OSSEC-GUI/README.md

<img src="https://linuxhint.com/wp-content/uploads/2019/05/Getting-started-with-OSSEC.jpg" width="50%">

# Install OSSEC XDR:
<br>
Version en cours 3.7 (voir le repo github en fin du README):
<br>

# Pour Linux:

<code>apt-get upgrade -y</code>
<br>

# Install du repository
<code>wget -q -O - https://updates.atomicorp.com/installers/atomic | sudo bash</code><br>

# Update
<code>sudo apt-get update</code><br>

# Server
<code>sudo apt-get install ossec-hids-server</code><br>

# Agent
<code>sudo apt-get install ossec-hids-agent</code><br>


<code>addgroup user ossec</code><br>
changer user par votre utilisateur.<br>

<code>nano /var/ossec/etc/ossec.conf</code>
```
<global>
    <email_notification>yes</email_notification>
    <email_to>root@localhost</email_to>
    <smtp_server>127.0.0.1</smtp_server>
    <email_from>ossecm@localhost</email_from>
</global>
```
```
<syscheck> 
    <!-- Frequency that syscheck is executed - default to every 22 hours --> 
    <frequency>79200</frequency> 
    <alert_new_files>yes</alert_new_files>
```
```
<!-- Directories to check (perform all possible verifications) --> 
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> 
<directories check_all="yes">/bin,/sbin</directories>

<directories report_changes="yes" realtime="yes" check_all="yes">/etc,/usr/bin,/usr/sbin</directories> 
<directories report_changes="yes" realtime="yes" check_all="yes">/var/www,/bin,/sbin</directories>
```

<code>nano /var/ossec/rules/local_rules.xml</code>
```
<rule id="554" level="7" overwrite="yes"> 
    <category>ossec</category> 
    <decoded_as>syscheck_new_entry</decoded_as> 
    <description>File added to the system.</description> 
    <group>syscheck,</group> 
</rule>
```
# Generation des clefs:
<code>
openssl genrsa -out /var/ossec/etc/client.keys 2048
</code>
<br>
<code>
openssl req -new -x509 -key /var/ossec/etc/client.keys -out /var/ossec/etc/client.cert -days 365
</code>

<code>/var/ossec/bin/ossec-control restart</code>

<code>
chmod 775 -R /var/ossec
</code>
<br>
<code>
chown -R ossec:ossec /var/ossec
</code>

```
sudo touch /var/log/messages
sudo touch /var/log/authlog
sudo touch /var/log/authlog
sudo touch /var/log/secure
sudo touch /var/log/authlog
sudo touch /var/log/xferlog

sudo mkdir /var/www/logs/
sudo touch /var/www/logs/access_log
sudo touch /var/www/logs/error_log
```


Si error queue:<br>
<code>sudo apt-get install ossec-hids-server</code>

# Install OSSEC Web UI Version 1.0 pas 0.8 /!\

La version 0.8
wget https://github.com/ossec/ossec-wui/archive/master.zip

# Ma contribution Ossec Web Gui pour Php 8.1 ou +

unzip ossec_1.0.zip 
mv ossec /var/www
attention à votre chemin apache web (/var/www/html)
<code>
chown -R www-data:www-data /var/www/ossec
</code>
<code>
chmod -R 775 /var/www/ossec
</code>
<code>cd /var/www/ossec</code>

<code>./setup.sh</code>

Username: admin 
New password: 
Re-type new password: 
Adding password for user admin 
Enter your web server user name (e.g. apache, www, nobody, www-data, ...) 
www-data 
You must restart your web server after this setup is done.

Setup completed successfully.

<code>systemctl restart apache2</code>


verifier les process:
```
ossecm      2389  0.0  0.0   3740   416 ?        S    11:37   0:00 /var/ossec/bin/ossec-maild<br>
root        2393  0.0  0.0   2988   328 ?        S    11:37   0:00 /var/ossec/bin/ossec-execd<br>
ossec       2397  0.3  0.1   8280  6844 ?        S    11:37   0:00 /var/ossec/bin/ossec-analysisd<br>
root        2401  0.0  0.0   7124   456 ?        S    11:37   0:00 /var/ossec/bin/ossec-logcollector<br>
root        2411  0.0  0.0   3908   404 ?        S    11:37   0:00 /var/ossec/bin/ossec-syscheckd<br>
ossec       2415  0.0  0.0   3884  1472 ?        S    11:37   0:00 /var/ossec/bin/ossec-monitord<br>
```

check mail<br>

<code>apt install mutt</code>
<br>
<code>sudo mutt</code>

# Pour Windows Agent:
Voir ossec-agent-win32-3.2.0-6132.exe

Le fichier ossec-hids-3.2.0.tar.gz est les sources en version 3.2

voir le GitHub de OSSEC:
https://github.com/ossec/ossec-hids