Install OSSEC XDR:

Version en cours 3.7 (voir le repo github en fin du README):

Pour Linux:

apt-get upgrade -y

Install du repository

wget -q -O - https://updates.atomicorp.com/installers/atomic | sudo bash

Update

sudo apt-get update

Server

sudo apt-get install ossec-hids-server

Agent

sudo apt-get install ossec-hids-agent

addgroup user ossec
changer user par votre utilisateur.

nano /var/ossec/etc/ossec.conf

<global>
    <email_notification>yes</email_notification>
    <email_to>root@localhost</email_to>
    <smtp_server>127.0.0.1</smtp_server>
    <email_from>ossecm@localhost</email_from>
</global>

<syscheck> 
    <!-- Frequency that syscheck is executed - default to every 22 hours --> 
    <frequency>79200</frequency> 
    <alert_new_files>yes</alert_new_files>

<!-- Directories to check (perform all possible verifications) --> 
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> 
<directories check_all="yes">/bin,/sbin</directories>

<directories report_changes="yes" realtime="yes" check_all="yes">/etc,/usr/bin,/usr/sbin</directories> 
<directories report_changes="yes" realtime="yes" check_all="yes">/var/www,/bin,/sbin</directories>

nano /var/ossec/rules/local_rules.xml

<rule id="554" level="7" overwrite="yes"> 
    <category>ossec</category> 
    <decoded_as>syscheck_new_entry</decoded_as> 
    <description>File added to the system.</description> 
    <group>syscheck,</group> 
</rule>

Generation des clefs:

openssl genrsa -out /var/ossec/etc/client.keys 2048
openssl req -new -x509 -key /var/ossec/etc/client.keys -out /var/ossec/etc/client.cert -days 365

/var/ossec/bin/ossec-control restart

chmod 775 -R /var/ossec
chown -R ossec:ossec /var/ossec

sudo touch /var/log/messages
sudo touch /var/log/authlog
sudo touch /var/log/authlog
sudo touch /var/log/secure
sudo touch /var/log/authlog
sudo touch /var/log/xferlog

sudo mkdir /var/www/logs/
sudo touch /var/www/logs/access_log
sudo touch /var/www/logs/error_log

Si error queue:
sudo apt-get install ossec-hids-server

Install OSSEC Web UI Version 1.0 pas 0.8 /!\

La version 0.8 wget https://github.com/ossec/ossec-wui/archive/master.zip

Ma contribution Ossec Web Gui pour Php 8.1 ou +

unzip ossec_1.0.zip mv ossec /var/www attention à votre chemin apache web (/var/www/html) chown -R www-data:www-data /var/www/ossec chmod -R 775 /var/www/ossec cd /var/www/ossec

./setup.sh

Username: admin New password: Re-type new password: Adding password for user admin Enter your web server user name (e.g. apache, www, nobody, www-data, ...) www-data You must restart your web server after this setup is done.

Setup completed successfully.

systemctl restart apache2

verifier les process:

ossecm      2389  0.0  0.0   3740   416 ?        S    11:37   0:00 /var/ossec/bin/ossec-maild<br>
root        2393  0.0  0.0   2988   328 ?        S    11:37   0:00 /var/ossec/bin/ossec-execd<br>
ossec       2397  0.3  0.1   8280  6844 ?        S    11:37   0:00 /var/ossec/bin/ossec-analysisd<br>
root        2401  0.0  0.0   7124   456 ?        S    11:37   0:00 /var/ossec/bin/ossec-logcollector<br>
root        2411  0.0  0.0   3908   404 ?        S    11:37   0:00 /var/ossec/bin/ossec-syscheckd<br>
ossec       2415  0.0  0.0   3884  1472 ?        S    11:37   0:00 /var/ossec/bin/ossec-monitord<br>

check mail

apt install mutt
sudo mutt

Pour Windows Agent:

Voir ossec-agent-win32-3.7.0-24343.exe

Le fichier ossec-hids-3.7.0.tar.gz est les sources en version 3.7

voir le GitHub de OSSEC: https://github.com/ossec/ossec-hids