Installing OSSEC on Centos 5.7

OSSEC is an open source host-based IDS that performs log analysis, and is able to correlate and analyse logs for a number of Linux (and Windows, but that is outside the scope of this blog post) servers. The software architecture of OSSEC and the use of agents, lends OSSEC to flexible deployment and management [1].

Set-up the Atomic repository that already has the appropriate OSSEC packages and install them would be the easiest way. However I have a strong dislike for the use of the /var partition (most system administrators, hmm... well at-least I have always, set this up as a separate partition for ease of management and security reasons) as an install location, esp. when it has been specified as a "noexec" partition.

Please Note: 
Firstly, there are a number of dependencies of some of the set-up below, such as Apache, PHP, MySQL, but the installation and secure configuration of these services are beyond the scope of this blog post. Secondly, the configuration below is only to set-up OSSEC as a monitor and not run it in IPS, i.e. as an active response alert handler.

Installation using the repository

1. wget https://www.atomicorp.com/installers/atomic -O atomic.sh
2. . ./atomic.sh
3. yum -y update
4. yum -y install ossec-hids ossec-hids-server ossec-wui

Installation using the tar ball source

1. Download, compile and install the source
1. wget http://www.ossec.net/files/ossec-hids-2.6.tar.gz
2. tar zxvf ossec-hids-2.6.tar.gz
3. cd ossec-hids-2.6/src
4. make clean
5. make setdb
6. make all
7. cd ..
8. ./install.sh
1. en
2. local
3. /opt/ossec
4. y
5. user@domain
6. mx.domain
7. y
8. y
9. n
2. Setup mysql DB for logging
1. Grant access to database
1. mysql -u root -p
2. grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on ossec.* to ossecuser@localhost;
3. set password for ossecuser@localhost=PASSWORD('PASSWD');
4. quit;
2. Create database and tables
1. mysqladmin -u root -p create ossec
2. mysql -u root -p ossec < src/os_dbd/mysql.schema
3. Edit the /opt/ossec/etc/ossec.conf file
1. Check the wiki to setup logging to the database and syslog [2]
3. Install the Web User Interface, you will need Apache and php
1. Again, the installation and secure configuration of Apache is beyond the scope of this blog post. 
2. wget http://www.ossec.net/files/ui/ossec-wui-0.3.tar.gz
3. tar zxvf ossec-wui-0.3.tar.gz
4. mkdir -p /var/www/html/ossec-wui
5. cp -rf ./ossec-wui-0.3/* /var/www/html/ossec-wui/
6. cd /var/www/html/ossec-wui/
7. ./setup.sh
8. Edit the ossec_conf.php to point to the ossec installation completed in the previous stage
1. $ossec_dir="/opt/ossec";
4. Start the OSSEC services
1. /opt/ossec/bin/ossec-control enable database
2. /opt/ossec/bin/ossec-control enable client-syslog
3. /opt/ossec/bin/ossec-control start

Possible Errors:

1. When executing OSSEC-WUI you may get a page that displays. "Unable to access OSSEC directory". Ensure that the user that your Apache web server runs as, e.g. httpd or apache is added to the ossec group
1. usermod -a -G ossec apache.
2. "Unable to retrieve alerts". Ensure that you web server is able to open the alerts file. This issue is two fold, firstly ensure that the web server has permissions to open the file and secondly that the fopen command is enabled in PHP.
1. safe_mode Off
2. safe_mode_gid On
3. These two are no so much error, but warning that will be annoy your syslog server, but depend on your PHP configuration.
1. PHP Warning:  shell_exec() has been disabled for security reasons - This is because of a uname -a query in the /var/www/html/ossec-wui/lib/os_lib_agent.php script;
1. //$agent_list[$agent_count]{'os'} = `uname -a`;
2. $agent_list[$agent_count]{'os'} = "Linux";
2. PHP Warning:  fseek() expects parameter 3 to be long - This may be a simple programming error in the /var/www/html/ossec-wui/lib/os_lib_alerts.php
1. //fseek($fp, $seek_place, "SEEK_SET");
2. fseek($fp, $seek_place );

References:

1. http://en.wikipedia.org/wiki/OSSEC
2. http://www.ossec.net/wiki

Snort sniff honk !

Snort is an open source intrusion detection system (IDS). Its highly configurable and can be run in a number of modes and architectures, There are a small number of freely available rules to use. For more information refer to the Snort home page http://www.snort.org/. Here are some instructions on getting it setup on CentOS, these were adapted from the Snort Documentation by Patrick Harper at http://assets.sourcefire.com/snort/setupguides/Snort_Base_Minimal.pdf;

1. yum install mysql mysql-bench mysql-server mysql-devel mysqlclient10 php-mysql httpd gcc pcre-devel php-gd gd mod_ssl glib2-devel gcc-c++ php php-pear libpcap-devel
2. vi /etc/httpd/conf/httpd.conf #Edit the httpd.conf file to suit
3. /etc/rc.d/init.d/httpd start
4. /etc/rc.d/init.d/mysqld restart
5. /usr/bin/mysql_secure_installation
6. cd /root
7. mkdir snortinstall
8. cd snortinstall
9. wget http://dl.snort.org/snort-current/snort-2.8.5.3.tar.gz
10. tar zxvf snort-2.8.5.3.tar.gz
11. cd snort-2.8.5.3
12. ./configure --with-mysql --enable-dynamicplugin # Fingers crossed it all goes well
13. make
14. make install
15. /usr/sbin/groupadd snort
16. /usr/sbin/useradd -g snort snort -s /sbin/nologin
17. mkdir -p /etc/snort/rules
18. mkdir -p /var/log/snort
19. cd /root/snortinstall/snort-2.8.5.3/etc
20. cp ./* /etc/snort/
21. cd /root/snortinstall
22. wget http://www.emergingthreats.net/rules/emerging.rules.tar.gz
23. tar zxvf emerging.rules.tar.gz
24. cd rules
25. cp ./* /etc/snort/rules/
26. vi /etc/snort/snort.conf # Edit the snort.conf file to suit
27. /etc/rc.d/init.d/mysqld start
28. mysql -u root -p mysql # Create the snort database and snort database user and set permissions
    
29. cd  /root/snortinstall/snort-2.8.5.3/schemas
30. mysql -u snort -p snort < create_mysql
31. pear install -a Image_Graph-alpha Image_Canvas-alpha Image_Color Numbers_Roman
32. cd /root/snortinstall/
33. wget http://downloads.sourceforge.net/project/adodb/adodb-php5-only/adodb-510-for-php5/adodb510.tgz?use_mirror=transact
34. wget http://downloads.sourceforge.net/project/secureideas/BASE/base-1.4.4/base-1.4.4.tar.gz?use_mirror=transact
35. cd /var/www
36. tar zxvf /root/snortinstall/adodb510.tgz
37. mv adodb5/ adbodb
38. cd /var/www/html/
39. tar zxvf /root/snortinstall/base-1.4.4.tar.gz
40. mv base-1.4.4/ base
41. cd base
42. cp base_conf.php.dist base_conf.php
43. vi base_conf.php # Edit the file to suit
44. # Load http://SERVERNAME/base in a browser and click on the setup link
45. # Click on Create BASE AG button
46. # Click on the Main Page link

SQL

1. create database snort;
2. create user 'snort'@'localhost' identified by '';
3. grant create, insert, select, delete, update on snort.* to snort@localhost;
4. grant create, insert, select, delete, update on snort.* to snort;