2014年2月5日 星期三

[研究] OSSEC - HIDS 2.7.1 主機型入侵偵測系統 - local 安裝 (CentOS 6.5 x64)

[研究] OSSEC - HIDS 2.7.1 主機型入侵偵測系統 - local 安裝 (CentOS 6.5 x64)

2014-02-05

官方網站
http://www.ossec.net/

下載
http://www.ossec.net/main/downloads

安裝


yum -y install gcc httpd php
service httpd restart
wget http://www.ossec.net/files/ossec-hids-2.7.1.tar.gz
wget http://www.ossec.net/files/ossec-wui-0.8.tar.gz

tar zxvf ossec-hids-2.7.1.tar.gz
cd ossec-hids-2.7.1
./install.sh
cd ..

tar zxvf ossec-wui-0.8.tar.gz -C /var/www/html
mv  /var/www/html/ossec-wui-0.8  /var/www/html/ossec

usermod -G ossec apache
cat /etc/group | grep ossec

# /var/ossec/bin/ossec-control start
# vi /var/ossec/etc/ossec.conf

service ossec restart
service httpd restart
firefox http://localhost/ossec &


對 ossec-hids-2.7.1.tar.gz 做 install.sh 時候會出現一些設定詢問,基本上都是 Enter 用預設值
(安裝型態小弟選 local,有空再測試 server 和 agent)

 (en/br/cn/de/el/es/fr/it/jp/nl/pl/ru/sr/tr) [en]:

1- What kind of installation do you want (server, agent, local or help)?  local  
  - Local installation chosen.

2- Setting up the installation environment.

 - Choose where to install the OSSEC HIDS [/var/ossec]:

    - Installation will be made at  /var/ossec .

3- Configuring the OSSEC HIDS.

  3.1- Do you want e-mail notification? (y/n) [y]:
   - What's your e-mail address? root@localhost

   - We found your SMTP server as: 127.0.0.1
   - Do you want to use it? (y/n) [y]:

   --- Using SMTP server:  127.0.0.1

  3.2- Do you want to run the integrity check daemon? (y/n) [y]:

   - Running syscheck (integrity check daemon).

  3.3- Do you want to run the rootkit detection engine? (y/n) [y]:

   - Running rootcheck (rootkit detection).

  3.4- Active response allows you to execute a specific
       command based on the events received. For example,
       you can block an IP address or disable access for
       a specific user.
       More information at:
       http://www.ossec.net/en/manual.html#active-response

   - Do you want to enable active response? (y/n) [y]:

     - Active response enabled.

   - By default, we can enable the host-deny and the
     firewall-drop responses. The first one will add
     a host to the /etc/hosts.deny and the second one
     will block the host on iptables (if linux) or on
     ipfilter (if Solaris, FreeBSD or NetBSD).
   - They can be used to stop SSHD brute force scans,
     portscans and some other forms of attacks. You can
     also add them to block on snort events, for example.

   - Do you want to enable the firewall-drop response? (y/n) [y]:

     - firewall-drop enabled (local) for levels >= 6

   - Default white list for the active response:
      - 168.95.1.1

   - Do you want to add more IPs to the white list? (y/n)? [n]:

  3.6- Setting the configuration to analyze the following logs:
    -- /var/log/messages
    -- /var/log/secure
    -- /var/log/maillog
    -- /var/log/httpd/error_log (apache log)
    -- /var/log/httpd/access_log (apache log)

 - If you want to monitor any other file, just change
   the ossec.conf and add a new localfile entry.
   Any questions about the configuration can be answered
   by visiting us online at http://www.ossec.net .








(完)

[研究] OSSEC - HIDS 2.7.1 主機型入侵偵測系統 - server/agent 安裝 (CentOS 6.5 x64)
http://shaurong.blogspot.com/2014/02/ossec-hids-271-serveragent-centos-65-x64.html

[研究] OSSEC - HIDS 2.7.1 主機型入侵偵測系統 - local 安裝 (CentOS 6.5 x64)
http://shaurong.blogspot.com/2014/02/ossec-hids-271-local-centos-65-x64.html

[研究] OSSEC - HIDS 2.6 主機型入侵偵測系統 (CentOS 6.0 x86)
http://forum.icst.org.tw/phpbb/viewtopic.php?t=20340

沒有留言:

張貼留言