commit 365085c2b40d9ae06014074265fd65b7dda1e283 Author: Xavier Date: Fri Apr 14 12:05:35 2023 +0200 first commit diff --git a/README.md b/README.md new file mode 100755 index 0000000..aeae5ec --- /dev/null +++ b/README.md @@ -0,0 +1,153 @@ + + +# Install OSSEC XDR: +
+Version en cours 3.7 (voir le repo github en fin du README): +
+ +# Pour Linux: + +apt-get upgrade -y +
+ +# Install du repository +wget -q -O - https://updates.atomicorp.com/installers/atomic | sudo bash
+ +# Update +sudo apt-get update
+ +# Server +sudo apt-get install ossec-hids-server
+ +# Agent +sudo apt-get install ossec-hids-agent
+ + +addgroup user ossec
+changer user par votre utilisateur.
+ +nano /var/ossec/etc/ossec.conf +``` + + yes + root@localhost + 127.0.0.1 + ossecm@localhost + +``` +``` + + + 79200 + yes +``` +``` + +/etc,/usr/bin,/usr/sbin +/bin,/sbin + +/etc,/usr/bin,/usr/sbin +/var/www,/bin,/sbin +``` + +nano /var/ossec/rules/local_rules.xml +``` + + ossec + syscheck_new_entry + File added to the system. + syscheck, + +``` +# Generation des clefs: + +openssl genrsa -out /var/ossec/etc/client.keys 2048 + +
+ +openssl req -new -x509 -key /var/ossec/etc/client.keys -out /var/ossec/etc/client.cert -days 365 + + +/var/ossec/bin/ossec-control restart + + +chmod 775 -R /var/ossec + +
+ +chown -R ossec:ossec /var/ossec + + +``` +sudo touch /var/log/messages +sudo touch /var/log/authlog +sudo touch /var/log/authlog +sudo touch /var/log/secure +sudo touch /var/log/authlog +sudo touch /var/log/xferlog + +sudo mkdir /var/www/logs/ +sudo touch /var/www/logs/access_log +sudo touch /var/www/logs/error_log +``` + + +Si error queue:
+sudo apt-get install ossec-hids-server + +# Install OSSEC Web UI Version 1.0 pas 0.8 /!\ + +La version 0.8 +wget https://github.com/ossec/ossec-wui/archive/master.zip + +# Ma contribution Ossec Web Gui pour Php 8.1 ou + + +unzip ossec_1.0.zip +mv ossec /var/www +attention à votre chemin apache web (/var/www/html) + +chown -R www-data:www-data /var/www/ossec + + +chmod -R 775 /var/www/ossec + +cd /var/www/ossec + +./setup.sh + +Username: admin +New password: +Re-type new password: +Adding password for user admin +Enter your web server user name (e.g. apache, www, nobody, www-data, ...) +www-data +You must restart your web server after this setup is done. + +Setup completed successfully. + +systemctl restart apache2 + + +verifier les process: +``` +ossecm 2389 0.0 0.0 3740 416 ? S 11:37 0:00 /var/ossec/bin/ossec-maild
+root 2393 0.0 0.0 2988 328 ? S 11:37 0:00 /var/ossec/bin/ossec-execd
+ossec 2397 0.3 0.1 8280 6844 ? S 11:37 0:00 /var/ossec/bin/ossec-analysisd
+root 2401 0.0 0.0 7124 456 ? S 11:37 0:00 /var/ossec/bin/ossec-logcollector
+root 2411 0.0 0.0 3908 404 ? S 11:37 0:00 /var/ossec/bin/ossec-syscheckd
+ossec 2415 0.0 0.0 3884 1472 ? S 11:37 0:00 /var/ossec/bin/ossec-monitord
+``` + +check mail
+ +apt install mutt +
+sudo mutt + +# Pour Windows Agent: +Voir ossec-agent-win32-3.2.0-6132.exe + +Le fichier ossec-hids-3.2.0.tar.gz est les sources en version 3.2 + +voir le GitHub de OSSEC: +https://github.com/ossec/ossec-hids diff --git a/ossec-agent-win32-3.7.0-24343.exe b/ossec-agent-win32-3.7.0-24343.exe new file mode 100644 index 0000000..3b8878d Binary files /dev/null and b/ossec-agent-win32-3.7.0-24343.exe differ diff --git a/ossec-hids-3.7.0.tar.gz b/ossec-hids-3.7.0.tar.gz new file mode 100644 index 0000000..ba7e6d9 Binary files /dev/null and b/ossec-hids-3.7.0.tar.gz differ diff --git a/ossec.1.0.zip b/ossec.1.0.zip new file mode 100644 index 0000000..0a21835 Binary files /dev/null and b/ossec.1.0.zip differ diff --git a/ossec.conf.cli b/ossec.conf.cli new file mode 100755 index 0000000..69b52b3 --- /dev/null +++ b/ossec.conf.cli @@ -0,0 +1,69 @@ + + + + + 192.168.0.10 + + + yes + root@localhost + 127.0.0.1 + ossecm@localhost + + + + 79200 + yes + + /etc,/usr/bin,/usr/sbin + /bin,/sbin,/boot + + + /etc/mtab + /etc/hosts.deny + /etc/mail/statistics + /etc/random-seed + /etc/random.seed + /etc/adjtime + /etc/httpd/logs + + + /etc/ssl/private.key + + + + /var/ossec/etc/shared/rootkit_files.txt + /var/ossec/etc/shared/rootkit_trojans.txt + + + + syslog + /var/log/messages + + + + syslog + /var/log/authlog + + + + syslog + /var/log/auth.log + + + + syslog + /var/log/secure + + + + syslog + /var/log/xferlog + + + + syslog + /var/log/maillog + + + diff --git a/ossec.conf.srv b/ossec.conf.srv new file mode 100644 index 0000000..840fcf5 --- /dev/null +++ b/ossec.conf.srv @@ -0,0 +1,224 @@ + + + + + + 192.168.0.0/24 + + 127.0.0.1 + 192.168.0.10 + 1.1.1.1 + yes + root@localhost + 127.0.0.1 + ossecm@localhost + + + + rules_config.xml + pam_rules.xml + sshd_rules.xml + telnetd_rules.xml + syslog_rules.xml + arpwatch_rules.xml + symantec-av_rules.xml + symantec-ws_rules.xml + pix_rules.xml + named_rules.xml + smbd_rules.xml + vsftpd_rules.xml + pure-ftpd_rules.xml + proftpd_rules.xml + ms_ftpd_rules.xml + ftpd_rules.xml + hordeimp_rules.xml + roundcube_rules.xml + wordpress_rules.xml + cimserver_rules.xml + vpopmail_rules.xml + vmpop3d_rules.xml + courier_rules.xml + web_rules.xml + web_appsec_rules.xml + apache_rules.xml + nginx_rules.xml + php_rules.xml + mysql_rules.xml + postgresql_rules.xml + ids_rules.xml + squid_rules.xml + firewall_rules.xml + apparmor_rules.xml + cisco-ios_rules.xml + netscreenfw_rules.xml + sonicwall_rules.xml + postfix_rules.xml + sendmail_rules.xml + imapd_rules.xml + mailscanner_rules.xml + dovecot_rules.xml + ms-exchange_rules.xml + racoon_rules.xml + vpn_concentrator_rules.xml + spamd_rules.xml + msauth_rules.xml + mcafee_av_rules.xml + trend-osce_rules.xml + ms-se_rules.xml + + zeus_rules.xml + solaris_bsm_rules.xml + vmware_rules.xml + ms_dhcp_rules.xml + asterisk_rules.xml + ossec_rules.xml + attack_rules.xml + dropbear_rules.xml + unbound_rules.xml + sysmon_rules.xml + opensmtpd_rules.xml + exim_rules.xml + openbsd-dhcpd_rules.xml + dnsmasq_rules.xml + local_rules.xml + + + + + + 79200 + yes + + /etc,/usr/bin,/usr/sbin + /var/www,/bin,/sbin,/boot + + + /etc/mtab + /etc/hosts.deny + /etc/mail/statistics + /etc/random-seed + /etc/random.seed + /etc/adjtime + /etc/httpd/logs + + + /etc/ssl/private.key + + + + /var/ossec/etc/shared/rootkit_files.txt + /var/ossec/etc/shared/rootkit_trojans.txt + /var/ossec/etc/shared/system_audit_rcl.txt + /var/ossec/etc/shared/cis_debian_linux_rcl.txt + /var/ossec/etc/shared/cis_rhel_linux_rcl.txt + /var/ossec/etc/shared/cis_rhel5_linux_rcl.txt + + + + 1 + 7 + + + + syslog + any + + + + secure + + + + host-deny + host-deny.sh + srcip + yes + + + + firewall-drop + firewall-drop.sh + srcip + yes + + + + disable-account + disable-account.sh + user + yes + + + + + + + host-deny + local + 7 + 600 + + + + + firewall-drop + local + 7 + 600 + + + + + + syslog + /var/log/messages + + + + syslog + /var/log/authlog + + + + syslog + /var/log/auth.log + + + + syslog + /var/log/secure + + + + syslog + /var/log/xferlog + + + + syslog + /var/log/maillog + + + + apache + /var/www/logs/access_log + + + + apache + /var/www/logs/error_log + + + + syslog + /var/log/exim_mainlog + + +