{"id":7466,"date":"2022-04-22T14:36:30","date_gmt":"2022-04-22T21:36:30","guid":{"rendered":"https:\/\/www.xh86.me\/?p=7466"},"modified":"2022-04-22T14:36:30","modified_gmt":"2022-04-22T21:36:30","slug":"centos7%e4%b8%8b%e9%83%a8%e7%bd%b2ossec%e5%bc%80%e6%ba%90%e4%b8%bb%e6%9c%ba%e5%85%a5%e4%be%b5%e6%a3%80%e6%b5%8b%e7%b3%bb%e7%bb%9fhids%e5%b9%b6%e6%8e%a5%e5%85%a5%e5%88%b0graylog","status":"publish","type":"post","link":"https:\/\/www.xh86.me\/?p=7466","title":{"rendered":"CentOS7\u4e0b\u90e8\u7f72OSSEC\u5f00\u6e90\u4e3b\u673a\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf(HIDS)\u5e76\u63a5\u5165\u5230GrayLog"},"content":{"rendered":"
\n

OSSEC \u662f\u4e00\u4e2a\u53ef\u6269\u5c55\u3001\u591a\u5e73\u53f0\u3001\u5f00\u6e90\u7684\u57fa\u4e8e\u4e3b\u673a\u7684\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf (HIDS)<\/span><\/p>\n

\n

OSSEC \u62e5\u6709\u5f3a\u5927\u7684\u5173\u8054\u548c\u5206\u6790\u5f15\u64ce\uff0c\u96c6\u6210\u4e86\u65e5\u5fd7\u5206\u6790\u3001\u6587\u4ef6\u5b8c\u6574\u6027\u76d1\u63a7\u3001Windows \u6ce8\u518c\u8868\u76d1\u63a7\u3001\u96c6\u4e2d\u7b56\u7565\u6267\u884c\u3001rootkit \u68c0\u6d4b\u3001\u5b9e\u65f6\u8b66\u62a5\u548c\u4e3b\u52a8\u54cd\u5e94\u3002\u5b83\u53ef\u4ee5\u5728\u5927\u591a\u6570\u64cd\u4f5c\u7cfb\u7edf\u4e0a\u8fd0\u884c\uff0c\u5305\u62ec Linux\u3001OpenBSD\u3001FreeBSD\u3001MacOS\u3001Solaris \u548c Windows\u3002<\/p>\n

<\/div><\/p>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

\u4e00\u3001OSSEC Server\u670d\u52a1\u7aef\u642d\u5efa<\/span><\/h1>\n

1\u3001CentOS7\u64cd\u4f5c\u7cfb\u7edf\u57fa\u7840\u73af\u5883\u914d\u7f6e<\/span><\/h2>\n
hostnamectl\u00a0set<\/span>-hostname\u00a0ossecserver\r\nsystemctl\u00a0restart\u00a0rsyslog\r\nsed\u00a0-i\u00a0's\/enable\/disabled\/g'<\/span>\u00a0\/etc\/selinux\/config\r\nsetenforce\u00a00\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
2\u3001\u5b89\u88c5mariadb<\/span><\/h2>\n
yum\u00a0install\u00a0mariadb-server\r\nsystemctl\u00a0start\u00a0mariadb\r\nsystemctl\u00a0enable<\/span>\u00a0mariadb\r\nmysql_secure_installation\u00a0\r\nnetstat\u00a0-anp\u00a0|\u00a0grep\u00a03306\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
mysql\u00a0-uroot\u00a0-pMySQL_2022<\/code><\/pre>\n
create\u00a0database\u00a0ossec;
\ngrant\u00a0INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE\u00a0on\u00a0ossec.*\u00a0to\u00a0ossec@localhost;
\nset<\/span>\u00a0password\u00a0for<\/span>\u00a0ossec@localhost=PASSWORD(‘password’<\/span>);
\nflush\u00a0privileges;<\/p>\n
<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
3\u3001\u5b89\u88c5OSSEC-Server\u5e76\u5bfc\u5165MySQL schema<\/span><\/h2>\n
yum\u00a0localinstall\u00a0*.rpm\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\n
cd<\/span>\u00a0\/usr\/share\/ossec\/contrib\/\r\n\u00a0mysql\u00a0-uroot\u00a0-p\u00a0ossec\u00a0<\u00a0mysql.schema\u00a0\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\/var\/ossec\/bin\/ossec-control\u00a0enable<\/span>\u00a0database\r\ncd<\/span>\u00a0\/var\/ossec\/bin\r\n.\/ossec-configure\u00a0\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
4\u3001\u914d\u7f6e\u6587\u4ef6\u4e2d\u6dfb\u52a0output\u6570\u636e\u5e93\u914d\u7f6e<\/span><\/h2>\n
cd<\/span>\u00a0\/var\/ossec\/etc\/\r\nvim\u00a0ossec-server.conf\u00a0\r\n\u00a0\u00a0\u00a0\u00a0\u00a0<database_output>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<hostname>127.0.0.1<\/hostname>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<username>ossec<\/username>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<password>password<\/password>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<database>ossec<\/database>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<type<\/span>>mysql<\/type<\/span>>\r\n\u00a0\u00a0\u00a0\u00a0<\/database_output>\u00a0\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
 <\/p>\n
cd<\/span>\u00a0\/var\/ossec\/bin\u00a0\r\n\u00a0.\/ossec-control\u00a0restart\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
5\u3001\u6dfb\u52a0\u5ba2\u6237\u7aef\u5e76\u751f\u6210Key<\/span><\/h2>\n
.\/manage_agents\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u4e8c\u3001OSSEC Agent\u5ba2\u6237\u7aef\u5b89\u88c5\u53ca\u914d\u7f6e<\/span><\/h1>\n
1\u3001\u5b89\u88c5OSSEC-Agent<\/span><\/h2>\n
yum\u00a0localinstall\u00a0*.rpm\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
2\u3001\u4fee\u6539\u914d\u7f6e\u6587\u4ef6\u5e76\u542f\u52a8\u5ba2\u6237\u7aef<\/span><\/h2>\n
cd<\/span>\u00a0\/var\/ossec\/etc\/\r\nvim\u00a0ossec-agent.conf\r\nvim\u00a0internal_options.conf\u00a0\r\ncd<\/span>\u00a0\/var\/ossec\/bin\r\ntouch\u00a0\/var\/ossec\/queue\/rids\/sender\r\n.\/manage_agent\u00a0\r\n.\/ossec-control\u00a0restart\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
3\u3001\u670d\u52a1\u7aef\u786e\u8ba4Agent\u662f\u5426\u4e0a\u7ebf<\/span><\/h2>\n
\/var\/ossec\/bin\r\n.\/agent_control\u00a0-lc\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u4e09\u3001OSSEC-WUI Web\u670d\u52a1\u542f\u52a8<\/span><\/h1>\n
vi\u00a0\/etc\/php.ini\r\nsystemctl\u00a0restart\u00a0httpd\r\nsystemctl\u00a0enable<\/span>\u00a0httpd\r\n<\/code><\/pre>\n
<\/div><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u56db\u3001\u914d\u7f6eCEF\u65e5\u5fd7\u8f6c\u53d1\u5230Graylog<\/span><\/h1>\n
1\u3001\u53c2\u8003\u6587\u7ae0<\/span><\/h2>\n
https:\/\/github.com\/Graylog2\/graylog-guide-ossec\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
2\u3001OSSEC-Server\u670d\u52a1\u7aef\u6dfb\u52a0syslog_output<\/span><\/h2>\n
vim\u00a0\/var\/ossec\/etc\/ossec.conf\r\n\u6dfb\u52a0\u5982\u4e0b\u884c\r\n\u00a0\u00a0<syslog_output>\r\n\u00a0\u00a0\u00a0\u00a0<server>192.168.31.232<\/server>\r\n\u00a0\u00a0\u00a0\u00a0<port>12000<\/port>\r\n\u00a0\u00a0\u00a0\u00a0<format>cef<\/format>\r\n\u00a0\u00a0<\/syslog_output><\/code><\/pre>\n
 <\/p>\n
<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\/var\/ossec\/bin\/ossec-control\u00a0enable<\/span>\u00a0client-syslog\r\n\/var\/ossec\/bin\/ossec-control\u00a0restart\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u4e94\u3001HIDS\u529f\u80fd\u6d4b\u8bd5<\/span><\/h1>\n
1\u3001\u4f8b\u5982\u66b4\u529b\u7834\u89e3\u653b\u51fb\u6d4b\u8bd5<\/span><\/h2>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u53ef\u4ee5\u770b\u5230\u5df2\u7ecf\u81ea\u52a8\u8fdb\u884c\u4e86\u5c01\u5835<\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
2\u3001\u7cfb\u7edf\u5b8c\u6574\u6027\u6d4b\u8bd5<\/span><\/h2>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u516d\u3001Tips<\/span><\/h1>\n
1\u3001\u9a8c\u8bc1MariaDB\u6570\u636e\u5e93\u662f\u5426\u6b63\u5e38\u5bf9\u63a5<\/span><\/h2>\n
SELECT\u00a0id,server_id,rule_id,level,timestamp,location_id,src_ip,dst_ip,src_port,dst_port,alertid,user\u00a0FROM\u00a0alert\u00a0;\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
2\u3001\u914d\u7f6e\u6587\u4ef6\u6392\u9519\u65f6\u53c2\u8003\u5982\u4e0b\u94fe\u63a5<\/span><\/h2>\n
https:\/\/ossec-list.narkive.com\/bJiYSQh2\/errors-in-ossec-clients\r\nhttps:\/\/www.ossec.net\/docs\/<\/code><\/pre>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
OSSEC \u662f\u4e00\u4e2a\u53ef\u6269\u5c55\u3001\u591a\u5e73\u53f0\u3001\u5f00\u6e90\u7684\u57fa\u4e8e\u4e3b\u673a\u7684\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf (HIDS) OSSEC \u62e5\u6709\u5f3a\u5927\u7684\u5173\u8054\u548c\u5206\u6790 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,3],"tags":[],"class_list":["post-7466","post","type-post","status-publish","format-standard","hentry","category-linux","category-system"],"_links":{"self":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7466"}],"version-history":[{"count":1,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7466\/revisions"}],"predecessor-version":[{"id":7814,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7466\/revisions\/7814"}],"wp:attachment":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}