浮雲雅築: [研究]OSSEC HIDS v4.1.0 Server 安裝 (Ubuntu 26.04 LTS)

[研究]OSSEC HIDS v4.1.0 Server 安裝 (Ubuntu 26.04 LTS)

HIDS 主機型入侵偵測系統

2026-09-01

OSSEC Open Source Security Version: 4.2.0
https://www.ossec.net/ossec-downloads/

基本架構


Windows Server 2019
       │
       │ UDP 1514
       ▼
┌─────────────────────┐
│ Ubuntu OSSEC 4.2.0  │
│     Manager        │
│                     │
│ /var/ossec/         │
│ ├── etc/             │
│ ├── logs/            │
│ ├── rules/           │
│ └── bin/             │
└─────────────────────┘

Installation requirements
https://www.ossec.net/docs/docs/manual/installation/installation-requirements.html#install-req

Manager/Agent Installation
https://www.ossec.net/docs/docs/manual/installation/install-source.html

APT Automated Installation on Ubuntu
https://www.ossec.net/download-ossec/


wget -q -O - https://updates.atomicorp.com/installers/atomic | sudo bash
apt-get update
apt-get install ossec-hids-server

OSSEC 4.2.0 — ossec-control
https://www.ossec.net/docs/docs/programs/ossec-control.html


sudo /var/ossec/bin/ossec-control start
sudo /var/ossec/bin/ossec-control stop
sudo /var/ossec/bin/ossec-control restart
sudo /var/ossec/bin/ossec-control status


user1@ubuntu2604lts:~$ sudo /var/ossec/bin/ossec-control status
ossec-monitord not running...
ossec-logcollector not running...
ossec-remoted not running...
ossec-syscheckd not running...
ossec-analysisd not running...
ossec-maild not running...
ossec-execd not running...
user1@ubuntu2604lts:~$ sudo /var/ossec/bin/ossec-control start
Starting OSSEC HIDS v4.1.0...
2026/09/01 13:58:56 ossec-maild(1501): ERROR: Invalid SMTP Server: smtp.example.com.
2026/09/01 13:58:56 ossec-maild(1202): ERROR: Configuration error at '/var/ossec/etc/ossec.conf'. Exiting.
2026/09/01 13:58:56 ossec-maild(1202): ERROR: Configuration error at '/var/ossec/etc/ossec.conf'. Exiting.
ossec-maild did not start correctly.
user1@ubuntu2604lts:~$

修改設定，


sudo nano /var/ossec/etc/ossec.conf


user1@ubuntu2604lts:~$ sudo cat /var/ossec/etc/ossec.conf
<!-- OSSEC example config -->

<ossec_config>
  <global>
    <email_notification>yes</email_notification>
    <email_to>daniel.cid@example.com</email_to>
    <smtp_server>smtp.example.com.</smtp_server>
    <email_from>ossecm@ossec.example.com.</email_from>
  </global>

  <rules>
    <include>rules_config.xml</include>
    <include>pam_rules.xml</include>
    <include>sshd_rules.xml</include>
    <include>telnetd_rules.xml</include>
    <include>syslog_rules.xml</include>
    <include>arpwatch_rules.xml</include>
    <include>symantec-av_rules.xml</include>
    <include>symantec-ws_rules.xml</include>
    <include>pix_rules.xml</include>
    <include>named_rules.xml</include>
    <include>smbd_rules.xml</include>
    <include>vsftpd_rules.xml</include>
    <include>pure-ftpd_rules.xml</include>
    <include>proftpd_rules.xml</include>
    <include>ms_ftpd_rules.xml</include>
    <include>ftpd_rules.xml</include>
    <include>hordeimp_rules.xml</include>
    <include>roundcube_rules.xml</include>
    <include>wordpress_rules.xml</include>
    <include>cimserver_rules.xml</include>
    <include>vpopmail_rules.xml</include>
    <include>vmpop3d_rules.xml</include>
    <include>courier_rules.xml</include>
    <include>web_rules.xml</include>
    <include>web_appsec_rules.xml</include>
    <include>apache_rules.xml</include>
    <include>nginx_rules.xml</include>
    <include>php_rules.xml</include>
    <include>mysql_rules.xml</include>
    <include>postgresql_rules.xml</include>
    <include>ids_rules.xml</include>
    <include>squid_rules.xml</include>
    <include>firewall_rules.xml</include>
    <include>apparmor_rules.xml</include>
    <include>cisco-ios_rules.xml</include>
    <include>netscreenfw_rules.xml</include>
    <include>sonicwall_rules.xml</include>
    <include>postfix_rules.xml</include>
    <include>sendmail_rules.xml</include>
    <include>imapd_rules.xml</include>
    <include>mailscanner_rules.xml</include>
    <include>dovecot_rules.xml</include>
    <include>ms-exchange_rules.xml</include>
    <include>racoon_rules.xml</include>
    <include>vpn_concentrator_rules.xml</include>
    <include>spamd_rules.xml</include>
    <include>msauth_rules.xml</include>
    <include>mcafee_av_rules.xml</include>
    <include>trend-osce_rules.xml</include>
    <include>ms-se_rules.xml</include>
    <!-- <include>policy_rules.xml</include> -->
    <include>zeus_rules.xml</include>
    <include>solaris_bsm_rules.xml</include>
    <include>vmware_rules.xml</include>
    <include>ms_dhcp_rules.xml</include>
    <include>asterisk_rules.xml</include>
    <include>ossec_rules.xml</include>
    <include>attack_rules.xml</include>
    <include>dropbear_rules.xml</include>
    <include>unbound_rules.xml</include>
    <include>sysmon_rules.xml</include>
    <include>opensmtpd_rules.xml</include>
    <include>exim_rules.xml</include>
    <include>openbsd-dhcpd_rules.xml</include>
    <include>dnsmasq_rules.xml</include>
    <include>local_rules.xml</include>
  </rules>


  <syscheck>
    <!-- Frequency that syscheck is executed -- default every 20 hours -->
    <frequency>72000</frequency>
    
    <!-- Directories to check  (perform all possible verifications) -->
    <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes">/bin,/sbin,/boot</directories>

    <!-- Files/directories to ignore -->
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/hosts.deny</ignore>
    <ignore>/etc/mail/statistics</ignore>
    <ignore>/etc/random-seed</ignore>
    <ignore>/etc/random.seed</ignore>
    <ignore>/etc/adjtime</ignore>
    <ignore>/etc/httpd/logs</ignore>

    <!-- Check the file, but never compute the diff -->
    <nodiff>/etc/ssl/private.key</nodiff>
  </syscheck>

  <rootcheck>
    <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
    <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
  </rootcheck>

  <global>
    <white_list>127.0.0.1</white_list>
    <white_list>::1</white_list>
    <white_list>192.168.2.1</white_list>
    <white_list>192.168.2.190</white_list>
    <white_list>192.168.2.32</white_list>
    <white_list>192.168.2.10</white_list>
  </global>

  <remote>
    <connection>secure</connection>
  </remote>

  <alerts>
    <log_alert_level>1</log_alert_level>
    <email_alert_level>7</email_alert_level>
  </alerts>

  <command>
    <name>host-deny</name>
    <executable>host-deny.sh</executable>
    <expect>srcip</expect>
    <timeout_allowed>yes</timeout_allowed>
  </command>  

  <command>
    <name>firewall-drop</name>
    <executable>firewall-drop.sh</executable>
    <expect>srcip</expect>
    <timeout_allowed>yes</timeout_allowed>
  </command>  

  <command>
    <name>disable-account</name>
    <executable>disable-account.sh</executable>
    <expect>user</expect>
    <timeout_allowed>yes</timeout_allowed>
  </command>  


  <!-- Active Response Config -->
  <active-response>
    <!-- This response is going to execute the host-deny
       - command for every event that fires a rule with
       - level (severity) >= 6.
       - The IP is going to be blocked for  600 seconds.
      -->
    <command>host-deny</command>
    <location>local</location>
    <level>7</level>
    <timeout>600</timeout>
  </active-response>

  <active-response>
    <!-- Firewall Drop response. Block the IP for
       - 600 seconds on the firewall (iptables,
       - ipfilter, etc).
      -->
    <command>firewall-drop</command>
    <location>local</location>
    <level>7</level>
    <timeout>600</timeout>    
  </active-response>  

  <!-- Files to monitor (localfiles) -->

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/messages</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/authlog</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/auth.log</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/secure</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/xferlog</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/maillog</location>
  </localfile>

  <localfile>
    <log_format>apache</log_format>
    <location>/var/www/logs/access_log</location>
  </localfile>

  <localfile>
    <log_format>apache</log_format>
    <location>/var/www/logs/error_log</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/exim_mainlog</location>
  </localfile>

</ossec_config>
user1@ubuntu2604l

如果沒有要寄信，把下面 yes 改成 no，重新啟動


<email_notification>yes</email_notification>

重新啟動


user1@ubuntu2604lts:~$ sudo /var/ossec/bin/ossec-control restart
ossec-monitord not running ..
ossec-logcollector not running ..
ossec-remoted not running ..
ossec-syscheckd not running ..
ossec-analysisd not running ..
ossec-maild not running ..
ossec-execd not running ..
OSSEC HIDS v4.1.0 Stopped
Starting OSSEC HIDS v4.1.0...
Started ossec-execd...
Started ossec-analysisd...
Started ossec-logcollector...
Started ossec-remoted...
Started ossec-syscheckd...
Started ossec-monitord...
Completed.
user1@ubuntu2604lts:~$

4.2.0版才有version參數


ser1@ubuntu2604lts:~$ sudo /var/ossec/bin/ossec-control version

Usage: /var/ossec/bin/ossec-control {start|stop|reload|restart|status|enable|disable}
user1@ubuntu2604lts:~$


user1@ubuntu2604lts:~$ dpkg -l | grep ossec
ii  ossec-hids-server                          4.1.0-40639resolute                        amd64        OSSEC Server - Host Based Intrusion Detection System
user1@ubuntu2604lts:~$


ser1@ubuntu2604lts:~$ sudo tail -f /var/ossec/logs/ossec.log
2026/09/01 14:09:02 ossec-syscheckd: INFO: Starting syscheck scan (forwarding database).
2026/09/01 14:09:02 ossec-syscheckd: INFO: Starting syscheck database (pre-scan).
2026/09/01 14:10:11 ossec-logcollector(1904): INFO: File not available, ignoring it: '/var/log/messages'.
2026/09/01 14:10:11 ossec-logcollector(1904): INFO: File not available, ignoring it: '/var/log/authlog'.
2026/09/01 14:10:11 ossec-logcollector(1904): INFO: File not available, ignoring it: '/var/log/secure'.
2026/09/01 14:10:11 ossec-logcollector(1904): INFO: File not available, ignoring it: '/var/log/xferlog'.
2026/09/01 14:10:11 ossec-logcollector(1904): INFO: File not available, ignoring it: '/var/log/maillog'.
2026/09/01 14:10:11 ossec-logcollector(1904): INFO: File not available, ignoring it: '/var/www/logs/access_log'.
2026/09/01 14:10:11 ossec-logcollector(1904): INFO: File not available, ignoring it: '/var/www/logs/error_log'.
2026/09/01 14:10:11 ossec-logcollector(1904): INFO: File not available, ignoring it: '/var/log/exim_mainlog'.

OSSEC Web GUI 比較

名稱	OSSEC 4.x	Ubuntu 26.04	Web URL	Agent 管理	Alert	FIM	安裝難度	推薦
OSSEC Web UI (`ossec-wui`)	⚠️ 未正式支援	⚠️ 不建議	`http://Server/ossec-wui/`	△	✅	△	★★☆☆☆	35/100
KOFE：Kibana + OSSEC + Filebeat + Elasticsearch	⚠️ 舊架構	❌ 不建議直接使用	Kibana URL	❌	✅	△	★★★★☆	45/100
Kibana + OSSEC Log/Filebeat 自建	△	△	`http://Server:5601`	❌	✅	△	★★★★★	50/100
Splunk + OSSEC	△	✅	`https://Server:8000`	❌	✅	△	★★★★☆	55/100
OpenSearch Dashboards + OSSEC	△	△	`https://Server:5601`	❌	✅	△	★★★★☆	65/100
Atomic OSSEC GUI	✅	依版本	Web GUI	✅	✅	✅	★★★☆☆	90/100*
Wazuh Dashboard	❌（不是 OSSEC Server GUI）	✅*	`https://Server/`	✅	✅	✅	★★★☆☆	95/100*

* Atomic OSSEC GUI 並不是單純免費 OSSEC 的 Web GUI；官方目前將 GUI、SIEM、FIM、OpenSearch 整合等列為 Atomic OSSEC 的功能。官方也明確區分免費 OSSEC 與商業 Atomic OSSEC。

* Wazuh 是 OSSEC 的衍生/獨立發展平台，不應該理解成「OSSEC 4.x 的 Web GUI」。Wazuh 自己有 Server、Indexer、Dashboard 三個核心元件，Dashboard 才是它的 Web 管理介面。

Web畫面推薦

排名	方案	評分	我的建議
🥇	Wazuh	95	⭐⭐⭐⭐⭐ 最推薦，但不是 OSSEC 4.x GUI
🥈	OpenSearch + OSSEC	65	⭐⭐⭐⭐ 適合自己組 SIEM
🥉	Splunk + OSSEC	55	⭐⭐⭐ 有強大搜尋，但不是完整 OSSEC GUI
4	Kibana + OSSEC/Filebeat	50	⭐⭐⭐ 舊架構，不建議新建
5	KOFE	45	⭐⭐ 太舊
6	OSSEC Web UI	35	⭐ 不建議，已 Deprecated

https://www.ossec.net/ossec-gui-dashboard/

建議直接架設 Wazuh。

(完)

浮雲雅築

2026年9月2日星期三

[研究]OSSEC HIDS v4.1.0 Server 安裝 (Ubuntu 26.04 LTS)

沒有留言:

張貼留言

2026年9月2日 星期三

[研究]OSSEC HIDS v4.1.0 Server 安裝 (Ubuntu 26.04 LTS)

沒有留言:

張貼留言

2026年9月2日星期三