vagrant up
cd /tmp/ossec-hids-3.1.0
sudo sh install.sh
1- What kind of installation do you want (server, agent, local, hybrid or help)? server
/tmp/ossec-hids-3.1.0$ sudo /var/ossec/bin/ossec-control start
Starting OSSEC HIDS v3.1.0 (by Trend Micro Inc.)...
Started ossec-maild...
Started ossec-execd...
Started ossec-analysisd...
Started ossec-logcollector...
Started ossec-remoted...
Started ossec-syscheckd...
Started ossec-monitord...
Completed.
/tmp/ossec-hids-3.1.0$ sudo ls /var/ossec/etc/ossec.conf
/var/ossec/etc/ossec.conf
/tmp/ossec-hids-3.1.0$ sudo ls /var/ossec/rules/local_rules.xml
/var/ossec/rules/local_rules.xml
/tmp/ossec-hids-3.1.0$ sudo /var/ossec/bin/ossec-control restart
Deleting PID file '/var/ossec/var/run/ossec-remoted-1157.pid' not used...
Killing ossec-monitord ..
Killing ossec-logcollector ..
ossec-remoted not running ..
Killing ossec-syscheckd ..
Killing ossec-analysisd ..
Killing ossec-maild ..
Killing ossec-execd ..
OSSEC HIDS v3.1.0 Stopped
Starting OSSEC HIDS v3.1.0 (by Trend Micro Inc.)...
Started ossec-maild...
Started ossec-execd...
Started ossec-analysisd...
Started ossec-logcollector...
Started ossec-remoted...
Started ossec-syscheckd...
Started ossec-monitord...
Completed.
$ ls -l /tmp/
drwxrwxr-x 7 root root 4096 Oct 11 2018 ossec-hids-3.1.0
drwxr-xr-x 8 root root 4096 Nov 26 08:58 ossec-wui-master
$ sudo cp -r ossec-wui-master /var/www/html/ossec
:/tmp$ cd /var/www/html/ossec
:/var/www/html/ossec$ sudo ./setup.sh
/var/www/html/ossec$ sudo ./setup.sh
trap: SIGHUP: bad trap
Setting up ossec ui...
Username: ossecadmin
New password:
Re-type new password:
Adding password for user ossecadmin
Enter your web server user name (e.g. apache, www, nobody, www-data, ...)
www-data
You must restart your web server after this setup is done.
Setup completed successfully.
<http://192.168.21.9/ossec>
vagrant@vg-ossec-02:/tmp/ossec-hids-3.1.0$ sudo ./install.sh
1- What kind of installation do you want (server, agent, local, hybrid or help)? agent
3.1- What's the IP Address or hostname of the OSSEC HIDS server?: 192.168.21.9
Add Ossec Agent to the OSSEC Server
vagrant@vg-ossec-01:~$ sudo /var/ossec/bin/manage_agents
****************************************
* OSSEC HIDS v3.1.0 Agent manager. *
* The following options are available: *
****************************************
(A)dd an agent (A).
(E)xtract key for an agent (E).
(L)ist already added agents (L).
(R)emove an agent (R).
(Q)uit.
Choose your action: A,E,L,R or Q: A
- Adding a new agent (use '\q' to return to the main menu).
Please provide the following:
* A name for the new agent: vg-ossec-02
* The IP Address of the new agent: 192.168.21.10
* An ID for the new agent[001]:
Agent information:
ID:001
Name:vg-ossec-02
IP Address:192.168.21.10
Confirm adding it?(y/n): y
Agent added.
****************************************
* OSSEC HIDS v3.1.0 Agent manager. *
* The following options are available: *
****************************************
(A)dd an agent (A).
(E)xtract key for an agent (E).
(L)ist already added agents (L).
(R)emove an agent (R).
(Q)uit.
Choose your action: A,E,L,R or Q: E
Available agents:
ID: 001, Name: vg-ossec-02, IP: 192.168.21.10
Provide the ID of the agent to extract the key (or '\q' to quit): 001
Agent key information for '001' is:
MDAxIHZnLW9zc2VjLTAyIDE5Mi4xNjguMjEuMTAgNTQyYjg1NzgwMmNhOWM0YmFiYjRkY2RlMWM5ZjNlNWYwYTRjMjY5NDM3N2I5OTlkMTA2YTgzMGZjZGFlMzMxZQ==
Import Key from OSSEC Server
vagrant@vg-ossec-02:/tmp/ossec-hids-3.1.0$ sudo /var/ossec/bin/manage_agents
****************************************
* OSSEC HIDS v3.1.0 Agent manager. *
* The following options are available: *
****************************************
(I)mport key from the server (I).
(Q)uit.
Choose your action: I or Q: I
* Provide the Key generated by the server.
* The best approach is to cut and paste it.
*** OBS: Do not include spaces or new lines.
Paste it here (or '\q' to quit): MDAxIHZnLW9zc2VjLTAyIDE5Mi4xNjguMjEuMTAgNTQyYjg1NzgwMmNhOWM0YmFiYjRkY2RlMWM5ZjNlNWYwYTRjMjY5NDM3N2I5OTlkMTA2YTgzMGZjZGFlMzMxZQ==
Agent information:
ID:001
Name:vg-ossec-02
IP Address:192.168.21.10
Confirm adding it?(y/n): y
Added.
** Press ENTER to return to the main menu
****************************************
* OSSEC HIDS v3.1.0 Agent manager. *
* The following options are available: *
****************************************
(I)mport key from the server (I).
(Q)uit.
Choose your action: I or Q: Q
** You must restart OSSEC for your changes to take effect.
manage_agents: Exiting.
vagrant@vg-ossec-02:/tmp/ossec-hids-3.1.0$ sudo /var/ossec/bin/ossec-control restart
ossec-logcollector not running ..
ossec-syscheckd not running ..
ossec-agentd not running ..
ossec-execd not running ..
OSSEC HIDS v3.1.0 Stopped
Starting OSSEC HIDS v3.1.0 (by Trend Micro Inc.)...
Started ossec-execd...
2019/11/26 09:39:35 ossec-agentd: INFO: Using notify time: 600 and max time to reconnect: 1800
Started ossec-agentd...
Started ossec-logcollector...
Started ossec-syscheckd...
Completed.
vagrant@vg-ossec-01:~$ sudo /var/ossec/bin/ossec-control restart
Killing ossec-monitord ..
Killing ossec-logcollector ..
Killing ossec-remoted ..
Killing ossec-syscheckd ..
Killing ossec-analysisd ..
Killing ossec-maild ..
Killing ossec-execd ..
OSSEC HIDS v3.1.0 Stopped
Starting OSSEC HIDS v3.1.0 (by Trend Micro Inc.)...
Started ossec-maild...
Started ossec-execd...
Started ossec-analysisd...
Started ossec-logcollector...
Started ossec-remoted...
Started ossec-syscheckd...
Started ossec-monitord...
Completed.
vagrant@vg-ossec-01:~$ sudo /var/ossec/bin/list_agents -c
vg-ossec-02-192.168.21.10 is active.
<http://192.168.21.9/ossec>