OSSEC 拥有强大的关联和剖析引擎，集成了日志剖析、文件完全性监控、Windows 注册表监控、集中策略实行、rootkit 检测、实时警报和主动相应。它可以在大多数操作系统上运行，包括 Linux、OpenBSD、FreeBSD、MacOS、Solaris 和 Windows。
(图片可点击放大查看)
hostnamectl set-hostname ossecserversystemctl restart rsyslogsed -i 's/enable/disabled/g' /etc/selinux/configsetenforce 0
(图片可点击放大查看)
2、安装mariadbyum install mariadb-serversystemctl start mariadbsystemctl enable mariadbmysql_secure_installation netstat -anp | grep 3306
(图片可点击放大查看)
(图片可点击放大查看)
(图片可点击放大查看)
mysql -uroot -pMySQL_2022create database ossec;grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on ossec. to ossec@localhost;set password for ossec@localhost=PASSWORD('password');flush privileges;
(图片可点击放大查看)
3、安装OSSEC-Server并导入MySQL schemayum localinstall .rpm
(图片可点击放大查看)
(图片可点击放大查看)
cd /usr/share/ossec/contrib/ mysql -uroot -p ossec < mysql.schema
(图片可点击放大查看)
/var/ossec/bin/ossec-control enable databasecd /var/ossec/bin./ossec-configure
(图片可点击放大查看)
4、配置文件中添加output数据库配置cd /var/ossec/etc/vim ossec-server.conf <database_output> <hostname>127.0.0.1</hostname> <username>ossec</username> <password>password</password> <database>ossec</database> <type>mysql</type> </database_output>
(图片可点击放大查看)
cd /var/ossec/bin ./ossec-control restart
(图片可点击放大查看)
(图片可点击放大查看)
5、添加客户端并天生Key./manage_agents
(图片可点击放大查看)
二、OSSEC Agent客户端安装及配置1、安装OSSEC-Agentyum localinstall .rpm
(图片可点击放大查看)
2、修正配置文件并启动客户端cd /var/ossec/etc/vim ossec-agent.confvim internal_options.conf cd /var/ossec/bintouch /var/ossec/queue/rids/sender./manage_agent ./ossec-control restart
(图片可点击放大查看)
(图片可点击放大查看)
(图片可点击放大查看)
(图片可点击放大查看)
3、做事端确认Agent是否上线/var/ossec/bin./agent_control -lc
(图片可点击放大查看)
三、OSSEC-WUI Web做事启动vi /etc/php.inisystemctl restart httpdsystemctl enable httpd
(图片可点击放大查看)
(图片可点击放大查看)
(图片可点击放大查看)
(图片可点击放大查看)
(图片可点击放大查看)
四、配置CEF日志转发到Graylog1、参考文章https://github.com/Graylog2/graylog-guide-ossec
(图片可点击放大查看)
2、OSSEC-Server做事端添加syslog_outputvim /var/ossec/etc/ossec.conf添加如下行 <syslog_output> <server>192.168.31.232</server> <port>12000</port> <format>cef</format> </syslog_output>
(图片可点击放大查看)
/var/ossec/bin/ossec-control enable client-syslog/var/ossec/bin/ossec-control restart
(图片可点击放大查看)
(图片可点击放大查看)
五、HIDS功能测试1、例如暴力破解攻击测试(图片可点击放大查看)
(图片可点击放大查看)
可以看到已经自动进行了封堵
(图片可点击放大查看)
2、系统完全性测试(图片可点击放大查看)
(图片可点击放大查看)
六、Tips1、验证MariaDB数据库是否正常对接SELECT id,server_id,rule_id,level,timestamp,location_id,src_ip,dst_ip,src_port,dst_port,alertid,user FROM alert ;
(图片可点击放大查看)
2、配置文件排错时参考如下链接https://ossec-list.narkive.com/bJiYSQh2/errors-in-ossec-clientshttps://www.ossec.net/docs/
