OSSEC
OSSEC
Advantages of OSSEC :
1. Open source (yea).
2. OSSEC monitors integrity of system and log files.
3. Root kit detection.
4. An active response system. This means OSSEC will not only monitor, but also respond to threats (black list naughty IP addresses).
5. Optional web based graphical (monitoring) interface.
6. Optional central server (consolidates monitoring multiple systems).
7. OSSEC is relatively easy to set up.
The potential disadvantage of ossec, you would need to install apache to use the web interface. If you are already running a headless or remote server with apache then adding the ossec-wui is not as drastic. If you are on a Desktop you can bind apache to localhost (127.0.0.1) and restrict external connections with iptables (see below).
Home page: http://www.ossec.net/
OSSEC manual
OSSEC FAQ
Download and install OSSEC
Install Dependencies (gcc)
Code:
apt-get install -y gcc
Download the latest version of OSSEC
Code:
wget http://www.ossec.net/files/ossec-hids-2.4.tar.gz
Extract the archive and install
Code:
tar xvf ossec-hids-2.4.tar.gz
cd ossec-hids-2.4
sudo ./install.sh
The installation is very easy, you simply answer a few questions or hit the enter key for the defaults. The only question you have to answer is "What kind of installation do you want (server, agent, local or help)?" , at that question type "local" and hit enter (see below).
Select your language
Select "local" as the type of installation
What kind of installation do you want (server, agent, local or help)? local
The only default I personally change is the email report. Because I prefer the web interface I answer no to this question.
Do you want e-mail notification? (y/n) [y]:n
Otherwise go with the defaults (hit enter).
Start ossec
Code:
sudo /etc/init.d/ossec start
Install and configure the web interface
Step 1: Install apache and php5
Code:
sudo apt-get -y install apache2 php5
Setp 2: Download and configure the wui (Web User Interface)
Code:
cd /var/www
sudo wget http://www.ossec.net/files/ui/ossec-wui-0.3.tar.gz
sudo tar xvf ossec-wui-0.3.tar.gz
sudo rm ossec-wui-0.3.tar.gz
sudo mv ossec-wui-0.3 ossec
cd into the ossec directory and install ossec
Code:
cd /var/www/ossec
sudo ./setup.sh
As the wui is installed you will be asked a user name and password. Enter the user name and password of your choice.
Set the proper permissions of the ossec directory:
Code:
sudo chown -R www-data.www-data /var/www/ossec
Add www-data to the ossec group
Code:
sudo nano /etc/group
Find the ossec line (most likely at the bottom of the file) and add www-data to the ossec group
Save and exit nano
Set the permissions of /var/www/ossec/tmp
Code:
sudo chmod 770 /var/www/ossec/tmp
sudo chgrp www-data /var/www/ossec/tmp
Restart apache
Code:
sudo service apache2 restart
Open the page with firefox and go to the ossec directory
http://localhost/ossec
http://ip_address/ossec
As is typical of HIDS, be prepared to read up on any alerts you receive from OSSEC.
Restricting access to the ossec-wui
1. Using Apache.
Edit your Virtual Host. Unless you defined a virtual host for ossec, the default is /etc/apache2/sites-available/default
Under the section <Directory /var/www> edit the following lines :
From
Order allow,deny
allow from all
To
Code:
Order deny,allow
Deny from all
Allow from 127.0.0.0/255.0.0.0 ::1/128
Restart Apache
Code:
sudo service apache2 restart
2. With iptables
One line (assuming your default policy is ACCEPT):
Code:
sudo iptables -A INPUT -p tcp -m tcp --dport 80 ! -s 127.0.0.1 -j DROP
3. As an alternate to iptables, simply enable ufw
That will block incoming requests to apache (connections from localhost are allowed).
4. If you connect to the ossec wui, from an external client, especially over the internet, I highly advise you use ssl (https) and password protect the ossec directory.
There are several tutorials on the internet including the Ubuntu wiki is, IMO, a nice start.
Apache documentation Authentication, Authorization and Access Control
5. If you do NOT have access to the apache configuration file , use .htaccess :
Password protecting a directory with Apache and .htaccess
Apache Web Login Authentication
Apache Tutorial: .htaccess files
In general, you should never use .htaccess files unless you don't have access to the main server configuration file. There is, for example, a prevailing misconception that user authentication should always be done in .htaccess files. This is simply not the case. You can put user authentication configurations in the main server configuration, and this is, in fact, the preferred way to do things.
Back to top
