If you have been deploying or troubleshooting Alienvault long enough, you would know a few things: Alienvault is one of the most flexible SIEMs in the market. It has the most varied security features, and covers almost the entire spectrum of our PCI-DSS needs – from IDS, to SIEM, to File Integrity Monitoring, to vulnerability scaring to a partridge in a pear tree.
One of the products working under the Alienvault hood is OSSEC, which is a opensorce host based IDS. Sometimes, its interchangeable to HIDS, which is Host IDS, but really, the latter is simply the type; while the former is the actual name itself. For the sake of this article, we will interchange both terms.
OSSEC runs well with Windows, where Alienvault can do an auto deployment given the correct setup and credentials. However, it’s on Linux boxes that sometimes we get a bit concerned. Not because the product doesn’t work, but simply because the setting up of the installation. There is no auto deployment, so we need to set it up manually, and this might mean downloading the correct packages in the first place.
After this, we are going to look at a specific function of HIDS – File Integrity Monitoring or FIM for short.
Firstly, let’s get started. We have set up a simple CentOS 7 box in our lab in the same network as Alienvault, and we are going to install HIDS on this box as an AGENT. This will then talk to the Alienvault USM which is the server.
So let’s assume you have your agent system network setup (please ensure your DNS is set properly, you should be able to work this out in CentOS 7 either through the network tools or editing resolv.conf).
yum groupinstall "Development Tools" -y
The CentOS development tools are very useful tools which is a bundle, used primarily for building and compiling software from source code. “Yum” here while making you think of going for a teh tarik is a command found in almost all red-hat based distros to run installations. It’s used for update, installations etc. In the old days before YUM, we would use RPM (which is really what YUM is using), but we would have to manually track down dependencies and it really sucks because to install an RPM package might mean to install a whole bunch of stupid libraries or updating stuff and you are basically running around the internet looking for RPMs like Where’s Wally. It looks awful now, but back in the days, RPM was heavensent. We didn’t need to do “tar”, configure, make, “make install” anymore!
Anyway, the -y argument behind simply automates the command by answering yes to the prompts. So once you run that, fingers crossed, everything runs ok and you get
Complete!
Which means everything is ok.
The next is to get the kernel-devel package.
yum install kernel-devel -y
This is a package that allows us to install a kernel driver later. It’s not the full kernel source, so it shouldn’t take too long before you see the “complete!”.
At this point you are ready to install OSSEC. If there are any issues, then troubleshooting is obviously required.
First, we need to locate the version of HIDS that can work with Alienvault. You might think heading to the latest HIDS in https://ossec.github.io/downloads.html might be the answer, but for Alienvault, we would recommend to get the 2.8.3 version. You can find it here:
https://bintray.com/ossec/ossec-hids/download_file?file_path=ossec-hids-2.8.3.tar.gz
So, go to a installation directory (optional) like /usr/src and run
curl -OL https://bintray.com/ossec/ossec-hids/download_file?file_path=ossec-hids-2.8.3.tar.gz
We used curl here because for some reason wget wasn’t installed. the -OL is supposed to handle the redirected links for that particular site and supposedly to rename it to a proper remote file name. It doesn’t do the rename though (don’t know?) and we wind up with a file called “download_file?file_path=ossec-hids-2.8.3.tar.gz”. Just rename it if you are into aesthetics to ossec-hids-2.8.3.tar.gz.
So now lets do an extraction
tar –xzvf ossec-hids-2.8.3.tar.gz
We now have a folder called ossec-hids-2.8.3. Go into this folder and then run
./install.sh
Once you run, you will be given a series of questions. Default should be fine for most, and you should just select ‘agent’ and also key in the server (Alienvault) IP address. Now if you are running a separate Alienvault setup (non-AIO), then this IP address is actually the address of your SENSOR. Not Alienvault Server. So don’t get mixed up. The Sensor is the Server. Hm.
So everything ready, fingers crossed, just go ahead and install. There will be a lot of text filling your screen but the important thing is that there is no ERROR or WARNING (well warning ain’t bad), but at the end you should have a welcome note stating
Thanks for using the OSSEC HIDS. If you have any question, suggestion or if you find any bug, contact us at contact@ossec.net or using our public maillist at ossec-list@ossec.net (http://www.ossec.net/main/support/ ).
Press enter and you should be out of the installation. Congratulations!
You are not done yet. You still need to get Alienvault to talk to your box. The steps are as follows:
a) Generate an Agent Key from Alienvault
Go to your Alienvault AIO or your Server (since a standard sensor has no GUI, remember?).
Environment->Detection->Agents
Click “Add Agent”
Select the host from the list (It should be there automatically, but if it’s not just add it there through the asset list).
So now the agent has been created but you should see it as “Disconnected” from the list. Click the little Key sign that says “Extract Key”.
You should see something like
Agent key information for '2' is: MiBIb3N0LTE5Mi0xNjgtMC01MCAxOTIuMTY4LjAuNTAgMDBmYzI0MzUyNzg4N.....etc
b) Import the key into the agent system
Go back to your agent system and head over to /var/ossec/bin and run
./manage-agents
Type in ‘I’ to import
Paste the whole key into the screen and confirm adding it.
Quit and then restart by going
/var/ossec/bin
And
./ossec-control restart
c) Restarting HIDS on the server
On the server head over to
Environment->Detection->HIDS Control
On the right side, click “Restart” the HIDS and you should be fine.
d) Check the Agent Logs
Head back to the agent system and check the logs
cd /var/ossec/logs
more ossec.log
You should (hopefully!) see
INFO: Connected to the server (192.168.0.xxx:1514).
where xxx is your server IP address.
Back in the USM server you will be able to see that now the agent is “Active”.
In the next article we will see if we can get the FIM to work.
