O modo tradicional para configurar as chaves de autenticação dos agentes no Ossec server é sustentável até 5 servidores em média. Para facilitar esta tarefa Daniel Cid criou o daemon ossec-authd, responsável por gerenciar as chaves de autenticação dos agentes no servidor usando um certificado digital.
NO OSSEC SERVER
Execute os seguintes comandos para gerar o certificado:
#openssl genrsa -out /var/ossec/etc/sslmanager.key 2048
Generating RSA private key, 2048 bit long modulus
……………………………………………………………….+++
…………………………………………………………………………………………………………………..+++
e is 65537 (0x10001)
#openssl req -new -x509 -key /var/ossec/etc/sslmanager.key -out /var/ossec/etc/sslmanager.cert -days 365
—–
Country Name (2 letter code) [AU]:BR
State or Province Name (full name) [Some-State]:Bahia
Locality Name (eg, city) []:Salvador
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Alexos Core Labs
Organizational Unit Name (eg, section) []:IT
Common Name (eg, YOUR name) []:debian
Email Address []:alexos@acme.com
Inicie o ossec-authd
#/var/ossec/bin/ossec-authd -p 1515 >/dev/null 2>&1 &
#netstat -at | grep 1515
tcp 0 0 *:1515 *:* LISTEN
NO OSSEC AGENT
OBS: Antes de compilar o agente instale o pacote libssl-dev ( Debian ) ou openssl-dev ( CentOS ) evitando assim a mensagem erro abaixo.
ERROR: Not compiled. Missing OpenSSL support.
Execute o seguinte comando para iniciar a autenticação:
#/var/ossec/bin/agent-auth -m 192.168.0.1 -p 1515
2012/03/01 20:28:12 ossec-authd: INFO: Started (pid: 10988).INFO: Connected to 192.168.0.1:1515
INFO: Using agent name as: debian
INFO: Send request to manager. Waiting for reply.
INFO: Received response with agent key
INFO: Valid key created. Finished.
INFO: Connection closed.
Reinicie o servidor e o agente:
invoke-rc.d ossec restart ( Debian )
ou
service ossec restart ( CentOS )
Confirme a comunicação usando o agent_control no servidor
#/var/ossec/bin/agent_control -l
OSSEC HIDS agent_control. List of available agents:
ID: 000, Name: debian (server), IP: 127.0.0.1, Active/Local
ID: 1024, Name: debian, IP: any, Active