In this tutorial we will be installing OSSEC Host Intrusion detection. OSSEC is a free, open-source host intrusion detection system. The client is compatible with almost all of the mayor operating systems, including Linux, OpenBSD, FreeBSD, OS X, Solaris and Windows. In this tutorial we will be installing the OSSEC centralized management server and i will show you how to add a Windows 10 agent to be monitored and managed.

  • Log analysis
  • Integrity checking
  • Windows registry monitoring
  • Rootkit detection
  • Time based alerting
  • Active response.

Positives:

  • Very powerful log analysing engine
  • Monitor Multi OS environments with easy
  • OSSEC supports agent less as well as agent based monitoring
  • Can monitor all user activities which is not possible in a network based system
  • It can identify attacks that originate from inside the host.
  • Ability to monitor encrypted traffic.
  • No extra hardware since software is installed on the hosts
  • Cost effective for a small scale network having a few hosts.

Negatives:

  • By default, OSSEC restricts the number of agents to 256 per manager (to change this default behaviour OSSEC needs to be compiled from source with some additional options).
  • Limited number of alerts per hour.
  • Transitioning to newer versions of can be difficult, previously defined rules are overwritten by default values upon upgrading.

You can find more info on OSSEC here or on their GitHub site here

System Requirements

Installation

Connect to your server as the admin user via SSH.

ssh [email protected]

Set a static IP

sudo nano /etc/network/interfaces

Replace

...
auto eth0
iface eth0 inet dhcp
...

with thee following
(choose your IP from a non dhcp range in your network,and the DNS of your choosing i used Google DNS)

...
auto eth0
iface eth0 inet static
address 192.168.1.8
gateway 192.168.1.1
netmask 255.255.255.0
dns-nameservers 8.8.8.8 8.8.4.4
...

Save and close

Reboot

sudo shutdown -r now

Connect to your server on the new IP via SSH.

ssh [email protected]

Download and install OSSEC

# Add Apt sources.lst
wget -q -O - https://updates.atomicorp.com/installers/atomic | sudo bash

# Update sources
sudo apt-get update && sudo apt-get upgrade -y

# Server
sudo apt-get install ossec-hids-server unzip apache2 libapache2-mod-php7.0 php7.0 php7.0-cli php7.0-common apache2-utils

Enable email notifications

Choose the emails where the alerts will be sent to

Choose the from email address

localhost or 127.0.0.1
(i had some issues setting it to localhost here so please use 127.0.0.1 instead)

Add the IP from your PC to the whitelist so OSSEC will allow ssh connections from your PC by editing the OSSEC config file

sudo nano /var/ossec/etc/ossec.conf

In my case 192.168.1.120 you can also add multiple IP’s as necessary

...
  
    127.0.0.1
    ::1
    192.168.1.120
  
...

By default, OSSEC sends 12 emails per hour, we will modify the following setting to decrease the default. You can increase or decrease that value by adding the following section:

5

Should look like this:

...  yes [email protected] 127.0.0.1 [email protected]
    5
  
...

Installing the OSSEC Web Interface

sudo mkdir -p /var/www/html/

cd /var/www/

sudo wget https://github.com/ossec/ossec-wui/archive/master.zip

sudo unzip master.zip -d /var/www/html/

sudo rm master.zip

sudo mv /var/www/html/ossec-wui-master/* /var/www/html/

sudo rm -rf /var/www/html/ossec-wui-master/

cd /var/www/html/

sudo bash setup.sh

Enter your username, Password and choose www-data as your WebServer username

Setting up ossec ui...
 
Username: admin
New password: 
Re-type new password: 
Adding password for user admin
Enter your web server user name (e.g. apache, www, nobody, www-data, ...)
www-data
You must restart your web server after this setup is done.
 
Setup completed successfully.

Restart the Web Server and allow required ports trough the firewall

sudo ufw allow http

sudo ufw allow 1514/udp

sudo systemctl restart apache2

Test your Web Interface at

http://your.server.ip

sudo /var/ossec/bin/manage_agents

For additional info on setting up a domain on MailGun:
Setting up a domain with Mailgun

Install postfix

sudo debconf-set-selections
admin