configs

[darth-drew]

I have a distrubuted deployment where I have copied /opt/so/saltstack/default/wazuh/files/agent/ossec.conf to the local equivalent on the manger. I set active_response disabled from no to yes, and ran a high state, but my sensors are still blocking connections from my vuln scanner, and the value on the sensors still says disabled = no. Is it possible that salt is not updating the local ossec configs?

[shipler]

If the service is listening on port but you cannot make connections to this port, it can be a FW issue.
did you allowed access from the IP/Segment you are trying to make the connections from?

https://docs.securityonion.net/en/2.3/so-allow.html

[darth-drew]

I did, however I don't think it is a firewall issue because the scanner is able to log in, but can't complete a scan because of an intermittent authentication failure, which I believe is being caused by wazuh as a self defense mechanism.

[weslambert]

If you are trying to change the agent config on the box, you will need to change it locally in /var/ossec/etc/ossec.conf. The agent runs directly on the host as a traditionally installed package, as opposed to the manager running in a container, and using different paths.

[darth-drew]

That makes sense. Thanks wes. Spinning up a fresh node to run a test real quick.