Wazuh - Revision history

Maltfield: add link to logs

2024-09-22T23:19:40Z

add link to logs

← Older revision		Revision as of 23:19, 22 September 2024
Line 16:		Line 16:
	==Add user to email list==		==Add user to email list==

	Because ~~OSSEC~~ alerts can contain sensitive information (it may spit out lines from our config files, such as the contents of a diff after we change a password), its email alerts are necessarily encrypted with gpg.		Because Wazuh alerts can contain sensitive information (it may spit out lines from our config files, such as the contents of a diff after we change a password), its email alerts are necessarily encrypted with gpg.

	The below commands are an example of how to add Marcin to the list of recipients for ~~OSSEC~~ alerts		The below commands are an example of how to add Marcin to the list of recipients for Wazuh alerts

	<pre>		<pre>
Line 106:		Line 106:

	# add marcin's email (that matches an email on a UID of his key above) to the space-delimited "recipients" variable		# add marcin's email (that matches an email on a UID of his key above) to the space-delimited "recipients" variable
	vim /var/ossec/sent_encrypted_alarm.sh		vim /var/ossec/sent_encrypted_alarm.settings
	</pre>		</pre>

	For more information on how we configured ~~OSSEC~~ to use gpg, please see:		For more information on how we configured Wazuh to use gpg, please see:

	* http://jeroenvda.eu/2012/06/01/how-to-encrypt-ossec-email-alerts/		* http://jeroenvda.eu/2012/06/01/how-to-encrypt-ossec-email-alerts/
Line 115:		Line 115:
	==See Also==		==See Also==
	* [[OSE Server]]		* [[OSE Server]]
			* [[Maltfield_Log/2024_Q3#Sun_Sep_15.2C_2024]]

	[[Category: IT Infrastructure]]		[[Category: IT Infrastructure]]
	[[Category: Software]]		[[Category: Software]]

Maltfield: updated file list

2024-09-22T23:15:44Z

updated file list

← Older revision		Revision as of 23:15, 22 September 2024
Line 1:		Line 1:
	OSE uses ~~OSSEC~~ as a host-based intrusion detection system + file integrity monitor on our [[OSE Server]].		OSE uses Wazuh as a host-based intrusion detection system + file integrity monitor on our [[OSE Server]].

			Wazuh is a fork replacement of OSSEC.

	==Important Files & Directories==		==Important Files & Directories==
Line 5:		Line 7:
	# /var/ossec		# /var/ossec
	# /var/ossec/sent_encrypted_alarm.sh		# /var/ossec/sent_encrypted_alarm.sh
			# /var/ossec/sent_encrypted_alarm.settings
	# /var/ossec/.gnupg		# /var/ossec/.gnupg
			# /var/ossec/.forward
	# /etc/postfix/main.cf		# /etc/postfix/main.cf
	# /var/ossec/etc/ossec.conf		# /var/ossec/etc/ossec.conf

Maltfield: Maltfield moved page Ossec to Wazuh: OSSEC was forked to create Wazuh. We use Wazuh now.

2024-09-22T23:14:07Z

Maltfield moved page Ossec to Wazuh: OSSEC was forked to create Wazuh. We use Wazuh now.

← Older revision	Revision as of 23:14, 22 September 2024
(No difference)

Maltfield: /* Important Files & Directories */

2018-05-30T17:50:45Z

Important Files & Directories

← Older revision		Revision as of 17:50, 30 May 2018
Line 2:		Line 2:

	==Important Files & Directories==		==Important Files & Directories==

			# /var/ossec
			# /var/ossec/sent_encrypted_alarm.sh
			# /var/ossec/.gnupg
			# /etc/postfix/main.cf
			# /var/ossec/etc/ossec.conf
			# /var/ossec/rules/local_rules.xml

	==Add user to email list==		==Add user to email list==

Maltfield at 17:47, 30 May 2018

2018-05-30T17:47:05Z

← Older revision		Revision as of 17:47, 30 May 2018
Line 97:		Line 97:
	vim /var/ossec/sent_encrypted_alarm.sh		vim /var/ossec/sent_encrypted_alarm.sh
	</pre>		</pre>

			For more information on how we configured OSSEC to use gpg, please see:

			* http://jeroenvda.eu/2012/06/01/how-to-encrypt-ossec-email-alerts/

	==See Also==		==See Also==

Maltfield: Created page with "OSE uses OSSEC as a host-based intrusion detection system + file integrity monitor on our OSE Server. ==Important Files & Directories== ==Add user to email list== Becau..."

2018-05-30T17:45:55Z

Created page with "OSE uses OSSEC as a host-based intrusion detection system + file integrity monitor on our OSE Server. ==Important Files & Directories== ==Add user to email list== Becau..."

New page

OSE uses OSSEC as a host-based intrusion detection system + file integrity monitor on our [[OSE Server]].

==Important Files & Directories==

==Add user to email list==

Because OSSEC alerts can contain sensitive information (it may spit out lines from our config files, such as the contents of a diff after we change a password), its email alerts are necessarily encrypted with gpg.

The below commands are an example of how to add Marcin to the list of recipients for OSSEC alerts

<pre>
mkdir -p /var/tmp/gpg
pushd /var/tmp/gpg
# write multi-line to file for documentation copy & paste
cat << EOF > /var/tmp/gpg/marcin.pubkey2.asc
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1

mQINBFsDbMMBEACypyMZ/J9+M1DvNd+EGhIpRXEKH5WldOXlZtJAh1tGH5cvqBwR
QDCCyVAA+WsiE0IQJByrpxPbj25ypPSMcyhJYmmDOa/0R/NdVuBgJNmWFSyfB/aU
dKAC3brLMC8zUffieug0bVE6vI8QE/DUAGKU5AyNFOD3itFGgI7HtlaknU9ql7um
VxrOM7VU/GmqZcg5hqno6r1mhiG9boitM10lSav+Hylv3Es01pLUvy/NlJEZ10lZ
rQ8RHIQSTpxj9C9L32DjvcJ8BfIHzr6aY/xv5tbPDJuLgsPgn6EoUZkNQAyPMV8J
8MT26UmwlA0WvMkHJze+kgsXD5FUk7MuZM5ttEHKsngN5Sim1M+dBnUtg6QG4zpf
KhyVOOpag1L3iyCwGMbRIX8cTk2Hk39Csf37QKDUrHMbDqAOcQzpr6YcbEO/PPXW
u2VQDJfuiWrgQI7v+ac8uAlH66c6MmEqtsduxVmUYK1C7LlDmcswa4kOP/5WkpJ8
kFwicIM/qpZgewpjtD+ATADs0knA+D+MBQSoMI6FhCLLytz2JpIEtHJFDvDuV/7Q
Yi+RDyFqNr+i7rkNe/xpb5lzrLutN7JEYeMn+LsPH6Ucd8mGJ7j88c0OZUidkOu5
KErG4xHqee87B+Et0/LfEABogDAPnqH027tCMXHu8g2Ih8kZnglEnNeP6wARAQAB
tDBNYXJjaW4gSmFrdWJvd3NraSA8bWFyY2luQG9wZW5zb3VyY2VlY29sb2d5Lm9y
Zz6JAj0EEwEIACcFAlsDbMMCGwMFCRLMAwAFCwkIBwIGFQgJCgsCBBYCAwECHgEC
F4AACgkQ186EWruNpsEEGg//f195qc3hJcyon9Rq+tH7yp8hJN+Pcy3WBnj0Amvg
fPYGR1W5qbCnd9NPdcAz8J1H1Hsbz9+zYDlhIp71iuTlNvtT821du9bLwqplN9UI
YNkRAYm/kwd2qAYNPdVKW0lY9OhvyZA5XrjyQQxVtzQmuB0kTrzX1Br6ZWnMNavd
X2yhfbxJY71HbETMw/VLBubbl8RwpZGzXqye23Il8SryicDk9oIXF6uExB4Ym7PJ
3+h4Sn9dvAQOEsjl57r/ZHNctb4VLqJfVo12ba2XxTx0TGrdYGbiONHu9P2u+Zwj
+NlGmKq2+h2V4pdfl5buj90NtdV3GjJ6wBiBZ0sAO0tKIAp1PWP+Ayo9ep2G8H4A
R8WMJZ6VaXw54C2gLlyzwrsZztqBWljfL8tHtCyOKjN1YJuucn2pzEz/ENTOC3cn
SNzBTXSi/fJBaBgbueMtDE1j0VWjfcm+zIkMfcjUoN+w7gQGEQGc/myvDnEIevcy
ITlejx2MnCj3cjkKrOUXct+3pJwWuxFFfWtOUF91cgAd+FrVw7kQSNfS7T4X7jVO
frVpAXthQaSJIDas5ZqnBlkCdkF+4Oj8IbpV0RUHNIOy0XXJqb6Z3YVUjQdT+Dup
4wmz6dlNdNWfP0iyo6OOuphz+Tz9ZkPDfLXznR+tz62PB/oeHxE0S/zWDXTeyqWp
RyWJAhwEEwEKAAYFAlsDgiEACgkQ/huESU5kDUH+1g//ZoS0E9R6pKfvVBTnuphW
gmCuAgGXAxdMioCYYNqn+jGyy6XdDKcsVATJT0pwctMhkAxEajafzaoBC1/pellh
vO3c7088/BMzRJYSTHeAANd2qctK00ZZZ149T41TedfGaYOEJSNWyjXAZeOM8dlb
qLRkFVf2Zo4rG6ij55ywLS7Cqv1TBMwWzx70gl0TnPxBhBj48Mr/JnhYRQVZtm5c
MiaTncwGJky2CCEXTJqYGT9wDe74w1GGZz5Png59rs6m/1mibdtQ1YbF9gX5pBoK
afpPVRLSISNKyB8PUVNf/2Uqckl1JQ95rcsgTqArcLWeBV4fIm18SfKglYRg2I2u
EP4Fz3oLHROQ6aTPzQgfRX7ZFI7w7lEwOSwQTgC0qjH+y+5a7/H/+wuXtfnuHBsu
nJikH2MzmccRdUQGNtZLJ5HBVpglV3OAMWbknmGOSWdPPaeD68hhOJlfaq51HA8/
ewav9VDPADL/GBy9zSadWRYLCbmkPaksvYdP0exndeLr/GMNsO/jsI/BBgbtG5EM
qc71SEJDjOe+T1/NuoPQiQwaHXgUNgB6/F33sByKPu56M2T+gctpQHg2dw6U7LAK
biE8Q3pCoIzz+2/AZd/+vpdzZ71qahBiOMmrGTJfkqWDar8DP+bXHLYDZBYpExPg
MB+w06S7CsNzrmhBiuysm++JAhwEEwEKAAYFAlsDgj4ACgkQqj7fcWDi2XvKphAA
j/H/atXb2fyN/VJ3tPQ0qsmv3ctDpMnazCwRksTZHzFhZdyi6mu8zlE+iK9SGr5L
PTc+jSK02JnuAQcnZHMNrov6wPPAaoRFDQ7Nv9LUmzVJPnxXuoFxF1akkr0cdxpZ
4nfcCIZS0i43RLWSKuFFz81Oy4Med8U9JXq/NxYw/a5D7PZ7flSSUDYrQwgOQtut
lCebOPb/iu6A87HJ+bhtQb7G7G68HkFmlATnjA0AmeM/+PQ8AR6YH5mbgQeWmPTq
XJdfBs5+AFyUw1zJPa5GPBa+96tqCjOrkxrwR/FCe1L2Q+BfkBRDDg2FA6/pekG4
kzAB++JH3Uai6PSgmifUDMsA++4oRGf7ALqoXnXwu4SOQ2vlrsPjAnV77us5JvdI
Wc346uzvcJAyFOmBuQqRKOOsgYpEj1Q5HKkDuZNLM8e89o0dTOwcm4e8BR00GN6+
OyC6D8U8T72kFv3WvW5HqiP5mmGZDBNWLaXFjLJBSUrFVw9OJWuisSbX6JoISE4Y
RFhzS/REKLn7LDvVvByI3wZF6GLbfKkdzZHoK0Fc4GFiVloDOC7iGiHV+cw2Ivwx
yhsdRciuH5yRnbNhekaNNFddcmq2K6QPLgbDIBX43eFmArRk/mLwyMyvhVQT1NuL
NqudMTihZeO10A4evHqHDmiYIi0cRf9OKct0S7bSwJm5Ag0EWwNswwEQAMcuLBNf
/iTsBnvrI7cD2S24pVGMowaPDWMD1PEfwdL7dHDA4hTnrJexXHxGTFLiKgwhTdCr
ZnBUNmL1CjoN2nO02MlFPcDNsPAa03KSF/IIpx1v/Y7yYN3eJX1nthQ3rPJnguEe
L7mgBYtGeKBBdTWGzfHYDYI8IaUP6Bhfc6Yj+a5NVh+NsObhX0IMoa/lQNLDlfav
tqdDgi7tMuf/Qyz1VvgpYYzXDq9KdipWssCHEDnIggdlJGemQyQMGuAil1TOC+S8
9D/IbOuo3Wa+YMIu7g6cX0jX8Lp0kBH6yNlmIXvvOzV8smOVwemTl8Lt/9hETJqx
aXL9j3DCoYVA87MAGcBD3EMFjQKwVLIWe84B8i5G44yD2DCHBNL/Qeq09klI5T5M
BAgYbNoKx130pf0jGD6dzdfDiMgclAuhz5VTkNh5RCu7rdVgHGQKm5f6sVXCuAfl
/f3Wv66lyCIHbb+LAxnG07bPHLGgHtrS+xRp7d+y7ezaTSmzcOs8lb1C6D/tJXyV
+64lgkTsLid3ljVsMMCRWdRyXYWMOPAt9krFIW6niYHokN5m5uB/l/Vad+PYJ8WA
Agpord+A2vSLliogO1BiDX5lcZmlFPSDDAlr5373KGoBSoYIXq6xcqsvkg3F4RCW
B5YEWgBiX9roXzZ7oMUUK7uhDixFMqAWmN+dABEBAAGJAiUEGAEIAA8FAlsDbMMC
GwwFCRLMAwAACgkQ186EWruNpsEHSw//dXXtuO5V6M+OZ5ArMj1vFudU57PNT+35
5prq6IIDCeRiTanpjIR3GuOGtK3D+4r6Nk1lCoG0CwFPUu7k51gsdkB9DRrRYKX5
fXkl8UC+e8dKo9bMS3jyY9nC7Mv1DPc4gx7VoZeXsxlqz60tEG3HWehLGt03z47C
5I9VVLkTvxt73VH9BHcZaScyPfn3kOlbBSW6U/6ZnRJQ6pc6xPxMsqo0OznYgU9k
YpkS6xwjqT7MYCw4DiW5kSIqNBRMl3suLUUvsJH4OOjilIt4Su+GxftrokmayRYr
XRP0k/Tnf7nrjPl7znbCFxEEVSezaQE2rxQCiKXkmvYzaPjJXZmPgz49oih24Tgn
Llk70qRoRXt2MkZG3TH/t755ORYl5BUeyhnPSzOD/1BiFJze7N+r5mGtJsdjBSyO
LEdjVzsLRhKvheDkrsbguiV8wjaHdfpdPUdYHnWs/HZ7e9HyGoGxaYPRzYosqTu5
pxgIs4c3Toy7nYQjINd/IhLCYL7UBT+ybNMzh15u63UYun37x4mbdkkx7TzZpXex
cnP2bJijq/TJD8PRJNY9GFd5fnluk6xpaFH1YAtQbe/YpTHP0xn45Hi91tsv7S7F
Tl5+BGflBcIQOF80tOHetUrtH3cjp/dtKCE5ZU5Vt9pxlvQeO+azOH1jXQ35vs2t
7VMKgjAEf/c=
=nvDm
-----END PGP PUBLIC KEY BLOCK-----
EOF
gpg --homedir /var/ossec/.gnupg --delete-key marcin
gpg --homedir /var/ossec/.gnupg --import /var/tmp/gpg/marcin.pubkey2.asc
popd

# add marcin's email (that matches an email on a UID of his key above) to the space-delimited "recipients" variable
vim /var/ossec/sent_encrypted_alarm.sh
</pre>

==See Also==
* [[OSE Server]]

[[Category: IT Infrastructure]]
[[Category: Software]]