Scribd Logo
Upload

Welcome to Scribd!

  • 97 views

    Hendgrow Ossec Open Source Hids With Web User Interface

    Uploaded by

    Hau Tran
    This document provides instructions for installing OSSEC open source host-based intrusion detection system (HIDS) with a web user interface on an Ubuntu 20.04 server. It includes steps to install required packages, download and extract the OSSEC source code, run the install script, clone and set up the OSSEC web user interface, configure Apache, and add a Windows agent. The Windows agent is downloaded, registered with the OSSEC server, and started to integrate into the monitoring system.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Hendgrow Ossec Open Source Hids With Web User Interface

    Uploaded by

    Hau Tran
    97 views10 pages
    This document provides instructions for installing OSSEC open source host-based intrusion detection system (HIDS) with a web user interface on an Ubuntu 20.04 server. It includes steps to install required packages, download and extract the OSSEC source code, run the install script, clone and set up the OSSEC web user interface, configure Apache, and add a Windows agent. The Windows agent is downloaded, registered with the OSSEC server, and started to integrate into the monitoring system.

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides instructions for installing OSSEC open source host-based intrusion detection system (HIDS) with a web user interface on an Ubuntu 20.04 server. It includes steps to install required packages, download and extract the OSSEC source code, run the install script, clone and set up the OSSEC web user interface, configure Apache, and add a Windows agent. The Windows agent is downloaded, registered with the OSSEC server, and started to integrate into the monitoring system.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    97 views10 pages

    Hendgrow Ossec Open Source Hids With Web User Interface

    Uploaded by

    Hau Tran
    This document provides instructions for installing OSSEC open source host-based intrusion detection system (HIDS) with a web user interface on an Ubuntu 20.04 server. It includes steps to install required packages, download and extract the OSSEC source code, run the install script, clone and set up the OSSEC web user interface, configure Apache, and add a Windows agent. The Windows agent is downloaded, registered with the OSSEC server, and started to integrate into the monitoring system.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 10

    hendgrow.

    com

    OSSEC OPEN SOURCE HIDS WITH WEB USER


    INTERFACE. (UPDATED FOR UBUNTU 20.04 &
    OSSEC 3.6.0)
    urls used:
    OSSEC Server/Agent – https://github.com/ossec/ossec-hids/archive/3.6.0.tar.gz
    OSSEC Windows Agent
    – https://updates.atomicorp.com/channels/atomic/windows/ossec-agent-win32-
    3.6.0-12032.exe
    Start with installing some packages on Ubuntu 20.04.
    ssh to your ubuntu 20.04 server

    $ ssh yoursuser@yourserverip
    $ sudo apt update && sudo apt upgrade
    $ sudo apt install -y php php-cli php-common libapache2-mod-php apache2-utils sendmail
    inotify-tools apache2 build-essential gcc make wget tar zlib1g-dev libpcre2-dev libpcre3-
    dev unzip libz-dev libssl-dev libpcre2-dev libevent-dev build-essential
    Enter you password when prompted.

    $ sudo systemctl enable apache2


    $ sudo systemctl start apache2
    $ sudo a2enmod rewrite
    $ sudo systemctl restart apache2
    OSSEC Install
    $ wget https://github.com/ossec/ossec-hids/archive/3.6.0.tar.gz
    $ sudo tar -xvzf 3.6.0.tar.gz
    $ sudo /home/hgadmin/ossec-hids-3.6.0/install.sh
    Provide your preferred input as prompted. For the demo we opted for the below:
    The inputs we selected for the
    demo

    Input your server IP Address or hostname


    Installing the Web User Interface.
    $cd /tmp/
    $ sudo git clone https://github.com/ossec/ossec-wui.git
    $ sudo mv /tmp/ossec-wui /var/www/html
    $ cd /var/www/html/ossec-wui
    $ sudo ./setup.sh
    When prompted enter your chosen username and password. For the web server
    name enter www-data.
    Set Permissions
    $ sudo chown -R www-data:www-data /var/www/html/ossec-wui/
    $ sudo chmod -R 755 /var/www/html/ossec-wui/
    Restart Apache and launch Web User Interface
    $ sudo systemctl restart apache2
    Open browser and navigate to http://your-servers-ip/ossec-wui

    Configure WUI port to :8090


    One way to change the WUI port is to edit the 000-default.conf file.

    vi /etc/apache2/sites-enabled/000-default.conf

    Add the following to the file


    <VirtualHost *:8090>
    DocumentRoot /var/www/html/ossec-wui
    </VirtualHost>

    Edit the /etc/apache2/ports.conf file and add the port you specified. In our
    case 8090.
    sudo vi /etc/apache2/ports.conf

    Restart apache and test.


    sudo systemctl restart apache2
    Open your browser to http://your-ip-address:your-port / http://192.168.68.143:8089

    Windows Agent Install


    Download the OSSEC agent from
    – https://updates.atomicorp.com/channels/atomic/windows/ossec-agent-win32-
    3.6.0-12032.exe
    Open the command prompt and ssh to your ossec server.

    ssh hgadmin@192.168.68.123
    launch the OSSEC Agent Manager

    sudo /var/ossec/bin/manage_agents
    Input option (A) to add a new agent. Input your windows machines name when
    prompted.

    Input the windows machines IP when prompted and confirm adding with responding
    (y)
    Launch the executable agent file you have downloaded as administrator. Should be
    in your downloads folder.

    Open the OSSEC agent as administrator that you installed and enter the IP address
    of your OSSEC server.
    Open the command prompt window that you used to ssh to the OSSEC server.
    Extract the Key by inputting option (e) and then the corresponding Agent ID for the
    windows machine in the OSSEC Agent Manager that should still be open.

    Highlight and copy the key, update the OSSEC Agent. Save the updated info and
    start the OSSEC Agent.



    Open your web browser and navigate to your OSSEC Servers IP and specific port if
    you set one.

    —– Guide Ends Here —–

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy