Support #559
Updated by Daniel Curtis almost 10 years ago
{{>toc}}
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX and Windows. It also includes agentless monitoring for use with for example Cisco, HP or Juniper hardware.
This tutorial covers the installation of the OSSEC 2.8.0 server, the standard OSSEC Web UI and the Analogi dashboard on FreeBSD 9.2-RELEASE. It also covers OSSEC setup with MySQL support. Last but not least it shows you how to install the OSSEC agent on a *NIX system.
h1. Pre-requisites
* Update the system and ports tree:
<pre>
pkg update && pkg upgrade
portsnap fetch extract
</pre>
* Install portupgrade
<pre>
pkg install portupgrade
</pre>
---
h1. Install OSSEC
* Install ossec-hids-server from ports:
<pre>
portupgrade -Np ossec-hids-server
</pre>
*NOTE*: Make sure to enable @[X]MYSQL@
h2. Configure OSSEC
* Enable OSSEC service to start at boot:
<pre>
echo 'ossechids_enable="YES"' >> /etc/rc.conf
</pre>
* Edit the OSSEC config file:
<pre>
vi /usr/local/ossec-hids/etc/ossec.conf
</pre>
*NOTE*: The following settings are changed from the above file.
h3. Configure mail settings
* Now let’s configure the server the configuration. I modified the file to contain the following:
<pre>
<global>
<email_notification>yes</email_notification>
<email_to>admin@example.com</email_to>
<smtp_server>smtp.example.com</smtp_server>
<email_from>ossec@example.com</email_from>
</global>
</pre>
h3. Configure syscheck
* Adjust the syscheck Interval - syscheck is OSSEC's integrity checking process and we can tell syscheck how often to scan and checksum the filesystem for evidence of unauthorized changes:
<pre>
<syscheck>
<!-- Frequency that syscheck is executed -- this is set to run every 12 hours -->
<frequency>43200</frequency>
</pre>
h3. Specify Directories to Monitor
* Add/modify the directories to be monitored by OSSEC:
<pre>
<!-- Directories to check (perform all possible verifications) -->
<directories report_changes="yes" check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
<directories report_changes="yes" check_all="yes">/bin,/sbin</directories>
<directories report_changes="yes" check_all="yes">/usr/local/etc,/usr/local/bin,/usr/local/sbin</directories>
<directories report_changes="yes" check_all="yes">/home/,/usr/local/home,/usr/local/www</directories>
</pre>
h3. Specify Files or Directories to be Ignored
* Add/modify the directories to be ignored by OSSEC:
<pre>
<!-- Files/directories to ignore -->
<ignore>/etc/mtab</ignore>
<ignore>/etc/hosts.deny</ignore>
<ignore>/etc/mail/statistics</ignore>
<ignore>/etc/random-seed</ignore>
<ignore>/etc/adjtime</ignore>
<ignore>/etc/httpd/logs</ignore>
<ignore>/etc/dumpdates</ignore>
<ignore>/usr/local/ossec-hids/logs</ignore>
<ignore>/usr/local/ossec-hids/queue</ignore>
<ignore>/usr/local/ossec-hids/var</ignore>
<ignore>/usr/local/ossec-hids/tmp</ignore>
<ignore>/usr/local/ossec-hids/stats</ignore>
</pre>
h3. Configure Rootcheck
<pre>
* The next stop in ossec.conf is the rootcheck section. Rootcheck is a component of OSSEC which scans the system for rootkits. Modify the section to match the following:
<pre>
<rootcheck>
<rootkit_files>/usr/local/ossec-hids/etc/shared/rootkit_files.txt</rootkit_files>
<rootkit_trojans>/usr/local/ossec-hids/etc/shared/rootkit_trojans.txt</rootkit_trojans>
</rootcheck>
</pre>
* Start OSSEC server:
<pre>
service ossec-hids start
</pre>
h3. Specify Log Files to be Monitored
The files set in this example are:
# /var/log/messages
# /var/log/security
# /var/log/auth.log
# /var/log/maillog
# /var/log/lpd-errs
* The code block below shows an example of what the modified lines should be. You will want to add log locations for the specific services you've installed and are running on the server; services like Nginx, Apache, etc.
<pre>
<!-- Files to monitor (localfiles) -->
<localfile>
<log_format>syslog</log_format>
<location>/var/log/auth.log</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/security</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/messages</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/maillog</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/lpd-errs</location>
</localfile>
</pre>
h2. Adding Log File Entries with util.sh
h3. Fixing the OSSEC util.sh script on FreeBSD
* Open the util.sh file with vi:
<pre>
vi /usr/local/ossec-hids/bin/util.sh
</pre>
#* Then replace ALL instances of */var/ossec/etc/ossec.conf* with *+/usr/local/ossec-hids/etc/ossec.conf+*
* If you installed Nginx and its access and error log files are in the @/var/log/nginx@ directory, you may add them to ossec.conf by using util.sh like so:
<pre>
/usr/local/ossec-hids/bin/util.sh addfile /var/log/nginx/access.log
/usr/local/ossec-hids/bin/util.sh addfile /var/log/nginx/error.log
</pre>
h3. Alert on New Files
By default, OSSEC does not alert when new files are created in the system so we will change that behavior. There are two components to this change.
* Set syscheck - Scroll back up to the syscheck area os of ossec.conf and add an alertnewfiles line just under the frequency check interval:
<pre>
<syscheck>
<alert_new_files>yes</alert_new_files>
</pre>
Now you can save and close ossec.conf.
h3. Modify the Rule's Classification Level
Although we've told syscheck to watch for newly created files, OSSEC won't actually notify us about them yet. For that we need to modify a default OSSEC rule.
* Open ossec_rules.xml:
<pre>
vi /usr/local/ossec-hids/rules/ossec_rules.xml
</pre>
#* The rule that fires when a file is added to a monitored directory is rule 554. Here's what it looks like:
<rule id="554" level="0">
<category>ossec</category>
<decoded_as>syscheck_new_entry</decoded_as>
<description>File added to the system.</description>
<group>syscheck,</group>
</rule>
* Open @local_rules.xml@ This is where all user-modified OSSEC rules should go; you should *+not+* make changes to @ossec_rules.xml@
<pre>
vi /usr/local/ossec-hids/rules/local_rules.xml
</pre>
#* And add/modify the following change the notification level to 7 and tell OSSEC that this rule overwrites rule 554 from @ossec_rules.xml@. When done, the end of your @local_rules.xml@ file should look like below. The first line is all that was changed from the original rule.
<pre>
<rule id="554" level="7" overwrite="yes">
<category>ossec</category>
<decoded_as>syscheck_new_entry</decoded_as>
<description>File added to the system.</description>
<group>syscheck,</group>
</rule>
</group> <!-- SYSLOG,LOCAL -->
<!-- EOF -->
</pre>
* Then restart OSSEC:
<pre>
service ossec-hids restart
</pre>
---
h1. Nginx – Installation and Configuration
* Install Nginx
<pre>
pkg install nginx
</pre>
* Start and enable nginx to start at boot:
<pre>
echo 'nginx_enable="YES"' >> /etc/rc.conf
service nginx start
</pre>
h2. PHP – Installation and Configuration
* Install PHP5 and other required packages:
<pre>
portupgrade -Np php5
portupgrade -Np php5-mysql
portupgrade -Np php5-curl
portupgrade -Np php5-gd
portupgrade -Np pecl-intl
portupgrade -Np pear
portupgrade -Np pecl-imagick
portupgrade -Np php5-imap
portupgrade -Np php5-mcrypt
portupgrade -Np pecl-memcached
portupgrade -Np ming
portupgrade -Np php5-pspell
portupgrade -Np php5-recode
portupgrade -Np php5-snmp
portupgrade -Np php5-sqlite3
portupgrade -Np php5-tidy
portupgrade -Np php5-xmlrpc
portupgrade -Np php5-xsl
</pre>
* Configure the default PHP settings
<pre>
cp /usr/local/etc/php.ini-production /usr/local/etc/php.ini
</pre>
h3. Configure PHP-FPM
* Edit @/usr/local/etc/php-fpm.conf@:
<pre>
vi /usr/local/etc/php-fpm.conf
</pre>
#* Make the following changes:
<pre>
events.mechanism = kqueue
listen = /var/run/php-fpm.sock
listen.owner = www
listen.group = www
listen.mode = 0666
</pre>
* Enable PHP-FPM to start at boot:
<pre>
echo 'php_fpm_enable="YES"' >> /etc/rc.conf
</pre>
* Start PHP-FPM:
<pre>
service php-fpm start
</pre>
h3. Configure Nginx to use PHP-FPM:
* Create a directory for a OSSEC Web UI:
<pre>
mkdir /usr/local/www/ossec.example.com
</pre>
* Edit @/usr/local/etc/nginx/nginx.conf@:
<pre>
vi /usr/local/etc/nginx/nginx.conf
</pre>
#* Add the following inside the @server{ }@ block:
<pre>
http {
...
server {
listen 80;
server_name ossec.example.com; localhost;
root /usr/local/www/ossec-wui; /usr/local/www/ossec.example.com;
access_log /var/log/ossec.example.com-access.log;
error_log /var/log/ossec.example.com-error.log
location / {
index index.php index.html index.htm;
}
# For all PHP requests, pass them on to PHP-FPM via FastCGI
location ~ \.php$ {
fastcgi_pass unix:/var/run/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME /usr/local/www/ossec-wui$fastcgi_script_name; /usr/local/www/ossec.example.com$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_script_name;
include fastcgi_params; # include extra FCGI params
}
...
}
...
}
</pre>
The PHP support in FreeBSD is extremely modular so the base install is very limited. It is very easy to add support using the _lang/php5-extensions_ port. This port provides a menu driven interface to PHP extension installation. Alternatively, individual extensions can be installed using the appropriate port.
* Restart nginx:
<pre>
service nginx restart
</pre>
---
h1. MariaDB – Installation and Configuration
* Install MariaDB 5.5 server and client
<pre>
pkg install mariadb55-{server,client}
</pre>
h2. Configure MariaDB server
* Configure the MariaDB server
<pre>
cp /usr/local/share/mysql/my-small.cnf /usr/local/etc/my.cnf
</pre>
* Enable MariaDB to start at boot:
<pre>
echo 'mysql_enable="YES"' >> /etc/rc.conf
</pre>
* Start MariaDB
<pre>
service mysql-server start
</pre>
* Set password for mysql using the following command
<pre>
mysql_secure_installation
</pre>
* Restart mysql using the following commands:
<pre>
service mysql-server restart
</pre>
* Create a user and database for OSSEC. Open a MySQL shell:
<pre>
mysql -u root -p
</pre>
#* And run the following to create the *ossec* database with the *ossec_u* user
<pre>
create database ossec;
grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on ossec.* to ossec_u;
set password for ossec_u = PASSWORD('SuperSecretPassword'); PASSWORD('Passw0rd');
flush privileges;
quit;
</pre>
h3. Configure OSSEC database schema
The database also needs a schema. OSSEC provides the schema, it is located in the OSSEC github.
* Download latest OSSEC MySQL schema:
<pre>
cd /usr/local/ossec-hids
wget https://github.com/ossec/ossec-hids/raw/master/src/os_dbd/mysql.schema
</pre>
#* Import the schema it into the ossec database: MySQL:
<pre>
mysql -u root -p ossec < mysql.schema src/os_dbd/mysql.schema
</pre>
h3. OSSEC MySQL configuration
* Add We have to add the database config to the ossec.conf file:
<pre>
vi /usr/local/ossec-hids/etc/ossec.conf
</pre>
#* And add the *database_output* block into the *ossec_config* block:
<pre>
/var/ossec/etc/ossec.conf:
<ossec_config>
#...
<database_output>
<hostname>127.0.0.1</hostname>
<username>ossec_u</username>
<password>SuperSecretPassword</password> <password>Passw0rd</password>
<database>ossec</database>
<type>mysql</type>
</database_output>
#...
</ossec_config>
</pre> Change type mysql to type postgresql for the PostgreSQL database.
* Enable Save it, then enable the database in OSSEC:
<pre>
/usr/local/ossec-hids/bin/ossec-control
/var/ossec/bin/ossec-control enable database
</pre>
* And /var/ossec/bin/ossec-control restart OSSEC:
<pre>
service ossec-hids restart
</pre>
---
h1. Installing OSSEC Web UI
OSSEC Web UI
* Download This is also quite simple. Because we've already set up Apache and PHP, we can just download the web UI and extract to /usr/local/www/ossec-wui: /var/www/html:
wget http://www.ossec.net/files/ossec-wui-0.8.tar.gz
<pre> tar -xf ossec-wui-0.8.tar.gz
cd /usr/local/www
git clone https://github.com/ossec/ossec-wui.git ossec-wui
mkdir -p /usr/local/www/ossec-wui/tmp/ /var/www/html/ossec/tmp/
mv ossec-wui-0.8/* /var/www/html/ossec/
chown -R www:www /usr/local/www/ossec-wui www-data:www-data /var/www/html/ossec/tmp/
chmod 666 /usr/local/www/ossec-wui/tmp/ /var/www/html/ossec/tmp
</pre>
* Make sure to add the *www* www-data user to the ossec group, so nginx can access the ossec folder:
<pre>
pw
usermod www -a -G ossec www-data
</pre> We use version 0.8 of Web UI because there are a lot of errors (like broken search) in the stable 0.3 version. We also set the correct permissions on the tmp/ folder. Afterwards the web ui is visible at http://hostname/ossec/.
h1. Installing Analogi Web Dashboard
OSSEC Analogi dashboard
This tutorial was tested on a DigitalOcean VPS. If you use this link you sponsor this website. (referral link)
The Analogi dashboard is a nice and informative dashboard around OSSEC, which provides more visual information then the standard Web UI. The standard Web UI has better search functions, the Dashboard can be used for example on a Wall Mounted monitor and such.
Installation consists out of cloning the git repo and editing the settings file:
cd /var/www/html/
git clone https://github.com/ECSC/analogi.git
cp analogi/db_ossec.php.new analogi/db_ossec.php
vim analogi/db_ossec.php
Edit the relevant settings for the MySQL database configuration:
define ('DB_USER_O', 'ossec_u');
define ('DB_PASSWORD_O', 'Passw0rd');
define ('DB_HOST_O', '127.0.0.1');
define ('DB_NAME_O', 'ossec');
When correctly configured the Analogi webinterface can be found at http://hostname/analogi/.
The OSSEC server is now correctly set up.
Client installation
Client OSSEC config
Adding a client to OSSEC is quite simple. First you add the client to the server, which gives you a key. Then you add this key to the client, edit the config file on the client and that's it.
First we need to generate a key on the OSSEC server for this client. We do this by running /var/ossec/bin/manage_agents, option A, then entering the hostname, IP and ID for the client we want to add. Do this on the OSSEC server:
root@ossec:~# /var/ossec/bin/manage_agents
****************************************
* OSSEC HIDS v2.8 Agent manager. *
* The following options are available: *
****************************************
(A)dd an agent (A).
(E)xtract key for an agent (E).
(L)ist already added agents (L).
(R)emove an agent (R).
(Q)uit.
Choose your action: A,E,L,R or Q: A
- Adding a new agent (use '\q' to return to the main menu).
Please provide the following:
* A name for the new agent: ossec-client1
* The IP Address of the new agent: 2.3.4.5
* An ID for the new agent[001]:
Agent information:
ID:001
Name:ossec-client1
IP Address:2.3.4.5
Confirm adding it?(y/n): y
Agent added.
Get the key for the OSSEC client:
root@ossec:~# /var/ossec/bin/manage_agents
****************************************
* OSSEC HIDS v2.8 Agent manager. *
* The following options are available: *
****************************************
(A)dd an agent (A).
(E)xtract key for an agent (E).
(L)ist already added agents (L).
(R)emove an agent (R).
(Q)uit.
Choose your action: A,E,L,R or Q: E
Available agents:
ID: 001, Name: ossec-client1, IP: 2.3.4.5
Provide the ID of the agent to extract the key (or '\q' to quit): 001
Agent key information for '001' is:
SD[...]AAUjd=
** Press ENTER to return to the main menu.
Then switch to the OSSEC client and execute the manage_agents:
root@ossec:~# /var/ossec/bin/manage_agents
****************************************
* OSSEC HIDS v2.8 Agent manager. *
* The following options are available: *
****************************************
(I)mport key from the server (I).
(Q)uit.
Choose your action: I or Q: i
* Provide the Key generated by the server.
* The best approach is to cut and paste it.
*** OBS: Do not include spaces or new lines.
Paste it here (or '\q' to quit): SD[...]AAUjd=
Agent information:
ID:001
Name:ossec-client1
IP Address:2.3.4.5
Confirm adding it?(y/n): y
Added.
** Press ENTER to return to the main menu.
Check if this in the /var/ossec/etc/ossec.conf file:
<client>
<server-hostname>1.2.3.4</server-hostname>
</client>
Where 1.2.3.4 is your OSSEC server URL or IP.
Now restart OSSEC on both the OSSEC server and the newly added client:
/var/ossec/bin/ossec-control restart
Repeat these steps for any client that needs to be added.
Bonus Tips
Here are a few bonus tips/config examples for OSSEC
Active Response
If you've enabled Active Response you are protected from brute force attacks for ssh and some other pieces of software. Try it, login as a nonexistent user and check the web ui and logging:
brute
tail -f /var/ossec/logs/active-responses.log
Wed Jun 11 21:16:43 CEST 2014 /var/ossec/active-response/bin/host-deny.sh add - 198.211.118.121 1402514203.20760 5712
Wed Jun 11 21:16:43 CEST 2014 /var/ossec/active-response/bin/firewall-drop.sh add - 198.211.118.121 1402514203.20760 5712
On Linux it is just a standard iptables DROP rule for that IP. You can delete the DROP rule by first finding out it's ID:
iptables -L -n --line-numbers
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 DROP all -- 198.211.118.121 0.0.0.0/0
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 DROP all -- 198.211.118.121 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Then you can delete the rule with that ID:
iptables -D INPUT 1
iptables -D FORWARD 1
Ignoring rules
To very simply ignore rules based on rule id, add them to the XML file located in /var/ossec/rules/local_rules/xml, either on the ossec client for one machine or the ossec server to ignore on all machines:
<!-- Specify here a list of rules to ignore. -->
<!-- 3334 postfix start -->
<!-- 3333 postfix stop -->
<rule id="100030" level="0">
<if_sid>3333, 3334</if_sid>
<description>List of rules to be ignored.</description>
</rule>
Monitoring additional log files
The OSSEC agent by default only monitors a few log files. To add more, edit the /var/ossec/etc/ossec.conf file and add a line like this:
<localfile>
<location>/var/log/*</location>
<log_format>syslog</log_format>
</localfile>
This will add all files under /var/log. This might be a lot, you can also just add multiple <localfile> blocks with filenames.
Firewall
You need to allow UDP port 1514 between OSSEC server and clients. Otherwise you get errors like this:
2013/09/06 19:53:00 ossec-agentd: INFO: Using IPv4 for: 10.0.51.31 .
2013/09/06 19:53:21 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'ossec.raymii.nl/10.0.51.31'.
Removing OSSEC
h2. Resources
* http://www.ossec.net/doc/
* https://raymii.org/s/tutorials/OSSEC_2.8.0_Server_Client_and_Analogi_Dashboard_on_Ubuntu.html
* https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-ossec-on-freebsd-10-1
* http://virtuallyhyper.com/2014/04/ossec-freebsd/* Add/modify the directories to be monitored by OSSEC: