Ossec 安装并配置邮件通知

2023-08-27 18:53:10

Ossec 安装并配置邮件通知

Ossec 安装并配置邮件通知

1. 介绍

　　OSSEC 是一个完全开源的免费的服务器入侵检测工具，它支持多个平台，包括Linux, Solaris, AIX, HP-UX, BSD, Windows, Mac and VMware ESX；提供预留的入侵规则并提供相关的定制选项，也支持自定义安全规则，规则触发后的行动支持邮件通知，数据库写入，系统日志写入，2.9.0版本及之后的支持将告警信息写入到一个JSON格式的文件。更进一步的了解，请查阅官网：OSSEC.

2. 软硬件环境

　　OSSEC是基于C/S架构的，分为Server和Agent两部分，这里的部署使用三台虚拟机，一台虚拟机运行Server，另外两台台虚拟机只运行Agent。详细的环境信息如下：

项	虚拟机1（Server）	虚拟机2（Agent）	虚拟机3（Agent）
硬件信息	CPU:8核 RAM:16G 硬盘:100G	CPU:4核 RAM:4G 硬盘:100G	CPU:2核 RAM:2G 硬盘:100G
IP地址	172.16.11.141	172.16.11.197	172.16.11.198
操作系统	Centos7	Centos7	Centos7
主机名	master	ansible1	ansible2
软件版本	Ossec2.8.1 MySQL8.0	Ossec2.8.1	Ossec2.8.1

3. 安装步骤

3.1 Server

Ossec安装

　　在虚拟机1（Server）的主机上操作：

wget https://github.com/ossec/ossec-hids/archive/2.8.1.tar.gz	#下载ossec的2.8.1版本，目前最新的版本为3.6.0，笔者尝试过安装这个版本，

#发现agent无法连接上server端，github也有相关的issue，详见：https://github.com/ossec/ossec-hids/issues/1869

tar -zxvf 2.8.1.tar.gz				        #解压

mv ossec-hids-2.8.1/ ossec-hids		                #重命名文件夹

cd ossec-hids/						#进入文件夹

export OSSEC_SOURCE=$(pwd)                              #设置目录变量

yum -y install mysql-devel postgresql-devel zlib-devel pcre2-devel make gcc zlib-devel pcre2-devel sqlite-devel openssl-devel libevent-devel  #下载所需编译工具包

ln -s /usr/lib64/mysql/libmysqlclient.so.18 /usr/lib/libmysqlclient.so.18            #创建软链接链接MySQL库

ln -s /usr/lib64/mysql/libmysqlclient.so.18 /usr/lib64/libmysqlclient.so.18          #创建软链接链接MySQL库

cd src

make setdb		                                #开启数据库支持，该指令有以下输出：

#Info: Compiled with MySQL support.

#Info: Compiled with PostgreSQL support.

#如果是3.6.0版本，这个指令不存在，详见:https://github.com/ossec/ossec-hids/issues/1905

cd ../install.sh			                #执行编辑安装脚本进行安装

　　具体的安装脚本交互如下：

  ** Para instalação em português, escolha [br].

  ** 要使用中文进行安装, 请选择 [cn].

  ** Fur eine deutsche Installation wohlen Sie [de].

  ** Για εγκατάσταση στα Ελληνικά, επιλέξτε [el].

  ** For installation in English, choose [en].

  ** Para instalar en Español , eliga [es].

  ** Pour une installation en français, choisissez [fr]

  ** A Magyar nyelvű telepítéshez válassza [hu].

  ** Per l'installazione in Italiano, scegli [it].

  ** 日本語でインストールします．選択して下さい．[jp].

  ** Voor installatie in het Nederlands, kies [nl].

  ** Aby instalować w języku Polskim, wybierz [pl].

  ** Для инструкций по установке на русском ,введите [ru].

  ** Za instalaciju na srpskom, izaberi [sr].

  ** Türkçe kurulum için seçin [tr].

  (en/br/cn/de/el/es/fr/hu/it/jp/nl/pl/ru/sr/tr) [en]: en		#选择语言

 OSSEC HIDS v2.8 Installation Script - http://www.ossec.net

 You are about to start the installation process of the OSSEC HIDS.

 You must have a C compiler pre-installed in your system.

 If you have any questions or comments, please send an e-mail

 to dcid@ossec.net (or daniel.cid@gmail.com).

  - System: Linux master 3.10.0-1127.18.2.el7.x86_64

  - User: root

  - Host: master

  -- Press ENTER to continue or Ctrl-C to abort. --

1- What kind of installation do you want (server, agent, local, hybrid or help)? server	#安装server端

  - Server installation chosen.

2- Setting up the installation environment.

 - Choose where to install the OSSEC HIDS [/var/ossec]:

    - Installation will be made at  /var/ossec .

3- Configuring the OSSEC HIDS.

  3.1- Do you want e-mail notification? (y/n) [y]: y	        #开启邮件通知

   - What's your e-mail address? 1769128867@qq.com		#收件人邮箱

   - What's your SMTP server ip/host? 127.0.0.1			#SMTP邮箱服务器的地址

  3.2- Do you want to run the integrity check daemon? (y/n) [y]: y	#开启完整性检查守护进程

   - Running syscheck (integrity check daemon).

  3.3- Do you want to run the rootkit detection engine? (y/n) [y]: y	#开启rootkit检查引擎功能

   - Running rootcheck (rootkit detection).

  3.4- Active response allows you to execute a specific

       command based on the events received. For example,

       you can block an IP address or disable access for

       a specific user.

       More information at:

       http://www.ossec.net/en/manual.html#active-response

   - Do you want to enable active response? (y/n) [y]: y		#开启存活响应

     - Active response enabled.

   - By default, we can enable the host-deny and the

     firewall-drop responses. The first one will add

     a host to the /etc/hosts.deny and the second one

     will block the host on iptables (if linux) or on

     ipfilter (if Solaris, FreeBSD or NetBSD).

   - They can be used to stop SSHD brute force scans,

     portscans and some other forms of attacks. You can

     also add them to block on snort events, for example.

   - Do you want to enable the firewall-drop response? (y/n) [y]: n	#关闭防火墙响应功能

     - firewall-drop disabled.

   - Default white list for the active response:

      - 119.29.29.29

   - Do you want to add more IPs to the white list? (y/n)? [n]: n	#无需添加白名单

  3.5- Do you want to enable remote syslog (port 514 udp)? (y/n) [y]: y	#开启远程的syslog

   - Remote syslog enabled.

  3.6- Setting the configuration to analyze the following logs:

    -- /var/log/messages

    -- /var/log/secure

    -- /var/log/maillog

    -- /var/log/httpd/error_log (apache log)

    -- /var/log/httpd/access_log (apache log)

 - If you want to monitor any other file, just change

   the ossec.conf and add a new localfile entry.

   Any questions about the configuration can be answered

   by visiting us online at http://www.ossec.net .

   --- Press ENTER to continue ---

5- Installing the system

 - Running the Makefile

INFO: Little endian set.

.......省略编译输出........

- System is Redhat Linux.

 - Init script modified to start OSSEC HIDS during boot.

 - Configuration finished properly.

 - To start OSSEC HIDS:

                /var/ossec/bin/ossec-control start

 - To stop OSSEC HIDS:

                /var/ossec/bin/ossec-control stop

 - The configuration can be viewed or modified at /var/ossec/etc/ossec.conf

    Thanks for using the OSSEC HIDS.

    If you have any question, suggestion or if you find any bug,

    contact us at contact@ossec.net or using our public maillist at

    ossec-list@ossec.net

    ( http://www.ossec.net/main/support/ ).

    More information can be found at http://www.ossec.net

    ---  Press ENTER to finish (maybe more information below). ---

    - In order to connect agent and server, you need to add each agent to the server.

   Run the 'manage_agents' to add or remove them:

   /var/ossec/bin/manage_agents

   More information at:

   http://www.ossec.net/en/manual.html#ma

　　至此，服务器端已经安装成功，可以先添加agent端的信息，使用manage_agents添加agent：

/var/ossec/bin/manage_agents

　　具体的添加agent脚本交互如下：

****************************************

* OSSEC HIDS v2.8 Agent manager.     *

* The following options are available: *

****************************************

   (A)dd an agent (A).

   (E)xtract key for an agent (E).

   (L)ist already added agents (L).

   (R)emove an agent (R).

   (Q)uit.

Choose your action: A,E,L,R or Q: A			#选择添加一个agent操作

- Adding a new agent (use '\q' to return to the main menu).

  Please provide the following:

   * A name for the new agent: ansible1		        #agent的显示名称

   * The IP Address of the new agent: 172.16.11.197	#agent的IP

   * An ID for the new agent[001]: 001		        #agent的IP

Agent information:

   ID:001

   Name:ansible1

   IP Address:172.16.11.197

Confirm adding it?(y/n): y				#确定

Agent added.

****************************************

* OSSEC HIDS v2.8 Agent manager.     *

* The following options are available: *

****************************************

   (A)dd an agent (A).

   (E)xtract key for an agent (E).

   (L)ist already added agents (L).

   (R)emove an agent (R).

   (Q)uit.

Choose your action: A,E,L,R or Q: E		        #选择提取agent key操作

Available agents:

   ID: 001, Name: ansible1, IP: 172.16.11.197

Provide the ID of the agent to extract the key (or '\q' to quit): 001

Agent key information for '001' is:

MDAxIGFuc2libGUxIDE3Mi4xNi4xMS4xOTcgNDAxNTZlNTk0Y2JjYWZhMWZmNWQ2OWMwZjYxMjUyMmRmMWMxODNjZGI5Zjg3Y2NlMjVmODNkNWQ1ZjdlNDM5YQ==

** Press ENTER to return to the main menu.

.........再重复操作添加agent2并记下agent key后面配置agent时需要使用。.........

MySQL数据库配置

　　MySQL数据库的安装这里就不在列出，可以参考我上次安装zabbix服务时的安装进行操作，链接：MySQL安装。MySQL数据安装完成后，需要新建数据库和导入Ossec软件使用的数据库表结构。

mysql -u root -p

#输入root用户的密码

mysql> create database ossec character set utf8 collate utf8_bin;	#创建数据库

mysql> create user ossec identified by 'QCgOvUJ7&Cs*dG4m';		#创建数据库连接用户

mysql> grant all privileges on ossec.* to ossec;

mysql> flush privileges;

　　数据库用户新建成功后，再导入数据库的表结构，MySQL数据库的表结构文件在源码包下的src/os_dbd/mysql.schema，使用mysql工具进行导入：

mysql -uossec -pQCgOvUJ7&Cs*dG4m ossec < $OSSEC_SOURCE/src/os_dbd/mysql.schema      #导入MySQL数据库表结构

　　数据库导入完成后，还需要配置ossec的配置文件，指定连接的数据库服务器和用户等信息，编辑/var/ossec/etc/ossec.conf文件，添加内容如下：

<database_output>

      <hostname>127.0.0.1</hostname>		<!-- MySQL服务器IP -->

      <username>ossec</username>		<!-- MySQL用户账号 -->

      <password>QCgOvUJ7&Cs*dG4m</password>	<!-- MySQL用户密码 -->

      <database>ossec</database>		<!-- 数据库模式名称 -->

      <type>mysql</type>		        <!-- 数据库类型为MySQL -->

</database_output>

　　注意：<database_output>标签是放在<ossec_config>标签里面，参见官方文档：Configuring MySQL。保存文件后，还需要启动数据库支持：

/var/ossec/bin/ossec-control enable database

启动ossec

/var/ossec/bin/ossec-control start

　　启动后，通过查看/var/ossec/logs/ossec.log日志，可以看到已经连接上了数据库，如下所示：

添加agent方法

　　添加agent需要填写agent的IP、ID和主机名。执行如下脚本进行导入：

/var/ossec/bin/manage_agents

　　具体的脚本交互如下：

****************************************

* OSSEC HIDS v2.8 Agent manager.     *

* The following options are available: *

****************************************

   (A)dd an agent (A).

   (E)xtract key for an agent (E).

   (L)ist already added agents (L).

   (R)emove an agent (R).

   (Q)uit.

Choose your action: A,E,L,R or Q: A		      #进行添加agent操作

- Adding a new agent (use '\q' to return to the main menu).

  Please provide the following:

   * A name for the new agent: ansible1		      #主机名

   * The IP Address of the new agent: 172.16.11.197   #IP地址

   * An ID for the new agent[001]: 001		      #ID号

Agent information:

   ID:001

   Name:ansible01

   IP Address:172.16.11.197

Confirm adding it?(y/n): y

Agent added.

****************************************

* OSSEC HIDS v2.8 Agent manager.     *

* The following options are available: *

****************************************

   (A)dd an agent (A).

   (E)xtract key for an agent (E).

   (L)ist already added agents (L).

   (R)emove an agent (R).

   (Q)uit.

Choose your action: A,E,L,R or Q: E

Available agents:

   ID: 001, Name: ansible1, IP: 172.16.11.197

Provide the ID of the agent to extract the key (or '\q' to quit): 001

Agent key information for '001' is:

MDAxIGFuc2libGUxIDE3Mi4xNi4xMS4xOTcgNDAxNTZlNTk0Y2JjYWZhMWZmNWQ2OWMwZjYxMjUyMmRmMWMxODNjZGI5Zjg3Y2NlMjVmODNkNWQ1ZjdlNDM5YQ==

** Press ENTER to return to the main menu.

****************************************

* OSSEC HIDS v2.8 Agent manager.     *

* The following options are available: *

****************************************

   (A)dd an agent (A).

   (E)xtract key for an agent (E).

   (L)ist already added agents (L).

   (R)emove an agent (R).

   (Q)uit.

Choose your action: A,E,L,R or Q: Q

** You must restart OSSEC for your changes to take effect.

manage_agents: Exiting ..

　　添加agent完成后，记得要重启ossec服务。注意，这里的添加了agent操作并不是已经可以使用ossec服务了，还需要后面的agent通过导入agent key后并启动agent进程才会真正完成。

/var/ossec/bin/ossec-control restart

3.2 Agent

　　在虚拟机2（Agent）和虚拟机3（Agent）上执行以下同样的操作：

wget https://github.com/ossec/ossec-hids/archive/2.8.1.tar.gz	#下载ossec的2.8.1版本，目前最新的版本为3.6.0，笔者尝试过安装，发现agent无法连接上server端，

#github也有相关的issue，详见：https://github.com/ossec/ossec-hids/issues/1869

tar -zxvf 2.8.1.tar.gz				#解压

mv ossec-hids-2.8.1/ ossec-hids		        #重命名文件夹

cd ossec-hids/					#进入文件夹

yum -y install mysql-devel postgresql-devel zlib-devel pcre2-devel make gcc zlib-devel pcre2-devel sqlite-devel openssl-devel libevent-devel	#下载所需编译工具包

./install.sh			                #执行编辑安装脚本进行安装

　　具体的安装脚本交互如下：

  ** Para instalação em português, escolha [br].

  ** 要使用中文进行安装, 请选择 [cn].

  ** Fur eine deutsche Installation wohlen Sie [de].

  ** Για εγκατάσταση στα Ελληνικά, επιλέξτε [el].

  ** For installation in English, choose [en].

  ** Para instalar en Español , eliga [es].

  ** Pour une installation en français, choisissez [fr]

  ** A Magyar nyelvű telepítéshez válassza [hu].

  ** Per l'installazione in Italiano, scegli [it].

  ** 日本語でインストールします．選択して下さい．[jp].

  ** Voor installatie in het Nederlands, kies [nl].

  ** Aby instalować w języku Polskim, wybierz [pl].

  ** Для инструкций по установке на русском ,введите [ru].

  ** Za instalaciju na srpskom, izaberi [sr].

  ** Türkçe kurulum için seçin [tr].

  (en/br/cn/de/el/es/fr/hu/it/jp/nl/pl/ru/sr/tr) [en]: en	#选择语言

 OSSEC HIDS v2.8 Installation Script - http://www.ossec.net

 You are about to start the installation process of the OSSEC HIDS.

 You must have a C compiler pre-installed in your system.

 If you have any questions or comments, please send an e-mail

 to dcid@ossec.net (or daniel.cid@gmail.com).

  - System: Linux ansible1 3.10.0-1127.18.2.el7.x86_64

  - User: root

  - Host: ansible1

  -- Press ENTER to continue or Ctrl-C to abort. --

1- What kind of installation do you want (server, agent, local, hybrid or help)? agent #安装agent端

  - Agent(client) installation chosen.

2- Setting up the installation environment.

 - Choose where to install the OSSEC HIDS [/var/ossec]:

    - Installation will be made at  /var/ossec .

3- Configuring the OSSEC HIDS.

  3.1- What's the IP Address or hostname of the OSSEC HIDS server?: 172.16.11.141      #填写服务端的IP或者域名

   - Adding Server IP 172.16.11.141

  3.2- Do you want to run the integrity check daemon? (y/n) [y]: y		       #开启完整性检查守护进程

   - Running syscheck (integrity check daemon).

  3.3- Do you want to run the rootkit detection engine? (y/n) [y]: y	               #开启root检查功能

   - Running rootcheck (rootkit detection).

  3.4 - Do you want to enable active response? (y/n) [y]: y	      	               #开启存活响应

  3.5- Setting the configuration to analyze the following logs:

    -- /var/log/messages

    -- /var/log/secure

    -- /var/log/maillog

    -- /var/log/nginx/access.log (apache log)

    -- /var/log/nginx/error.log (apache log)

 - If you want to monitor any other file, just change

   the ossec.conf and add a new localfile entry.

   Any questions about the configuration can be answered

   by visiting us online at http://www.ossec.net .

   --- Press ENTER to continue ---

5- Installing the system

 - Running the Makefile

INFO: Little endian set.

························

······省略编译输出········

························

 - System is Redhat Linux.

 - Init script modified to start OSSEC HIDS during boot.

 - Configuration finished properly.

 - To start OSSEC HIDS:

                /var/ossec/bin/ossec-control start

 - To stop OSSEC HIDS:

                /var/ossec/bin/ossec-control stop

 - The configuration can be viewed or modified at /var/ossec/etc/ossec.conf

    Thanks for using the OSSEC HIDS.

    If you have any question, suggestion or if you find any bug,

    contact us at contact@ossec.net or using our public maillist at

    ossec-list@ossec.net

    ( http://www.ossec.net/main/support/ ).

    More information can be found at http://www.ossec.net

    ---  Press ENTER to finish (maybe more information below). ---

 - You first need to add this agent to the server so they

   can communicate with each other. When you have done so,

   you can run the 'manage_agents' tool to import the

   authentication key from the server.

   /var/ossec/bin/manage_agents

   More information at:

   http://www.ossec.net/en/manual.html#ma

　　现在可以看到Agent端已经安装完成了，安装脚本会默认安装在/var/ossec目录下。Agent端的配置首先需要在Server端添加此Agent主机，添加Agent和提取密钥请回看Server部分。添加完成后，提取并拷贝此客户端的验证密钥到agent端，然后运行进行导入：

/var/ossec/bin/manage_agents

　　脚本交互：

****************************************

* OSSEC HIDS v2.8 Agent manager.     *

* The following options are available: *

****************************************

   (I)mport key from the server (I).

   (Q)uit.

Choose your action: I or Q: I	            #选择”导入一个从Server端导出的key“操作

* Provide the Key generated by the server.

* The best approach is to cut and paste it.

*** OBS: Do not include spaces or new lines.

Paste it here (or '\q' to quit): MDAxIGFuc2libGUxIDE3Mi4xNi4xMS4xOTcgNDAxNTZlNTk0Y2JjYWZhMWZmNWQ2OWMwZjYxMjUyMmRmMWMxODNjZGI5Zjg3Y2NlMjVmODNkNWQ1ZjdlNDM5YQ==	#粘贴key

Agent information:

   ID:001

   Name:ansible1

   IP Address:172.16.11.197

Confirm adding it?(y/n): y		   #确定添加

Added.

** Press ENTER to return to the main menu.

　　至此，导入完成，可以启动Agent端了：

/var/ossec/bin/ossec-control start

　　最后，在Server端检查一下agent端是否运行正常。在Server端执行/var/ossec/bin/agent_control -l查看添加了的Agent:

[root@master ossec]# /var/ossec/bin/agent_control -l

OSSEC HIDS agent_control. List of available agents:

   ID: 000, Name: master (server), IP: 127.0.0.1, Active/Local

   ID: 002, Name: ansible2, IP: 172.16.11.198, Active

   ID: 001, Name: ansible1, IP: 172.16.11.197, Active

List of agentless devices:

3.3 配置邮件通知

　　配置邮件通知需要在Server端下进行操作。我这里以网易的163邮箱作为发件人，腾讯的QQ邮箱作为收件人，进行Ossec的邮件通知配置操作。

安装所需的软件包

yum install -y postfix mailx cyrus-sasl cyrus-sasl-plain	#安装postfix邮件相关的软件包

配置Postfix的配置文件/etc/postfix/main.cf

cat >> /etc/postfix/main.cf << EOF

relayhost = [smtp.163.com]:25

smtp_sasl_auth_enable = yes

smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd

smtp_sasl_security_options = noanonymous

smtp_tls_CAfile = /etc/ssl/certs/ca-bundle.crt

smtp_use_tls = yes

EOF

配置发送邮箱的账号和密码

echo "[smtp.163.com]:25 superlollipop@163.com:QFIANRBFCXMHEOVA" > /etc/postfix/sasl_passwd

#格式[smtp服务地址]:端口 USERNAME@gmail.com:PASSWORD

postmap /etc/postfix/sasl_passwd      #更新Postfix查询表使配置生效

　　PASSWORD是邮箱提供商提供的第三方客户端授权码，不是登录密码，请搜索相关邮箱提供商的资料获取。postmap执行如果提示缺少 libmysqlclient.so.18,需要安装MySQL的库，执行：yum install mariadb-libs安装依赖库。常见的邮箱服务器和端口，可参考文章：常用的邮箱服务器（SMTP、POP3）地址、端口

更改存储文件和DB文件权限和用户组

chown root:root /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

chmod 0600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

启动Postfix服务

systemctl start postfix

测试配置文件是否有效

echo "Test mail from postfix" | mail -s "Test Postfix" -r "superlollipop@163.com" 1769128867@qq.com

#-s subject:邮件主题；-r from-addr 发送方邮箱地址；1769128867@qq.com为收件人邮箱地址

　　如下图所示的测试邮件截图：

配置/var/ossec/etc/ossec.conf文件，如下所示：

<global>

    <email_notification>yes</email_notification>

    <email_to>1769128867@qq.com</email_to>

    <smtp_server>127.0.0.1</smtp_server>

    <email_from>superlollipop@163.com</email_from>

</global>

　　注意：<global>标签是放在<ossec_config>标签里面，参见官方文档：Alerts to a single E-Mail Address。

重启Ossec服务

/var/ossec/bin/ossec-control restart

　　至此，Ossec的邮件通知已经完成，可以通过修改目录/var/ossec/rules下的xml配置文件修改相关规则。这些规则很多都没有配置邮件通知，比如添加修改了用户密码发送邮件通知，则可以修改文件/var/ossec/rules/pam_rules.xml，如下所示：

<rule id="5555" level="3">			      <!-- 此规则默认就存在了的 -->

    <options>alert_by_email</options>	              <!-- 添加alert_by_email就会发送邮件通知 -->

    <match>: password changed for</match>

    <description>User changed password.</description>

</rule>

　　保存文件，然后执行/var/ossec/bin/ossec-control restart重启Ossec服务使配置更改生效。然后测试修改了Server端的root用户的密码后，接收到邮件通知，如下图所示：