2019独角兽企业重金招聘Python工程师标准>>> 
1.ossec服务端安装
解压>>>
#tar -zxvf ossec_server.tar.gz
#cd ossec
安装>>>
#./install.sh
agent.conf初始化>>>
#touch /var/ossec/etc/shared/agent.conf
服务启动>>>
#/var/ossec/bin/ossec-control start
安装授权>>>
# openssl genrsa -out /var/ossec/etc/sslmanager.key
# openssl req -new -x509 -key /var/ossec/etc/sslmanager.key -out /var/ossec/etc/sslmanager.cert -days 365
授权监听启动>>>
# /var/ossec/bin/ossec-authd &
ps:
1.警告邮件地址在安装过程中录入
2.(开启联动)，一般不开启。
2.ossec客户端(agent)安装
# /var/ossec/bin/manage_agents
将服务端注册的添加agent对应的key拷贝过来
# /etc/init.d/ossec restart
服务端检查，是否添加成功
所有已经建立连接的列表
# /var/ossec/bin/agent_control -lc
所有管理的agent节点，及各个节点当前的状态
# /var/ossec/bin/agent_control -l
【或利用salt做客户端salt安装】
#salt '192.168.192.101' state.sls ossec
客户端启动
#/var/ossec/bin/ossec-control start
服务端重启
#/var/ossec/bin/ossec-control restart
salt的server端init.sls内容
include:
- mk_Downloads
install_ossec_packages:
pkg.latest:
- pkgs:
- openssl-devel
- gcc
- prelink
install_ossec:
archive.extracted:
- name: /root/Downloads/ossec
- source: salt://ossec/ossec.tar.gz
- archive_format: tar
- if_missing: /root/Downloads/ossec
cmd.run:
- name: cd ossec && sh install.sh
- cwd: /root/Downloads
- unless: test -e /var/ossec/bin/ossec-control
add_ossec_config:
file.recurse:
- name: /var/ossec/
- source: salt://ossec/conf/
- user: ossec
- group: ossec
- dir_mode: 744
- template: jinja
agentauth:
cmd.run:
- name: /var/ossec/bin/agent-auth -m ${ossec_server_ip} -p 1515 -A $(ifconfig | egrep -o '10\.(59|211|200|223).[0-9]{1,3}.[0-9]{1,3}' | head -n 1)
- unless: test -s /var/ossec/etc/client.keys
serverstart:
cmd.run:
- name: /var/ossec/bin/ossec-control restart
- onchanges:
- file: add_ossec_config
同时需要增加
/root/Downloads/ossec/preloaded-vars.conf文件，内容如下：
USER_LANGUAGE="cn" # For english
USER_NO_STOP="y"
USER_INSTALL_TYPE="agent"
USER_DIR="/var/ossec"
USER_ENABLE_ACTIVE_RESPONSE="y"
USER_ENABLE_SYSCHECK="y"
USER_ENABLE_ROOTCHECK="y"
USER_AGENT_SERVER_IP="*.*.*.248"3.一些命令
#查看当前连接的agents(agent存活查看)
#/var/ossec/bin/agent_control -lc（服务端执行）
启动成功后，服务端会开启1514/udp端口，用来与agent端进行交互。
通过：# netstat -anp|grep 1514
查看服务端服务是否正常启动
#查看所有agents的连接状态
#/var/ossec/bin/agent_control -l（服务端执行）
#将agent192.168.192.144注册到服务端192.168.192.239（agent端执行）
#/var/ossec/bin/agent-auth -m 192.168.192.239 -p 1515 -A 192.168.192.144
【服务端常用命令】
#查看存活节点
# /var/ossec/bin/agent_control -lc
#查看运行状态
# /var/ossec/bin/ossec-control status
#管理节点
# /var/ossec/bin/manage_agents
【windows操作系统安装agent】
step1:官网下载直接点击安装
此步中的Authentication key即为step3中的key.
step2:服务端添加节点:
step3:导出key节点key，下一步使用:
step4:检查agent节点是否已经连接
# /var/ossec/bin/agent_control -lc
如未连接则查看agent端ossec服务是否启动&邮件启动
【异常处理】
服务端：
[root@bbs217 rids]# /var/ossec/bin/agent_control -l
OSSEC HIDS agent_control. List of available agents:
ID: 000, Name: bbs217 (server), IP: 127.0.0.1, Active/Local
ID: 1024, Name: 192.168.192.101, IP: any, Active
agent端异常：
ERROR: Duplicated counter for '192.168.192.101'.
分别在angent及server执行如下命令，并重启ossec服务：
#rm -rf /var/ossec/queue/rids/*
【日志位置】
服务&agent端：/var/ossec/logs/ossec.log
【参考网站】
http://ossec.github.io/downloads.html
http://www.ossec.net/
【异常】
2019/05/05 16:40:03 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2019/05/05 16:40:03 rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2019/05/05 16:40:03 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' not accessible: 'Connection refused'.
2019/05/05 16:40:03 ossec-remoted(1211): ERROR: Unable to access queue: '/queue/ossec/queue'. Giving up..
2019/05/05 16:40:08 ossec-logcollector(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2019/05/05 16:40:08 ossec-logcollector(1211): ERROR: Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up..
2019/05/05 16:40:11 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2019/05/05 16:40:11 rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2019/05/05 16:40:24 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2019/05/05 16:40:24 rootcheck(1211): ERROR: Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up..
查看日志：发现是空间满了导致的。
异常：Duplicate Counter Error in OSSEC
On the server:
execute /var/ossec/bin/manage_agents
select “Remove and agent” (R)
select your agent (for example 006)
back in the main menu, select “Add an agent” (A)
give OSSEC the name and IP
back on the main menu, select “Extract key for an agent”
copy the key you’re given
quit and restart OSSEC
On the agent:
execute /var/ossec/bin/manage_agents
select “Import key from server” (I)
paste the key
quit and restart OSSEC