> Where did you get the binaries?
I compiled the binary myself, following the guide on
http://www.ossec.net/wiki/Know_How:BinaryInstall, used to make rolling
out on multiple servers much easier.
I edited the preloaded-vars.conf file with what I wanted and compiled,
installed without issue. then just extracted/imported the key from the
manager.
> Are you getting email alerts for these files?
> Please post your entire agent.conf. I'm wondering if it's not getting used.
> Are other configurations in the agent.conf getting used?
It seems that I'm confused on the agent.conf as it was giving errors
on the agent and it was not sending anymore alerts or responding to
syscheck/restart commands from the manager. After I replaced the
agent.conf manually with just having syscheck directories and the
logfiles to monitor, it'd restart again.
>From what I understand the agent.conf should be the only config an
agent uses, right? So define the syscheck folders/logfiles to monitor
etcetera. However my agent says it has duplicate folders, which are
defined in ossec.conf. So it's not " use agent.conf instead of
ossec.conf" when it's found then?
I'm currently just using this as my agent.conf
<agent_config>
<syscheck>
<frequency>21600</frequency>
<directories check_all="yes">/etc,/usr/bin,/usr/sbin,/bin,/sbin,/
usr/src</directories>
<ignore>/etc/mtab</ignore>
<ignore>/etc/mnttab</ignore>
<ignore>/etc/hosts.deny</ignore>
<ignore>/etc/mail/statistics</ignore>
<ignore>/etc/random-seed</ignore>
<ignore>/etc/adjtime</ignore>
<ignore>/etc/httpd/logs</ignore>
<ignore>/etc/utmpx</ignore>
<ignore>/etc/wtmpx</ignore>
<ignore>/etc/cups/certs</ignore>
<ignore>/etc/dumpdates</ignore>
<ignore>/etc/svc/volatile</ignore>
<ignore>/etc/virtual/usage/</ignore>
<ignore>/etc/virtual/pophosts</ignore>
<ignore>/etc/virtual/pophosts_user</ignore>
<ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf</ignore>
<ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf.back</
ignore>
<ignore>/etc/virtual/domains</ignore>
<ignore>/etc/virtual/domainowners</ignore>
<ignore>/etc/proftpd.passwd</ignore>
<ignore>/etc/proftpd.vhosts.conf</ignore>
<ignore>/etc/named.conf</ignore>
</syscheck>
<rootcheck>
<rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</
rootkit_files>
<rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</
rootkit_trojans>
</rootcheck>
<active-response>
<disabled>yes</disabled>
</active-response>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/messages</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/auth.log</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/syslog</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/dpkg.log</location>
</localfile>
</agent_config>
It does email me alerts now, however the daily reports(rootcheck/
syscheck) came all in the subject line, not the body.
Also it's no longer giving me messages on the pophosts and
pophosts_users files anymore, so it's definitely in use now.
> There were no error messages at all on the first server when you ran
> the report manually? That's odd.
> Check the ossec-reportd file and permissions (file
> /var/ossec/bin/ossec-reportd ; ls -l /var/ossec/bin/ossec-reportd).
> These are the permissions I have for the file:
> -r-xr-x--- 1 root ossec 241863 Aug 10 10:23 /var/ossec/bin/ossec-reportd
As for the permissions, they're exactly the same for everything in
the /var/ossec/bin directory.
On Aug 24, 3:00 pm, "dan (ddp)" <[email protected]> wrote:
> On Tue, Aug 24, 2010 at 7:15 AM, Aeterna <[email protected]> wrote:
> > Hey folks,
>
> > I'm looking to deploy ossec on several servers but I'm running into
> > 2-3 issues, which hopefully are simple and I'm just overlooking
> > something obvious. I'm using 2.4.1 on both server and agent, the
> > agent's installed through a binary to make the rollout automated
> > through a script.
>
> Where did you get the binaries?
>
>
>
> > So I've got a server installed and 1 agent who's getting a shared
> > config, verified by looking at the md5sum. These are DirectAdmin
> > servers so I've included this part to syscheck.
> > <ignore>/etc/virtual/usage/</ignore>
> > <ignore>/etc/virtual/pophosts</ignore>
> > <ignore>/etc/virtual/pophosts_user</ignore>
> > <ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf</ignore>
> > <ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf.back</
> > ignore>
> > <ignore>/etc/virtual/domains</ignore>
> > <ignore>/etc/virtual/domainowners</ignore>
> > <ignore>/etc/proftpd.passwd</ignore>
> > <ignore>/etc/proftpd.vhosts.conf</ignore>
> > <ignore>/etc/named.conf</ignore>
>
> > Now from what I understand this should stop the agent checking said
> > files and directory, however when I run /var/ossec/bin/
> > syscheck_control -i (id), it'll still show the /etc/virtual/pophosts &
> > pophosts_user files to have been changed.
>
> Are you getting email alerts for these files?
> Please post your entire agent.conf. I'm wondering if it's not getting used.
> Are other configurations in the agent.conf getting used?
>
>
>
> > The 2nd issue is that I'm not getting the daily reports e-mailed to
> > me, in my /var/ossec/etc/ossec.conf I have added the following:
>
> > <reports>
> > <category>syscheck</category>
> > <title>Daily report: syscheck</title>
> > <email_to>[email protected]</email_to>
> > </reports>
>
> > I can see in the /var/ossec/logs/ossec.log that it says after a filter
> > had been applied, it contains no alerts... while there clearly were
> > alerts that day. It ran at 1minute past midnight, but I'm assuming
> > that it still had the alerts in the alerts file at that point.
>
> > Then finally I set up another test server on an equal machine/distro
> > and decided to try a manual report from the cli and ran this command:
> > cat /var/ossec/logs/alerts/alerts.log | /var/ossec/bin/ossec-reportd -
> > n "Test summary"
> > This generated a summary of the alerts it had during that day, however
> > when I ran it on my first server, it just cat'd the alerts log file,
> > nothing else.
> > Not sure where to look on that one.
>
> > Thanks in advance.
>
> There were no error messages at all on the first server when you ran
> the report manually? That's odd.
> Check the ossec-reportd file and permissions (file
> /var/ossec/bin/ossec-reportd ; ls -l /var/ossec/bin/ossec-reportd).
> These are the permissions I have for the file:
> -r-xr-x--- 1 root ossec 241863 Aug 10 10:23 /var/ossec/bin/ossec-reportd
