LearnAdmin: June 2013

Install and configure OSSEC ( Host-based Intrusion Detection System ) - By Subhash C

OSSEC is used to meet PCI Compliance central logging and intrusion monitoring requirements with a free and self-managed solution. OSSEC monitors all types of logs such as syslog, apache, maillogs, mysql logs, ftp logs, and more.

1. Deploying OSSEC core server:

# Wget http://www.ossec.net/files/ossec-hids-2.7.tar.gz

2. Extract the compressed OSSEC package and run the “./install.sh” script (It will guide you through the installation).

# tar -xvf ossec-hids-2.7.tar.gz

# cd ossec-hids-2.7

# ./install.sh

The interactive installation begins and during this process it prompts for installation type either server or agent or local. However, installation path for OSSEC can be defined but by default it installs in (/var/ossec) directory. It is advised to select default settings and follow accordingly till the end of the installation. Finally, it is compiled and installed successfully according to the specification provided.

Select the language (in this example it is EN)

Select the type of installation as server

Accept the default folder, unless you want to change it:

Enable email notification by specifying the email address which will be used to send email alerts FROM:

If setup fails to determine your SMTP gateway automatically, you may specify it manually (change the IP as necessary to reflect your environment):

Enable integrity check daemon:

Enable rootkit detection daemon:

Whether or not you want to have “Active response” enabled is up to you. Although in prod environment, it can be quite risky.

We will not be using Syslog daemon feature in this example, so disable it.

OSSEC core server installation is now completed.

1. Generating client keys

OSSEC server with the agent names in order to generate unique authentication keys required to bind the agent to the corresponding OSSEC server.

a. Firstly, create agents.TXT file containing the IPs and names separated by comma, of all target Linux Servers:

192.168.9.101,rwca1

...

…

….

Save:wq!

b. Place this file to /var/ossec folder on OSSEC server.

c. Now execute the following command: /var/ossec/bin/manage_agents -f /agents.txt

More info: http://www.ossec.net/doc/programs/manage_agents.html

1. Start OSSEC Server

# /var/ossec/bin/ossec-control start
# /var/ossec/bin/ossec-control restart
#/var/ossec/bin/ossec-control stop

2. Install the OSSEC Agents

Follow above server installation steps, instead of server choose type agent

# tar -xvf ossec-hids-2.7.tar.gz

# cd ossec-hids-2.7

# ./install.sh

Select the type of installation as agent

3. Add Agents to OSSEC Manager

To add an agent to an OSSEC manager with manage_agents you need to follow the steps below.

Run manage_agents on the OSSEC server.
Add an agent.
Extract the key for the agent.
Copy that key to the agent.
Run manage_agents on the agent.
Import the key copied from the manager.
Restart the manager’s OSSEC processes.
Start and restart the agent.

Follow online Guide: http://www.ossec.net/doc/manual/agent/agent-management.html#running-manage-agents-and-start-screen

4. Verify successful installation of the agent

Then verify that the client has been installed successfully and communicating with the OSSEC server.

# tail –f /var/ossec/log/ossec.log

5. Deploy OSSEC Web UI dashboard

Install PHP for OSSEC UI

# yum install php-mysql php-devel php-gd php-pecl-memcache php-pspell php-snmp php-xmlrpc php-xml

# Start Apache: /etc/init.d/httpd start

# Configure Apache autostart: /sbin/chkconfig httpd on

# Restart Apache: /etc/init.d/httpd restart

Download OSSEC webUI module

# cd /var/ww/html/

# Wget http://www.ossec.net/files/ossec-wui-0.8-alpha-0.tar.gz

# tar –xvf ossec-wui-0.8-alpha-0.tar.gz

# mv ossec-wui-0.8-alpha ossec-wui

# Switch to the ossec-wui and run

./setup.sh - specify user and password to protect Web UI.

# Add apache user to ossec group:

Change permissions for /var/ossec/tmp directory:

# chmod 770 /var/ossec/ tmp/

# chgrp apache /var/ossec/tmp/

# /etcinit.d/httpd restart

# /var/ossec/bin/ossec-control restart (restart the OSSEC server)

Access the OSSEC web portal: http://your-ip-address/ossec-wui

in the above URL replace your-ip-address with ip address where you installed ossec-wui

More info: http://www.ossec.net/wiki/index.php/OSSECWUI:Install

Step by step tutorial to configure two node redhat clustering By -- Sojan VM

Two node Red Hat and Clustering

node1

node2

management server

Configure the Shared Storage

Install the clustering software on the nodes

High availability application service “High Availability”

package group and webserver

service ricci start

provide passwd for ricci

Install the cluster management software on

the management server

yum groupinstall “High Availability Management”

chkconfig luci on

service luci start

https://manage.example.com:8084

Define a cluster

Node1 and Node2

Then create a partition and format

Define kvm Fence device

Cluster.conf--------------------cluster configuration fine

<?xml version="1.0"?>

<cluster config_version="6" name="cluster">

<clusternodes>

<clusternode name="cluster_node1" nodeid="1">

<fence>

<method name="kvm">

<device domain="cluster_node1" name="kvm"/>

</method>

</fence>

</clusternode>

<clusternode name="cluster_node2" nodeid="2">

<fence>

<method name="kvm">

<device domain="cluster_node2" name="kvm"/>

</method>

</fence>

</clusternode>

</clusternodes>

<cman expected_votes="1" two_node="1"/>

<fencedevices>

<fencedevice agent="fence_xvm" name="kvm"/>

</fencedevices>

</cluster>

Kvm Host configuration

Let's start Installing the necessary packages on the host:

yum install fence-virt fence-virtd fence-virtd-libvirt fence-virtd-multicast

Then create the key needed for the host to authenticate all the fencing requests from the guest cluster:

dd if=/dev/urandom of=/etc/cluster/fence_xvm.key bs=4096 count=1

The key should then be copied to /etc/cluster/fence_xvm.key of every guest.

Now run the configuration tool:

fence_virtd –c

service fence_virtd start

check your fence is working or not:

fence_xvm -o reboot –H node2

Define Resources For Clustered Web Service

Shared Storage (if not in fstab)

IP address

Apache Resource

Define Failover Domains

Node2

Define Clustered Web Service

Define service

Add storage resource (if not in fstab)

Add ip address resource

add script resource

Fix : rpmdb: unable to lock mutex: Invalid argument


 If you are getting this message printed out repeatedly on the terminal screen while trying to install some packages using yum

 

# rpmdb: unable to lock mutex: Invalid argument



 

 yum -y update glibc ( This works sometimes )

 

If that doesn not work then execute below command 



 

rpmdb --rebuilddb -vv

LearnAdmin

Labels