OSSEC安装手册

# 安装OSSEC

[TOC]

## 一、提前环境准备

安装采用的是centos7.0的系统，最小化安装环境

### 1.1、关闭SElinux

由于centos7自带的SElinux会拦截，阻止太多的东西，避免麻烦，这里 我们把SElinux关闭！
```bash
[root@ctccaozhe ~]# vim /etc/selinux/config
```
编辑/etc/selinux/config，找到SELINUX 行修改成为：`SELINUX=disabled`
然后**重新启动**。

### 1.2、关闭防火墙或开放端口

#### 1.2.1、直接关闭防火墙

##### 关闭firewalld

```bash
[root@ctccaozhe ~]# systemctl stop firewalld.service #停止firewall 
[root@ctccaozhe ~]# systemctl disable firewalld.service #禁止firewall开机启动 
```

##### 关闭iptables

```bash
[root@ctccaozhe ~]# systemctl stop iptables.service
[root@ctccaozhe ~]# systemctl disable iptables.service
```

#### 1.2.2、开放防火墙端口

如果服务器需要安全考虑不能关闭防火墙那我们需要开启80端口，CentOS 7.0默认使用的是firewall作为防火墙，这里我们把centos7的防火墙换成iptables
关闭firewall：

```bash
[root@ctccaozhe ~]# systemctl stop firewalld.service #停止firewall
[root@ctccaozhe ~]# systemctl disable firewalld.service #禁止firewall开机启动
```

安装iptables防火墙

```bash
[root@ctccaozhe ~]# yum install iptables-services #安装
[root@ctccaozhe ~]# gedit /etc/sysconfig/iptables #编辑防火墙配置文件或者使用vim
```

原文件清空，复制粘贴保存：

```bash
# Firewall configuration written by system-config-firewall 
# Manual customization of this file is not recommended. 
*filter 
:INPUT ACCEPT [0:0] 
:FORWARD ACCEPT [0:0] 
:OUTPUT ACCEPT [0:0] 
-A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT 
-A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT 
-A INPUT -m state –state NEW -m tcp -p tcp –dport 3306 -j ACCEPT 
-A INPUT -m state –state NEW -m udp -p udp –dport 514 -j ACCEPT 
-A INPUT -m state –state NEW -m udp -p udp –dport 1514 -j ACCEPT 
-A INPUT -j REJECT –reject-with icmp-host-prohibited 
-A FORWARD -j REJECT –reject-with icmp-host-prohibited 
COMMIT

```

因为ossec通信是用udp 514,1514端口（可以用命令：# netstat -unlp|grep ossec 查看）所以加了下面这两句

```bash
-A INPUT -m state –state NEW -m udp -p udp –dport 514 -j ACCEPT
-A INPUT -m state –state NEW -m udp -p udp –dport 1514 -j ACCEPT
```

好了，iptables配置好了，现在，我们开启iptables:

```bash
[root@ctccaozhe ~]# systemctl restart iptables.service #最后重启防火墙使配置生效
[root@ctccaozhe ~]# systemctl enable iptables.service #设置防火墙开机启动
```

### 1.3安装运行环境

#### 1.3.1、配置yum

首先需要配置yum

建议先备份 CentOS-Base.repo：

```shell
cp /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.bak
```
修改CentOS-Base.repo文件内容为：
```bash
# CentOS-Base.repo
#
# The mirror system uses the connecting IP address of the client and the
# update status of each mirror to pick mirrors that are updated to and
# geographically close to the client.  You should use this for CentOS updates
# unless you are manually picking other mirrors.
#
# If the mirrorlist= does not work for you, as a fall back you can try the
# remarked out baseurl= line instead.
#
#

[base]
name=CentOS-$releasever - Base
baseurl=https://mirrors.tuna.tsinghua.edu.cn/centos/$releasever/os/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-7

#released updates
[updates]
name=CentOS-$releasever - Updates
baseurl=https://mirrors.tuna.tsinghua.edu.cn/centos/$releasever/updates/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-7

#additional packages that may be useful
[extras]
name=CentOS-$releasever - Extras
baseurl=https://mirrors.tuna.tsinghua.edu.cn/centos/$releasever/extras/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-7

#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-$releasever - Plus
baseurl=https://mirrors.tuna.tsinghua.edu.cn/centos/$releasever/centosplus/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=centosplus
gpgcheck=1
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-7
```

最后，更新软件包缓存

```bash
sudo yum makecache
```

#### 1.3.2、安装Apache和sendmail

```bash
[root@ctccaozhe ~]# yum install wget gcc make mysql mysql-server mysql-devel httpd php php-mysql sendmail
```

#### 1.3.3、安装mariadb

MariaDB是MySQL社区开发的分支，也是一个增强型的替代品。这里也推荐使用MariaDB，但是使用mysql也是没问题的

##### 安装MariaDB

```bash
[root@ctccaozhe ~]# yum -y install mariadb-server mariadb mariadb-devel
[root@ctccaozhe ~]# systemctl start mariadb
[root@ctccaozhe ~]# systemctl enable mariadb
```

##### 配置MariaDB

```bash
[root@ctccaozhe ~]# mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user.  If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none):      <---MaroaDB第一次配置是没有root密码的
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n]y                             <---是否配置root密码
New password:                                         <---输入密码
Re-enter new password:                                <---重复输入
Password updated successfully!
Reloading privilege tables..
 ... Success!

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n]y                        <---是否删除匿名用户
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n]n                  <---是否不允许root远程登录
 ... skipping.

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n]y       <---是否删除测试数据库test
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n]y                 <---重新加载特权表使配置生效
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!
```

#####  登录数据库查看是否设置成功

```bash
mysql -uroot -p

MariaDB [(none)]>

```

##### mariadb相关命令

```bash
systemctl start mariadb      #启动MariaDB
systemctl stop mariadb       #停止MariaDB
systemctl restart mariadb    #重启MariaDB
systemctl enable mariadb     #设置开机启动
```
创建数据库以方便我们下面的安装配置，连接到本机的MySQL，然后执行如下命令：

`create database ossec;`
`grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on ossec.* to ossec@localhost;`
`set password for ossec@localhost =PASSWORD('ossec');`
`flush privileges;`
`exit`

```sql
[root@ctccaozhe ~]# mysql -uroot -p
MariaDB [(none)]> create database ossec;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on ossec.* to ossec@localhost;
Query OK, 0 rows affected (0.01 sec)

MariaDB [(none)]> set password for ossec@localhost =PASSWORD('ossec');
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> exit
Bye
[root@ctccaozhe ~]#

```

用SET PASSWORD命令修改密码
格式：`MariaDB [(none)]> set password for 用户名@localhost = password('新密码');` 
例子：`MariaDB [(none)]> set password for root@localhost = password('123')`

> 大概的环境已经准备的差不多了

## 二、服务器ossec-server安装

### 2.1、下载

服务端包，同时解压。

```bash
[root@ctccaozhe ~]# wget https://www.caozhexxgweb.cn/data/ossec-hids-2.8.3.tar.gz
[root@ctccaozhe ~]# tar zxf ossec-hids-2.8.1.tar.gz
[root@ctccaozhe ~]# cd ossec-hids-2.8.3
```

为了使OSSEC支持MariaDB ，需要在安装前执行make setdb命令，如下

```
[root@ctccaozhe ~]# cd src; make setdb; cd ..
```

### 2.2、安装

```
[root@ctccaozhe ossec-hids-2.8.3]# ./install.sh 
which: no host in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin)

** Para instalação em português, escolha [br].
  ** 要使用中文进行安装, 请选择 [cn].
  ** Fur eine deutsche Installation wohlen Sie [de].
  ** Για εγκατάσταση στα Ελληνικά, επιλέξτε [el].
  ** For installation in English, choose [en].
  ** Para instalar en Español , eliga [es].
  ** Pour une installation en français, choisissez [fr]
  ** A Magyar nyelvű telepítéshez válassza [hu].
  ** Per l'installazione in Italiano, scegli [it].
  ** 日本語でインストールします．選択して下さい．[jp].
  ** Voor installatie in het Nederlands, kies [nl].
  ** Aby instalować w języku Polskim, wybierz [pl].
  ** Для инструкций по установке на русском ,введите [ru].
  ** Za instalaciju na srpskom, izaberi [sr].
  ** Türkçe kurulum için seçin [tr].
  (en/br/cn/de/el/es/fr/hu/it/jp/nl/pl/ru/sr/tr) [en]: cn
which: no host in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin)
 OSSEC HIDS v2.8.3 安装脚本 - http://www.ossec.net
 
 您将开始 OSSEC HIDS 的安装.
 请确认在您的机器上已经正确安装了 C 编译器.
 如果您有任何疑问或建议,请给 dcid@ossec.net (或 daniel.cid@gmail.com) 发邮件.
 
  - 系统类型: Linux ctccaozhe 3.10.0-693.el7.x86_64
  - 用户: root
  - 主机: ctccaozhe

-- 按 ENTER 继续或 Ctrl-C 退出. --

1- 您希望哪一种安装 (server, agent, local or help)? server

- 选择了 Server 类型的安装.

2- 正在初始化安装环境.

- 请选择 OSSEC HIDS 的安装路径 [/var/ossec]:

- OSSEC HIDS 将安装在  /var/ossec .

3- 正在配置 OSSEC HIDS.

3.1- 您希望收到e-mail告警吗? (y/n) [y]: 
   - 请输入您的 e-mail 地址? ctccaozhe@qq.com
   - 请输入您的 SMTP 服务器IP或主机名 ? 10.10.10.168

3.2- 您希望运行系统完整性检测模块吗? (y/n) [y]:

- 系统完整性检测模块将被部署.

3.3- 您希望运行 rootkit检测吗? (y/n) [y]:

- rootkit检测将被部署.
       
  3.4- 关联响应允许您在分析已接收事件的基础上执行一个
       已定义的命令.
       例如,你可以阻止某个IP地址的访问或禁止某个用户的访问权限.
       更多的信息,您可以访问:
       http://www.ossec.net/en/manual.html#active-response
   - 您希望开启联动(active response)功能吗? (y/n) [y]:

- 关联响应已开启

- 默认情况下, 我们开启了主机拒绝和防火墙拒绝两种响应.
     第一种情况将添加一个主机到 /etc/hosts.deny.
     第二种情况将在iptables(linux)或ipfilter(Solaris,
     FreeBSD 或 NetBSD）中拒绝该主机的访问.
   - 该功能可以用以阻止 SSHD 暴力攻击, 端口扫描和其他
     一些形式的攻击. 同样你也可以将他们添加到其他地方,
     例如将他们添加为 snort 的事件.

- 您希望开启防火墙联动(firewall-drop)功能吗? (y/n) [y]:

- 防火墙联动(firewall-drop)当事件级别 >= 6 时被启动

- 联动功能默认的白名单是:
      - 202.101.172.35
      - 223.5.5.5

- 您希望添加更多的IP到白名单吗? (y/n)? [n]: y
   - 请输入IP (用空格进行分隔): 10.10.10.169

3.5- 您希望接收远程机器syslog吗 (port 514 udp)? (y/n) [y]:

- 远程机器syslog将被接收.

3.6- 设置配置文件以分析一下日志:
    -- /var/log/messages
    -- /var/log/secure
    -- /var/log/maillog
    -- /var/log/httpd/error_log (apache log)
    -- /var/log/httpd/access_log (apache log)

-如果你希望监控其他文件, 只需要在配置文件ossec.conf中
  添加新的一项. 
  任何关于配置的疑问您都可以在 http://www.ossec.net 找到答案.

--- 按 ENTER 以继续 ---

5- 正在安装系统
 - 正在运行Makefile
INFO: Little endian set.

*** Making zlib (by Jean-loup Gailly and Mark Adler)  *** 
make[1]: 进入目录“/root/ossec-hids-2.8.3/src/external”
cd zlib-1.2.8/; ./configure; make libz.a;
Checking for gcc...

…………省略编译输出…………

- 系统类型是  Redhat Linux.
 - 修改启动脚本使 OSSEC HIDS 在系统启动时自动运行

- 已正确完成系统配置.

- 要启动 OSSEC HIDS:
		/var/ossec/bin/ossec-control start

- 要停止 OSSEC HIDS:
		/var/ossec/bin/ossec-control stop

- 要查看或修改系统配置,请编辑  /var/ossec/etc/ossec.conf

感谢使用 OSSEC HIDS.
    如果您有任何疑问,建议或您找到任何bug,
    请通过　contact@ossec.net 或邮件列表 ossec-list@ossec.net 联系我们.    
    ( http://www.ossec.net/en/mailing_lists.html ).

您可以在　http://www.ossec.net 获得更多信息

--- 请按　ENTER 结束安装 (下面可能有更多信息). ---

```

直到碰到上面内容，说明安装完成。

### 2.3、配置

#### 2.3.1、配置数据库

上面只是安装好了OSSEC服务端，下面则是为了配置服务端，使其工作正常。执行下面命令启用数据库支持：

```bash
[root@ctccaozhe ossec-hids-2.8.3]# /var/ossec/bin/ossec-control enable database
```

然后导入MySQL表结构到MySQL中：

```bash
[root@ctccaozhe ossec-hids-2.8.3]# mysql -uossec -p ossec < ./src/os_dbd/mysql.schema
```

修改部分配置文件的权限，否则会启动服务失败：

```bash
[root@ctccaozhe ossec-hids-2.8.3]# chmod u+w /var/ossec/etc/ossec.conf
```

#### 2.3.2、配置mysql连接

然后我们编辑ossec.conf文件，在ossec_config中添加MySQL配置：

```xml
<ossec_config>
    <database_output>
        <hostname>10.10.10.169</hostname>
        <username>ossec</username>
        <password>ossec</password>
        <database>ossec</database>
    	<type>mysql</type>
	</database_output>
</ossec_config>
```

#### 2.3.3、配置syslog

由于我们在前面的安装过程中支持接受远程机器的syslog，所以我们还需要对ossec.conf文件中的syslog部分进行配置，修改ossec.conf文件，按照下面的内容进行修改，把我们网段可以全添加进去：

```xml
<remote>
    <connection>syslog</connection>
    <allowed-ips>192.168.0.0/16</allowed-ips>
</remote>
```

#### 2.3.4、启动ossec

在实际的实验过程中启动ossec服务端必须先添加一个客户端，否则直接启动服务端是会失败的，通过如下命令查看日志会发现如下错误：

```bash
[root@ctccaozhe logs]# cat /var/ossec/logs/ossec.log
2018/03/5 23:43:15 ossec-analysisd(1210): ERROR: Queue '/queue/alerts/ar' not accessible: 'Connection refused'.
2018/03/5 23:43:15 ossec-analysisd(1301): ERROR: Unable to connect to active response queue.
```

在服务器上添加客户端，执行如下命令，按照提示进行输入：

```bash
[root@ctccaozhe ossec-hids-2.8.3]# /var/ossec/bin/manage_agents

****************************************
* OSSEC HIDS v2.8.3 Agent manager.     *
* The following options are available: *
****************************************
   (A)dd an agent (A).
   (E)xtract key for an agent (E).
   (L)ist already added agents (L).
   (R)emove an agent (R).
   (Q)uit.
Choose your action: A,E,L,R or Q: A

Adding a new agent (use ‘\q’ to return to the main menu).
        Please provide the following:
            A name for the new agent: ossec-agent
            The IP Address of the new agent: 10.10.10.157
            An ID for the new agent[001]: 001
            Agent information:
            ID:001
            Name:ossec-agent
            IP Address:10.10.10.157

Confirm adding it?(y/n): y
        Agent added.
```

注意、需要将key记录到文本中，后面需要用到。

然后程序会重新进入到第一次的界面，如下，我们导出刚才添加的那个agent的key，用于后面的客户端连接到服务端：

```bash
[root@ctccaozhe ossec-hids-2.8.3]# /var/ossec/bin/manage_agents

Available agents:
　　ID: 001, Name: ossec-agent, IP: 10.10.10.157
　　Provide the ID of the agent to extract the key (or ‘\q’ to quit): 001

Agent key information for ‘001’ is:

MDAxIG9zc2VjLWFnZW50IDE5Mi4xNjguODAuMzIgN2MyZTMyMzYwZTBhNTVmNDVhNTJlMTE5MjRjNjRiNjZjOTdhYjlmN2Q2MjVmYzY4MGFiZjNmZGJmOGIwY2JlMw

** Press ENTER to return to the main menu.
```

到现在就可以启动我们的ossec服务端了。

```bash
[root@ctccaozhe ]# /var/ossec/bin/ossec-control start
```

或者执行

```bash
[root@ctccaozhe ]# /etc/init.d/ossec start
```

## 三、客户端ossec-server安装

### 3.1、下载

由于我们本身客户端也是Linux服务器，而ossec的服务端和客户端是同一个安装包，所以在客户端上下载安装包，并且解压安装，如下。

```bash
[root@ctccaozhe ~]# wget https://www.caozhexxgweb.cn/data/ossec-hids-2.8.3.tar.gz
[root@ctccaozhe ~]# tar zxf ossec-hids-2.8.1.tar.gz
[root@ctccaozhe ~]# cd ossec-hids-2.8.3
```

### 3.2、安装

```
　　** Para instalação em português, escolha [br].
　　** 要使用中文进行安装, 请选择 [cn].
　　** Fur eine deutsche Installation wohlen Sie [de].
　　** Για εγκατάσταση στα Ελληνικά, επιλέξτε [el].
　　** For installation in English, choose [en].
　　** Para instalar en Español , eliga [es].
　　** Pour une installation en français, choisissez [fr]
　　** A Magyar nyelvű telepítéshez válassza [hu].
　　** Per l’installazione in Italiano, scegli [it].
　　** 日本語でインストールします．選択して下さい．[jp].
　　** Voor installatie in het Nederlands, kies [nl].
　　** Aby instalować w języku Polskim, wybierz [pl][/pl].
　　** Для инструкций по установке на русском ,введите [ru].
　　** Za instalaciju na srpskom, izaberi [sr].
　　** Türkçe kurulum için seçin [tr].
　　(en/br/cn/de/el/es/fr/hu/it/jp/nl/pl/ru/sr/tr) [en]: cn
　　OSSEC HIDS v2.8.1 安装脚本 - http://www.ossec.net

您将开始 OSSEC HIDS 的安装.
　　请确认在您的机器上已经正确安装了 C 编译器.

如果您有任何疑问或建议,请给发邮件.

1- 您希望哪一种安装 (server, agent, local or help)? agent

选择了 Agent(client) 类型的安装.

2- 正在初始化安装环境.

请选择 OSSEC HIDS 的安装路径 [/var/ossec]: /var/ossec
        OSSEC HIDS 将安装在 /opt/ossec .

3- 正在配置 OSSEC HIDS.

3.1- 请输入 OSSEC HIDS 服务器的IP地址或主机名: 192.168.80.31

添加服务器IP 10.10.10.169

3.2- 您希望运行系统完整性检测模块吗? (y/n) [y]: y

系统完整性检测模块将被部署.

3.3- 您希望运行 rootkit检测吗? (y/n) [y]: y

rootkit检测将被部署.

3.4 - 您希望开启联动(active response)功能吗? (y/n) [y]: y

3.5- 设置配置文件以分析一下日志:
    – /var/log/messages
    – /var/log/secure
    – /var/log/xferlog
    – /var/log/maillog
    – /var/log/httpd/error_log (apache log)
    – /var/log/httpd/access_log (apache log)

-如果你希望监控其他文件, 只需要在配置文件ossec.conf中
    添加新的一项.
    任何关于配置的疑问您都可以在 http://www.ossec.net 找到答案.

— 按 ENTER 以继续 —

5- 正在安装系统
- 正在运行Makefile
INFO: Little endian set.

…………省略编译输出…………

系统类型是 Redhat Linux.

修改启动脚本使 OSSEC HIDS 在系统启动时自动运行

已正确完成系统配置.

要启动 OSSEC HIDS:
        /var/ossec/bin/ossec-control start

要停止 OSSEC HIDS:
        /var/ossec/bin/ossec-control stop

要查看或修改系统配置,请编辑 /var/ossec/etc/ossec.conf

感谢使用 OSSEC HIDS.
        如果您有任何疑问,建议或您找到任何bug,
        [email protected] 或邮件列表 [email protected] 联系我们.
        ( http://www.ossec.net/en/mailing_lists.html ).

您可以在　http://www.ossec.net 获得更多信息

— 请按　ENTER 结束安装 (下面可能有更多信息). —

您必须首先将该代理添加到服务器端以使他们能够相互通信.
        这样做了以后,您可以运行’manage_agents’工具导入
        服务器端产生的认证密匙.
        /opt/ossec/bin/manage_agents

详细信息请参考:

http://www.ossec.net/en/manual.html#ma
```

### 3.3、配置

其实配置ossec客户端就是把刚才由服务端生成的key，在客户端中导入，执行如下命令

```
[root@ctccaozhe ossec-hids-2.8.3]# /var/ossec/bin/manage_agents

Provide the Key generated by the server.
    The best approach is to cut and paste it.
    *** OBS: Do not include spaces or new lines.

Paste it here (or ‘\q’ to quit): MDAxIG9zc2VjLWFnZW50IDE5Mi4xNjguODAuMzIgN2MyZTMyMzYwZTBhNTVmNDVhNTJlMTE5MjRjNjRiNjZjOTdhYjlmN2Q2MjVmYzY4MGFiZjNmZGJmOGIwY2JlMw

Agent information:
　　ID:001
　　Name:ossec-agent
　　IP Address: 10.10.10.157

Confirm adding it?(y/n): y
　　　　Added.
　　** Press ENTER to return to the main menu.
```

最后启动ossec-agent客户端

```
[root@ctccaozhe ~]# /var/ossec/bin/ossec-control start
```

或者执行

```
[root@ctccaozhe ~]# /etc/init.d/ossec start
```

## 四、为ossec-server安装第三方的web界面（analogi）

上面我们安装了ossec的服务端，并且为ossec添加了一个客户端，非常简单的一个环境，环境是搭建好了，可是目前这个环境如果我们要分析ossec的报警信息就太麻烦了，**所以我们安装第三方的 web界面用来显示报警信息。**

```bash
[root@ctccaozhe ~]# wget https://github.com/ECSC/analogi/archive/master.zip
[root@ctccaozhe ~]# unzip master
[root@ctccaozhe ~]# mv analogi-master/ /var/www/html/analogi
[root@ctccaozhe ~]# cd /var/www/html/
[root@ctccaozhe html]# chown -R apache.apache analogi/
[root@ctccaozhe html]# cd analogi/
[root@ctccaozhe analogi]# cp db_ossec.php.new db_ossec.php
```

编辑db_ossec.php文件，修改MySQL的配置信息:

```sql
define ('DB_USER_O', 'ossec');
define ('DB_PASSWORD_O', 'ossec');
define ('DB_HOST_O', '127.0.0.1');
define ('DB_NAME_O', 'ossec');
```

修改 apache 配置，增加虚拟目录，

```bash
[root@ctccaozhe ~]# vim /etc/httpd/conf.d/analogi.conf
```

添加如下内容

```xaml
Alias /analogi /var/www/html/analogi
<Directory /var/www/html/analogi>
    Order deny,allow
    Deny from all
    Allow from 192.168.0.0/16
</Directory>
```

然后重新启动Apache

```bash
[root@ctccaozhe ~]# systemctl restart httpd
```

## 五、 为ossec-server安装第三方的web界面（ossec-wui )

https://github.com/ossec/ossec-wui/releases

```bash
[root@ctccaozhe ~]# pwd
/var/www/html
[root@ctccaozhe html]# ls
analogi  ossec-wui-0.9.zip
[root@ctccaozhe html]# unzip ossec-wui-master.zip
unzip:  cannot find or open ossec-wui-master.zip, ossec-wui-master.zip.zip or ossec-wui-master.zip.ZIP.
[root@ctccaozhe html]# ll
total 184
drwxr-xr-x 5 apache apache   4096 Mar  6 05:48 analogi
-rw-r--r-- 1 root   root   182791 Mar  6 10:40 ossec-wui-0.9.zip
[root@ctccaozhe html]# yum -y install unzip
[root@ctccaozhe html]# unzip ossec-wui-master.zip
```

果你这里，也是这样的情况，则linux下解压unzip报错“cannot find zipfile directory……”

[解决方法](http://www.vuln.cn/8532)

当然，你这里，也可以是tar.gz

```bash
[root@ctccaozhe html]# pwd
/var/www/html
[root@ctccaozhe html]# ls
analogi  ossec-wui-0.9.tar.gz
[root@ctccaozhe html]# tar -zxvf ossec-wui-0.9.tar.gz 
```

```bash
[root@ctccaozhe html]# pwd
/var/www/html
[root@ctccaozhe html]# ls
analogi  ossec-wui-0.9  ossec-wui-0.9.tar.gz
[root@ctccaozhe html]# rm ossec-wui-0.9.tar.gz 
rm: remove regular file ‘ossec-wui-0.9.tar.gz’? y
[root@ctccaozhe html]# mv ossec-wui-0.9/ ossec
[root@ctccaozhe html]# ls
analogi  ossec
[root@ctccaozhe html]# cd ossec/
[root@ctccaozhe ossec]# ls
CONTRIB  htaccess_def.txt  index.php  lib      ossec_conf.php  README.search  site
css      img               js         LICENSE  README          setup.sh
[root@ctccaozhe ossec]# ./setup.sh 
Setting up ossec ui...
Username: ossec
New password: 
Re-type new password: 
Adding password for user ossec
Enter your web server user name (e.g. apache, www, nobody, www-data, ...)
apache
You must restart your web server after this setup is done.
Setup completed successfully.
[root@ctccaozhe ossec]# 
```

再

```bash
[root@ossec-server ossec]# vim /etc/httpd/conf.d/ossec.conf 
```

保存退出。
`chown apache:apache *`
`service httpd restart`

# 最后

上面是整个安装和配置步骤，结束