Hi Martin, there are actually some options to deploy agents, you can use Puppet or Ansible to make a large deployment. A very simple unattended installation could be installing the agent with preloaded variables. You can find file etc/preloaded-vars.conf at the source code, fill it (uncomment and set the options) and launch the install.sh. With a proper filled preloaded-vars.conf, it will make an unattended installation.
The next step is adding the agent to the manager, you may use the Auth system (ossec-authd server on manager and agent-auth on agents) to register automatically agents. There are some approaches to get a high availability system, the most important task is to ensure that file /var/ossec/etc/client.keys is always synchronized between every manager in your system. If you have Rids counters enabled (OSSEC has them enabled by default) you should make the same with file /var/ossec/queue/rids/sender_counter, that stores the message counter (it does this to numerate each message and avoid some security threats like replay attacks). There is no an unique way to achieve high availability, it depends on your system (how many managers you have, whether they are parallel or there is a main manager and a backup server, whether you will use shared storage, etc). Best regards. On Tue, Apr 4, 2017 at 10:32 AM, Martin <martin...@gmail.com> wrote: > I know it is possible with "Unattended Source Installation" but i'd still > have to add manually these agents on the manager or is there another way :) > ? > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- Victor M. Fernandez-Castro IT Security Engineer Wazuh Inc. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
