—– Guide Starts Here —–
urls used:
OSSEC Server/Agent – https://github.com/ossec/ossec-hids/archive/3.6.0.tar.gz
OSSEC Windows Agent – https://updates.atomicorp.com/channels/atomic/windows/ossec-agent-win32-3.6.0-12032.exe
Start with installing some packages on Ubuntu 20.04.
ssh to your ubuntu 20.04 server
$ ssh yoursuser@yourserverip
$ sudo apt update && sudo apt upgrade
$ sudo apt install -y php php-cli php-common libapache2-mod-php apache2-utils sendmail inotify-tools apache2 build-essential gcc make wget tar zlib1g-dev libpcre2-dev libpcre3-dev unzip libz-dev libssl-dev libpcre2-dev libevent-dev build-essential
Enter you password when prompted.
$ sudo systemctl enable apache2
$ sudo systemctl start apache2
$ sudo a2enmod rewrite
$ sudo systemctl restart apache2
OSSEC Install
$ wget https://github.com/ossec/ossec-hids/archive/3.6.0.tar.gz
$ sudo tar -xvzf 3.6.0.tar.gz
$ sudo /home/hgadmin/ossec-hids-3.6.0/install.sh
Provide your preferred input as prompted. For the demo we opted for the below:
Installing the Web User Interface.
$cd /tmp/
$ sudo git clone https://github.com/ossec/ossec-wui.git
$ sudo mv /tmp/ossec-wui /var/www/html
$ cd /var/www/html/ossec-wui
$ sudo ./setup.sh
When prompted enter your chosen username and password. For the web server name enter www-data.
Set Permissions
$ sudo chown -R www-data:www-data /var/www/html/ossec-wui/
$ sudo chmod -R 755 /var/www/html/ossec-wui/
Restart Apache and launch Web User Interface
$ sudo systemctl restart apache2
Open browser and navigate to http://your-servers-ip/ossec-wui
Configure WUI port to :8090
One way to change the WUI port is to edit the 000-default.conf file.
vi /etc/apache2/sites-enabled/000-default.conf
Add the following to the file
<VirtualHost *:8090>
DocumentRoot /var/www/html/ossec-wui
</VirtualHost>
Edit the /etc/apache2/ports.conf file and add the port you specified. In our case 8090.
sudo vi /etc/apache2/ports.conf
Restart apache and test.
sudo systemctl restart apache2
Open your browser to http://your-ip-address:your-port / http://192.168.68.143:8089
Windows Agent Install
Download the OSSEC agent from – https://updates.atomicorp.com/channels/atomic/windows/ossec-agent-win32-3.6.0-12032.exe
Open the command prompt and ssh to your ossec server.
ssh hgadmin@192.168.68.123
launch the OSSEC Agent Manager
sudo /var/ossec/bin/manage_agents
Input option (A) to add a new agent. Input your windows machines name when prompted.
Input the windows machines IP when prompted and confirm adding with responding (y)
Launch the executable agent file you have downloaded as administrator. Should be in your downloads folder.
Open the OSSEC agent as administrator that you installed and enter the IP address of your OSSEC server.
Open the command prompt window that you used to ssh to the OSSEC server. Extract the Key by inputting option (e) and then the corresponding Agent ID for the windows machine in the OSSEC Agent Manager that should still be open.
Highlight and copy the key, update the OSSEC Agent. Save the updated info and start the OSSEC Agent.
Open your web browser and navigate to your OSSEC Servers IP and specific port if you set one.
—– Guide Ends Here —–