On Fri, Dec 12, 2014 at 9:25 AM, <[email protected]> wrote: > Hello, > > Currently I work with a group (cant give the name) that is trying to deploy > OSSEC across a large environment (about 3 data centers and over 1000+ > Solaris Zones). The idea behind it is we don't really have a need for the > agents but we would like to implement OSSEC's AgentLess function to help > improve the security of are infrastructure. We currently use a PKI system > for authentication and also have a pretty big OpenLDAP / NFS environment. > > The problem we were running in to was this, we had a OSSEC server setup with > analogi in are test lab and we were able to get a LDAP account / PKI > authentication ID for a user called "OSSECAGENT" setup, however when we > would try to use the ssh_generic_diff it would timeout on connection. The > idea was we would have the SSH account instead of being root or ossec be the > OSSECAGENT and just have the ossec chroot'ed user run on the server. > > so for example > > OSSEC_SERVER ----------> (Using SSH - and user ID OSSECAGENT) ---------- > > TESTBOX1 > > after debugging and working with it we identified the issue to be the OSSEC > SSH key is not currently on the TESTBOX1 machine, there for when we try to > SSH it will not identity the user connecting and eventually time out. > > When we run: /opt/ossec/agentless/ssh_generic_diff ossecagent@testbox1 > echo "hello" - (from root) it works fine (connects - runs the command - > Disconnects - all with out a issue). However when we restart the OSSEC > service via the OSSEC-CONTROL restart, it ends up timing out in the logs. > The password is being prompted due to the issue we talked about above. > > What we would like it to do is this, we would love for the OSSEC user to be > tied in to LDAP with a home directory in "/home/ossec" instead of the > chroot'ed "/opt/ossec" (cant use /var in are environment). This way we can > create a SSL key for the user and have it utilize the PKI system we already > have in place. > > We originally just tried following the setups in: > http://ossec-docs.readthedocs.org/en/latest/manual/agent/agentless-monitoring.html > and were unable to switch users in to the OSSEC account. > > The entry in the /etc/passwd file was: > "ossec:x:######:####::/opt/ossec:/bin/false" - we changed it to > "ossec:x:######:####::/opt/ossec:/bin/bash" and were able to "su - ossec" > (how we have to change users) and get a bash shell, but since the user would > not be tied in to a NFS based home directory we would have to put the SSL > cert on every single box and we don't want to have to do that. > > We created a snapshot of the working OSSEC server and through tinkering got > a OSSEC user created in LDAP and on the box via a NIS group and deleted the > original user from the /etc/passwd file. Created a SSL key, and mapped the > home directory on all the boxes we currently have. However due to the > chroot'ed process we are noticing this will not work because ossec wont be > able to start. The biggest issue was OSSEC connecting to the socket : > "/opt/ossec/queue/ossec/queue" - this is the log file entries for it: > > ossec-syscheckd(1210): ERROR: Queue '/opt/ossec/queue/ossec/queue' not > accessible: 'Destination address required'. > > We were wanting to know if anybody had run in to something like this and had > a easy method of getting this setup and configured. Any help would be > appreciated. we would like to avoid having to use the chroot'ed ossec user > if possible because we an create a SSH Key but getting the key on several > thousand servers on multiple networks will be painful. >
Please excuse my ignorance, I don't mess with Solaris very much. Couldn't you just create the ossecagent user in your directory? The ossec user only needs to exist on the manager, not on agentless systems. So creating the ossecagent user in ldap, and putting the ssh key in its home directory (which can be /home/ossecagent or whatever) seems like it would work. > Let me know of any questions > thanks again > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
