OSSEC – Installazione Agent

Dopo aver installato OSSEC Server, installiamo su un altro sistema l’agent di OSSEC che invierà gli eventi all’OSSEC server. 

Se il repository non fosse ancora installato, procederemo con l’installazione del repository esattamente come fatto per l’installazione di OSSEC Server; successivamente, installiamo l’agent:

# yum -y install make tcl expect  \
  ossec-hids ossec-hids-agent GeoIP GeoIP-GeoLite-data 
# systemctl daemon-reload

Apriamo il file di configurazione di ossec ( /var/ossec/etc/ossec.conf ), e modifichiamo la riga relativa alla configurazione del server a cui inviare i dati:

...
  <client>
    <server-ip>192.168.45.85</server-ip>
  </client>
 ...

Prima di avviare l’agent, occorre registrare il client sul server; per cui, sul server:

# /var/ossec/bin/manage_agents

****************************************
* OSSEC HIDS v3.6.0 Agent manager.     *
* The following options are available: *
****************************************
   (A)dd an agent (A).
   (E)xtract key for an agent (E).
   (L)ist already added agents (L).
   (R)emove an agent (R).
   (Q)uit.
Choose your action: A,E,L,R or Q: A

- Adding a new agent (use '\q' to return to the main menu).
  Please provide the following:
   * A name for the new agent: <NomeSimbolico>
   * The IP Address of the new agent: 192.168.xxx.xxx
   * An ID for the new agent[027]:
Agent information:
   ID:027
   Name:<NomeSimbolico>
   IP Address:192.168.xxx.xxx

Confirm adding it?(y/n): y
Agent added with ID 027.

****************************************
* OSSEC HIDS v3.6.0 Agent manager.     *
* The following options are available: *
****************************************
   (A)dd an agent (A).
   (E)xtract key for an agent (E).
   (L)ist already added agents (L).
   (R)emove an agent (R).
   (Q)uit.
Choose your action: A,E,L,R or Q: E

Available agents:
   ID: 027, Name: <NomeSimbolico>, IP: 192.168.xxx.xxx
Provide the ID of the agent to extract the key (or '\q' to quit): 027

Agent key information for '027' is:
MwAxIXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXWZkNTVkYzE3MDcXXXXXXXXXXXXXlOTlkMWQxNWE3Ng==

** Press ENTER to return to the main menu

****************************************
* OSSEC HIDS v3.6.0 Agent manager.     *
* The following options are available: *
****************************************
   (A)dd an agent (A).
   (E)xtract key for an agent (E).
   (L)ist already added agents (L).
   (R)emove an agent (R).
   (Q)uit.
Choose your action: A,E,L,R or Q: Q

** You must restart OSSEC for your changes to take effect.

manage_agents: Exiting.

Come indicato, provvediamo a riavviare OSSEC server:

# systemctl restart ossec-hids

Registriamo la chiave rilasciata dal server sul client:

# /var/ossec/bin/manage_agent

****************************************
* OSSEC HIDS v3.6.0 Agent manager.     *
* The following options are available: *
****************************************
   (I)mport key from the server (I).
   (Q)uit.
Choose your action: I or Q: I

* Provide the Key generated by the server.
* The best approach is to cut and paste it.
*** OBS: Do not include spaces or new lines.

Paste it here (or '\q' to quit): MwAxIXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXWZkNTVkYzE3MDcXXXXXXXXXXXXXlOTlkMWQxNWE3Ng==

Agent information:
   ID:027
   Name:<NomeSimbolico>
   IP Address:192.168.xxx.xxx

Confirm adding it?(y/n): y
Added.
** Press ENTER to return to the main menu.

****************************************
* OSSEC HIDS v3.6.0 Agent manager.     *
* The following options are available: *
****************************************
   (I)mport key from the server (I).
   (Q)uit.
Choose your action: I or Q: Q

** You must restart OSSEC for your changes to take effect.
manage_agents: Exiting.

Se la procedura dovesse restituire l’errore seguente:

manage_agents: ERROR: Cannot unlink /queue/rids/sender: No such file or directory

potete risolvere il problema applicando la risposta indicata in questo post.

Riavviamo infine l’agent sul sistema client:

# systemctl restart ossec-hids

Nei file di log del client, troveremo le seguenti righe:

2020/04/18 16:28:35 os_dns imsg_init()
2020/04/18 16:28:35 INFO: Connected to 192.168.xxx.xxx at address 192.168.xxx.xxx, port 1514
2020/04/18 16:28:35 ossec-agentd: DEBUG: agt->sock: 13
2020/04/18 16:28:35 ossec-logcollector: Remote commands are not accepted from the manager. Ignoring it on the agent.conf
2020/04/18 16:28:36 ossec-agentd(4102): INFO: Connected to server 192.168.xxx.xxx, port 1514.

Sul server, potremo vedere gli agent connessi tramite il seguente comando:

# /var/ossec/bin/agent_control -lc 

OSSEC HIDS agent_control. List of available agents: 
ID: 000, Name: ossec.anthesia.lan (server), IP: 127.0.0.1, Active/Local
ID: ...... 
ID: 027, Name: <NomeSimbolico>, IP: 192.168.xxx.xxx, Active

Vediamo ora come visualizzare nello Stack Elastic i dati rilevati dall’OSSEC Server.

← OSSEC – Installazione Server

Wazuh – Un’estensione di OSSEC →