## Introduction OSSEC is an open-source, host-based intrusion detection system (HIDS) that performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, time-based alerting, and active response. It's a must-have security application on any server. OSSEC can be installed to monitor just the server it's installed on (a local installation), or be installed as a server to monitor one or more agents. In this tutorial, you'll learn how to install OSSEC to monitor CentOS 7 as a local installation. ## Prerequisites * A CentOS 7 server preferably setup with SSH keys and customized using [Initial Setup of a CentOS 7 Server](https://docs.vultr.com/initial-setup-of-a-centos-7-server). Log into the server using the standard user account. Assume that username is **joe**. ssh -l joe server-ip-address ## Step 1: Install Required Packages OSSEC will be compiled from source, so you need a compiler to make that possible. It also requires an extra package for notifications. Install them by typing: sudo yum install -y gcc inotify-tools ## Step 2 - Download and Verify OSSEC OSSEC is delivered as a compressed tarball that has to be downloaded from the project's website. The checksum file, which will be used to verify that the tarball has not be tampered with, also has to be downloaded. At the time of this publication, the latest version of OSSEC is 2.8.2. Check the project's [download page](http://www.ossec.net/?page_id=19) and download whatever the latest version is. To download the tarball, type: wget -U ossec http://www.ossec.net/files/ossec-hids-2.8.2.tar.gz For the checksum file, type: wget -U ossec http://www.ossec.net/files/ossec-hids-2.8.2-checksum.txt With both files downloaded, the next step is to verify the MD5 and SHA1 checksums of the tarball. For the MD5sum, type: md5sum -c ossec-hids-2.8.2-checksum.txt The expected output is: ossec-hids-2.8.2.tar.gz: OK md5sum: WARNING: 1 line is improperly formatted To verify the SHA1 hash, type: sha1sum -c ossec-hids-2.8.2-checksum.txt And its expected output is: ossec-hids-2.8.2.tar.gz: OK sha1sum: WARNING: 1 line is improperly formatted ## Step 3: Determine Your SMTP Server During OSSEC's installation process, you'll be prompted to specify an SMTP server for your email address. If you don't know what it is, the easiest method to find out is by issuing this command from your local machine (replace the fake email address with your real one): dig -t mx you@example.com The relevant section in the output is shown in this code block. In this sample output, the SMTP server for the queried email address is at the end of the line - **mail.vivaldi.net.** . Note that the dot at the end is included. ;; ANSWER SECTION: vivaldi.net. 300 IN MX 10 mail.vivaldi.net. ## Step 4: Install OSSEC To install OSSEC, you first need to unpack the tarball, which you do by typing: tar xf ossec-hids-2.8.2.tar.gz It will be unpacked into a directory that bears the name and version of the program. Change or `cd` into it. OSSEC 2.8.2, the version installed for this article, has a minor bug that needs to be fixed before starting the installation. By the time the next stable version is released, which should be OSSEC 2.9, this should not be necessary, because the fix is already in the master branch. Fixing it for OSSEC 2.8.2 just means editing one file, which is found in the `active-response` directory. The file is `hosts-deny.sh`, so open it using: nano active-response/hosts-deny.sh Towards the end of the file, look for this block of code: # Deleting from hosts.deny elif [ "x$" = "xdelete" ]; then lock; TMP_FILE = `mktemp /var/ossec/ossec-hosts.XXXXXXXXXX` if [ "X$" = "X" ]; then # Cheap fake tmpfile, but should be harder then no random data TMP_FILE = "/var/ossec/ossec-hosts.`cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -1 `" fi On the lines that start with **TMP_FILE**, delete the spaces around the **=** sign. After removing the spaces, that portion of the file should be as shown in the block of code below. Save and close the file. # Deleting from hosts.deny elif [ "x$" = "xdelete" ]; then lock; TMP_FILE=`mktemp /var/ossec/ossec-hosts.XXXXXXXXXX` if [ "X$" = "X" ]; then # Cheap fake tmpfile, but should be harder then no random data TMP_FILE="/var/ossec/ossec-hosts.`cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -1 `" fi Now that the fix is in, we can start the installation process, which you do by typing: sudo ./install.sh Throughout the installation process, you'll be prompted to provide some input. In most cases, you only have to press **ENTER** to accept the default. First, you'll be prompted to select the installation language, which by default, is English (en). So press **ENTER** if that's your preferred language. Otherwise, input the 2 letters from the list of supported languages. Afterwards, press **ENTER** again. The first question will ask you what type of installation you want. Here, enter **local**. 1- What kind of installation do you want (server, agent, local, hybrid or help)? local For subsequent questions, press **ENTER** to accept the default. Question 3.1 will prompt you for your email address and then ask for your SMTP server. For that question, enter a valid email address and the SMTP server you determined in Step 3. 3- Configuring the OSSEC HIDS. 3.1- Do you want e-mail notification? (y/n) [y]: - What's your e-mail address? you@example.com - What's your SMTP server ip/host? If installation is successful, you should see this output: - Configuration finished properly. ... More information can be found at http://www.ossec.net --- Press ENTER to finish (maybe more information below). --- Press **ENTER** to finish the installation. ## Step 5: Start OSSEC OSSEC has been installed, but not started. To start it, first switch to the root account. sudo su Then, start it by issuing the following command. /var/ossec/bin/ossec-control start Afterwards, check your Inbox. There should be an alert from OSSEC informing you that it has been started. With that, you now know that OSSEC is installed and will be sending alerts as needed. ## Step 6: Customize OSSEC The default configuration of OSSEC works fine, but there are settings you can tweak to make it protect your server better. The first file to customize is the main configuration file - `ossec.conf`, which you'll find in the `/var/ossec/etc` directory. Open the file: nano /var/ossec/etc/ossec.conf The first item to verify is an email setting, which you'll find in the **global** section of the file: yes finid@vivaldi.net mail.vivaldi.net. ossecm@vultr.guest Make sure that the **email_from** address is a valid email. Otherwise, some email provider's SMTP server's will mark alerts from OSSEC as Spam. If the FQDN of the server is not set, the domain part of the email is set to the hostname of the server, so this is a setting that you really want to have a valid email address. Another setting that you want to customize, especially while testing the system, is the frequency with which OSSEC runs its audits. That setting is in the **syscheck** section, and, by default, it is run every 22 hours. To test OSSEC's alerting features, you might want to set it to a lower value, but reset it to the default afterwards. 79200 By default, OSSEC does not alert when a new file is added to the server. To change that, add a new tag just under the **< frequency >** tag. When completed, the section should now contain: 79200 yes One last setting that's good to change is in the list to directories that OSSEC should check. You'll find them right after the previous setting. Be default, the directories are shown as: /etc,/usr/bin,/usr/sbin /bin,/sbin Modify both lines to make OSSEC report changes in real-time. When finished, they should read: /etc,/usr/bin,/usr/sbin /bin,/sbin Save and close the file. The next file that we'll need to modify is `local_rules.xml` in the `/var/ossec/rules` directory. So `cd` into that directory: cd /var/ossec/rules That directory holds OSSEC's rule files, none of which should be modified, except the `local_rules.xml` file. In that file, we add custom rules. The rule we need to add is the one that fires when a new file is added. That rule, numbered **554**, does not trigger an alert by default. That's because OSSEC does not send out alerts when a rule with level set to zero is triggered. Here's what rule 554 looks like by default. ossec syscheck_new_entry File added to the system. syscheck, We need to add a modified version of that rule in the `local_rules.xml` file. That modified version is given in the block of code below. Copy and add it to the bottom of the file just before the closing tag. ossec syscheck_new_entry File added to the system. syscheck, Save and close the file, then restart OSSEC. /var/ossec/bin/ossec-control restart ## More Information OSSEC is a very powerful piece of software, and this article just touched on the basics. You will find more customization settings in the [official documentation](http://ossec-docs.readthedocs.org/en/latest/manual/index.html).

Articles Tagged: OSSEC HIDS