I am trying to create my own msi to install ossec. As per Dean's recommendation, i'll test the installation of the MSI on one PC and then manually import the auth keys afterwards. I included the entire "ossec-agent" folder in Program Files into the MSI and am currently stuck at which registry keys is needed on the target host? Obviously I would like it to be added as a service as well. Has anyone attempted this and can point me towards the required keys?
Currently, I have spotted the following hives HKLM > Software > ossec HKLM > System > ControlSet001 > Services > OssecSvc HKLM > System > ControlSet002 > Services > OssecSvc HKLM > System > CurrentControlSet > Services > OssecSvc but there seems to be a couple of keys specified under HKLM > System > CurrentControlSet > Enum > Root > LEGACY_OSSECSVC Are these needed as well? On Aug 10, 5:54 pm, smokey <[email protected]> wrote: > Well if manage_agent.exe would support /y switch (force adding new > agent silently) then everything would be much easier. > > For example running shell command during computer startup in windows > > 'get computer name > strComputerName = WSNetwork.ComputerName > > 'open key file > Set strFile = OpenTextFile(strComputerName,1) > strAgentKey = strFile.ReadLine > > 'add agent key > WSShell.Run manage_agent.exe -i -y strAgentKey > > D.B. > > On Aug 9, 10:29 pm, Michael Starks <[email protected]> > wrote: > > > > Thanks very much for your reply. > > > I should be able to use the MSI package that comes with the new > > > version? > > > I made some changes/bug fixes to the OSSEC Windows installer for the > > express purpose of facilitating mass installs better. You should see them > > in the next release. It's not an MSI package, but it most likely can be > > converted to one with one of the many tools out there. Key management is > > still out-of-band at the moment. > > > -- > > Michael Starks > > [I] Immutable Security > > Information Security, Privacy and Personal > > Libertyhttp://www.immutablesecurity.com
