浮雲雅築: [研究] OSSEC - HIDS 2.7.1 主機型入侵偵測系統

2014年2月5日星期三

[研究] OSSEC - HIDS 2.7.1 主機型入侵偵測系統 - local 安裝 (CentOS 6.5 x64)

[研究] OSSEC - HIDS 2.7.1 主機型入侵偵測系統 - local 安裝 (CentOS 6.5 x64)

2014-02-05

官方網站
http://www.ossec.net/

下載
http://www.ossec.net/main/downloads

安裝

yum -y install gcc httpd php
service httpd restart
wget http://www.ossec.net/files/ossec-hids-2.7.1.tar.gz
wget http://www.ossec.net/files/ossec-wui-0.8.tar.gz

tar zxvf ossec-hids-2.7.1.tar.gz
cd ossec-hids-2.7.1
./install.sh
cd ..

tar zxvf ossec-wui-0.8.tar.gz -C /var/www/html
mv /var/www/html/ossec-wui-0.8 /var/www/html/ossec

usermod -G ossec apache
cat /etc/group | grep ossec

# /var/ossec/bin/ossec-control start
# vi /var/ossec/etc/ossec.conf

service ossec restart
service httpd restart
firefox http://localhost/ossec &

對 ossec-hids-2.7.1.tar.gz 做 install.sh 時候會出現一些設定詢問，基本上都是 Enter 用預設值
(安裝型態小弟選 local，有空再測試 server 和 agent)

(en/br/cn/de/el/es/fr/it/jp/nl/pl/ru/sr/tr) [en]:

1- What kind of installation do you want (server, agent, local or help)? local
- Local installation chosen.

2- Setting up the installation environment.

- Choose where to install the OSSEC HIDS [/var/ossec]:

- Installation will be made at /var/ossec .

3- Configuring the OSSEC HIDS.

3.1- Do you want e-mail notification? (y/n) [y]:
- What's your e-mail address? root@localhost

- We found your SMTP server as: 127.0.0.1
- Do you want to use it? (y/n) [y]:

--- Using SMTP server: 127.0.0.1

3.2- Do you want to run the integrity check daemon? (y/n) [y]:

- Running syscheck (integrity check daemon).

3.3- Do you want to run the rootkit detection engine? (y/n) [y]:

- Running rootcheck (rootkit detection).

3.4- Active response allows you to execute a specific
command based on the events received. For example,
you can block an IP address or disable access for
a specific user.
More information at:
http://www.ossec.net/en/manual.html#active-response

- Do you want to enable active response? (y/n) [y]:

- Active response enabled.

- By default, we can enable the host-deny and the
firewall-drop responses. The first one will add
a host to the /etc/hosts.deny and the second one
will block the host on iptables (if linux) or on
ipfilter (if Solaris, FreeBSD or NetBSD).
- They can be used to stop SSHD brute force scans,
portscans and some other forms of attacks. You can
also add them to block on snort events, for example.

- Do you want to enable the firewall-drop response? (y/n) [y]:

- firewall-drop enabled (local) for levels >= 6

- Default white list for the active response:
- 168.95.1.1

- Do you want to add more IPs to the white list? (y/n)? [n]:

3.6- Setting the configuration to analyze the following logs:
-- /var/log/messages
-- /var/log/secure
-- /var/log/maillog
-- /var/log/httpd/error_log (apache log)
-- /var/log/httpd/access_log (apache log)

- If you want to monitor any other file, just change
the ossec.conf and add a new localfile entry.
Any questions about the configuration can be answered
by visiting us online at http://www.ossec.net .