檔案防篡改系統ossec搭建

 OSSEC簡要介紹： 

OSSEC 是一款開源的入侵檢測系統，包括了日志分析，全面檢測，rook-kit檢測。作為一款HIDS，OSSEC應該被安裝在一台實施監控的系統中。另外有時候不需要安裝完全版本的OSSEC，如果有多台電腦都安裝了OSSEC，那麼就可以采用用戶端/伺服器模式來運作。客戶機通過用戶端程式将資料發回到伺服器端進行分析。在一台電腦上對多個系統進行監控對于企業或者家庭使用者來說都是相當經濟實用的。

<a href="http://blog.51cto.com/attachment/201210/181927931.png" target="_blank"></a>

環境： 

centos5.5 x86_64 

ossec-hids-2.7-beta1

10.10.10.240 ossec server 

10.10.10.141 ossec client1

下載下傳軟體包

<b>一、ossec server安裝</b>

配置源碼,使能夠相容mysql

[root@logserver src]# tar -xf ossec-hids-2.7-beta-1.tar.gz

[root@logserver src]# cd ossec-hids-2.7-beta1/

[root@logserver ossec-hids-2.7-beta1]# cd src

[root@logserver src]# make setdb

Info: Compiled with MySQL support

[root@logserver ossec-hids-2.7-beta1]# ./install.sh 

[root@logserver ossec-hids-2.7-beta1]# /var/ossec/bin/ossec-control enable database

[root@logserver ossec-hids-2.7-beta1]# mysql -u root -p

mysql&gt;  create database ossec;

Query OK, 1 row affected (0.04 sec)

mysql&gt; grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on ossec.* to ossecuser@ identified by 'ossecpass';

Query OK, 0 rows affected (0.10 sec)

mysql&gt; flush privileges;

Query OK, 0 rows affected (0.00 sec)

[root@logserver ossec-hids-2.7-beta1]# cd contrib/

[root@logserver contrib]# vim ossec2mysql.conf

# PARAMS USED BY  OSSEC2BASED

dbhost=localhost

database=ossecuser

debug=5

dbport=3306

dbpasswd=ossecpass

dbuser=ossec

daemonize=0

sensor=centralserver

hids_inter&gt;

導入資料

[root@logserver contrib]# mysql -u ossecuser -p &lt; /usr/local/src/ossec-hids-2.7-beta1/contrib/ossec2mysql.sql 

在末尾添加

 &lt;database_output&gt;

        &lt;hostname&gt;10.10.10.137&lt;/hostname&gt;

        &lt;username&gt;ossecuser&lt;/username&gt;

        &lt;password&gt;ossecpass&lt;/password&gt;

        &lt;database&gt;ossec&lt;/database&gt;

        &lt;type&gt;mysql&lt;/type&gt;

    &lt;/database_output&gt;

&lt;/ossec_config&gt;

2.啟動ossec

[root@logserver etc]# /var/ossec/bin/ossec-control restart

添加agent key

<b>二、ossec cilent安裝</b>

 tar xf ossec-hids-2.7-beta-1.tar.gz

 cd ossec-hids-2.7-beta1/

 ./install.sh

--&gt;cn

--&gt;client

/usr/local/ossec/bin/manage_agents  

<b>三、添加ossec client到ossec server</b>

<b>server:</b>

/usr/local/ossec/bin/manage_agents

A

name

IP

E

001

cpoy key

q

client

--&gt;i

--&gt;paste key

--&gt;y

 /usr/local/ossec/bin/ossec-control start

Starting OSSEC HIDS v2.7-beta1 (by Trend Micro Inc.)...

Started ossec-execd...

Started ossec-agentd...

Started ossec-logcollector...

Started ossec-syscheckd...

Completed.

You have new mail in /var/spool/mail/root

[root@redmine src]# netstat -antup|grep ossec

udp        0      0 10.10.10.141:35928          10.10.10.240:1514           ESTABLISHED 28558/ossec-agentd

<b>四、安裝管理界面</b>

[root@db src]# tar xf ossec-wui-0.3.tar.gz 

[root@db src]# cd ossec-wui-0.3

[root@db ossec-wui-0.3]# ls

CONTRIB  css  htaccess_def.txt  img  index.php  js  lib  LICENSE  ossec_conf.php  README  README.search  setup.sh  site

[root@db ossec-wui-0.3]# cp -Rf * /usr/local/ossec/

[root@db ossec-wui-0.3]# cd /usr/local/ossec/

運作配置腳本

[root@db ossec]# ./setup.sh

配置ossec權限

[root@db ossec]# chgrp apache tmp/

[root@db ossec]# chmod 770 -R tmp/

[root@db ossec]#cat /etc/group

apache:x:48:ossec

 [root@db ossec]# yum install -y php.x86_64   php-cli.x86_64  php-devel.x86_64 httpd

yum install -y httpd php

添加虛拟目錄

[root@db ~]# cat /etc/httpd/conf.d/vdoc.conf

Alias /ossec/ "/usr/local/ossec/"

&lt;Directory "/usr/local/ossec/"&gt;

    Options Indexes FollowSymLinks

    AllowOverride None

    Order allow,deny

 Allow from all

#  Order deny,allow

#  Deny from all

#  Allow from 127.0.0.1

   AuthName "OSSEC AUTH"

   AuthType Basic

   AuthUserFile /usr/local/ossec/.htpasswd

   Require valid-user

&lt;/Directory&gt; 

<a href="http://blog.51cto.com/attachment/201210/182226326.png" target="_blank"></a>

<a href="http://blog.51cto.com/attachment/201210/004449380.png" target="_blank"></a>

     本文轉自 珏石頭 51CTO部落格，原文連結：http://blog.51cto.com/gavinshaw/1020540，如需轉載請自行聯系原作者