# Install OSSEC XDR:
Version en cours 3.7 (voir le repo github en fin du README):
# Pour Linux: apt-get upgrade -y
# Install du repository wget -q -O - https://updates.atomicorp.com/installers/atomic | sudo bash
# Update sudo apt-get update
# Server sudo apt-get install ossec-hids-server
# Agent sudo apt-get install ossec-hids-agent
addgroup user ossec
changer user par votre utilisateur.
nano /var/ossec/etc/ossec.conf ``` yes root@localhost 127.0.0.1 ossecm@localhost ``` ``` 79200 yes ``` ``` /etc,/usr/bin,/usr/sbin /bin,/sbin /etc,/usr/bin,/usr/sbin /var/www,/bin,/sbin ``` nano /var/ossec/rules/local_rules.xml ``` ossec syscheck_new_entry File added to the system. syscheck, ``` # Generation des clefs: openssl genrsa -out /var/ossec/etc/client.keys 2048
openssl req -new -x509 -key /var/ossec/etc/client.keys -out /var/ossec/etc/client.cert -days 365 /var/ossec/bin/ossec-control restart chmod 775 -R /var/ossec
chown -R ossec:ossec /var/ossec ``` sudo touch /var/log/messages sudo touch /var/log/authlog sudo touch /var/log/authlog sudo touch /var/log/secure sudo touch /var/log/authlog sudo touch /var/log/xferlog sudo mkdir /var/www/logs/ sudo touch /var/www/logs/access_log sudo touch /var/www/logs/error_log ``` Si error queue:
sudo apt-get install ossec-hids-server # Install OSSEC Web UI Version 1.0 pas 0.8 /!\ La version 0.8 wget https://github.com/ossec/ossec-wui/archive/master.zip # Ma contribution Ossec Web Gui pour Php 8.1 ou + unzip ossec_1.0.zip mv ossec /var/www attention à votre chemin apache web (/var/www/html) chown -R www-data:www-data /var/www/ossec chmod -R 775 /var/www/ossec cd /var/www/ossec ./setup.sh Username: admin New password: Re-type new password: Adding password for user admin Enter your web server user name (e.g. apache, www, nobody, www-data, ...) www-data You must restart your web server after this setup is done. Setup completed successfully. systemctl restart apache2 verifier les process: ``` ossecm 2389 0.0 0.0 3740 416 ? S 11:37 0:00 /var/ossec/bin/ossec-maild
root 2393 0.0 0.0 2988 328 ? S 11:37 0:00 /var/ossec/bin/ossec-execd
ossec 2397 0.3 0.1 8280 6844 ? S 11:37 0:00 /var/ossec/bin/ossec-analysisd
root 2401 0.0 0.0 7124 456 ? S 11:37 0:00 /var/ossec/bin/ossec-logcollector
root 2411 0.0 0.0 3908 404 ? S 11:37 0:00 /var/ossec/bin/ossec-syscheckd
ossec 2415 0.0 0.0 3884 1472 ? S 11:37 0:00 /var/ossec/bin/ossec-monitord
``` check mail
apt install mutt
sudo mutt # Pour Windows Agent: Voir ossec-agent-win32-3.2.0-6132.exe Le fichier ossec-hids-3.2.0.tar.gz est les sources en version 3.2 voir le GitHub de OSSEC: https://github.com/ossec/ossec-hids