From 5e6a573b5acb43f5f6f8432b6f49ec9e08463fe8 Mon Sep 17 00:00:00 2001 From: Mario Preksavec Date: Fri, 14 Oct 2016 13:45:14 +0700 Subject: system/ossec-local: Added (Open Source Host-based IDS). Signed-off-by: Willy Sudiarto Raharjo --- system/ossec-local/README | 3 + system/ossec-local/README.SLACKWARE | 15 ++ system/ossec-local/doinst.sh | 29 ++++ system/ossec-local/ossec-local.SlackBuild | 152 ++++++++++++++++++++ system/ossec-local/ossec-local.conf | 229 ++++++++++++++++++++++++++++++ system/ossec-local/ossec-local.info | 10 ++ system/ossec-local/ossec.logrotate | 5 + system/ossec-local/slack-desc | 19 +++ 8 files changed, 462 insertions(+) create mode 100644 system/ossec-local/README create mode 100644 system/ossec-local/README.SLACKWARE create mode 100644 system/ossec-local/doinst.sh create mode 100644 system/ossec-local/ossec-local.SlackBuild create mode 100644 system/ossec-local/ossec-local.conf create mode 100644 system/ossec-local/ossec-local.info create mode 100644 system/ossec-local/ossec.logrotate create mode 100644 system/ossec-local/slack-desc (limited to 'system') diff --git a/system/ossec-local/README b/system/ossec-local/README new file mode 100644 index 0000000000..955a80fcad --- /dev/null +++ b/system/ossec-local/README @@ -0,0 +1,3 @@ +OSSEC is an Open Source Host-based Intrusion Detection System that performs log +analysis, file integrity checking, policy monitoring, rootkit detection, +real-time alerting and active response. diff --git a/system/ossec-local/README.SLACKWARE b/system/ossec-local/README.SLACKWARE new file mode 100644 index 0000000000..e07808bfc6 --- /dev/null +++ b/system/ossec-local/README.SLACKWARE @@ -0,0 +1,15 @@ +You may wish to add these lines to /etc/rc.d/rc.local to start the service: + +if [ -x /etc/rc.d/rc.ossec ]; then + /etc/rc.d/rc.ossec start +fi + +You may also add these lines to /etc/rc.d/rc.local_shutdown: + +if [ -x /etc/rc.d/rc.ossec ]; then + /etc/rc.d/rc.ossec stop +fi + +Remember to give executable permission to /etc/rc.d/rc.local_shutdown: + + chmod 0755 /etc/rc.d/rc.local_shutdown diff --git a/system/ossec-local/doinst.sh b/system/ossec-local/doinst.sh new file mode 100644 index 0000000000..a68e4ea3a2 --- /dev/null +++ b/system/ossec-local/doinst.sh @@ -0,0 +1,29 @@ +config() { + NEW="$1" + OLD="$(dirname $NEW)/$(basename $NEW .new)" + # If there's no config file by that name, mv it over: + if [ ! -r $OLD ]; then + mv $NEW $OLD + elif [ "$(cat $OLD | md5sum)" = "$(cat $NEW | md5sum)" ]; then + # toss the redundant copy + rm $NEW + fi + # Otherwise, we leave the .new copy for the admin to consider... +} + +preserve_perms() { + NEW="$1" + OLD="$(dirname $NEW)/$(basename $NEW .new)" + if [ -e $OLD ]; then + cp -a $OLD ${NEW}.incoming + cat $NEW > ${NEW}.incoming + mv ${NEW}.incoming $NEW + fi + config $NEW +} + +preserve_perms etc/rc.d/rc.ossec.new +config etc/ossec-init.conf.new +config etc/logrotate.d/ossec.new +find var/ossec/etc var/ossec/rules -type f -name '*.new' \ + | while read new ; do config $new ; done diff --git a/system/ossec-local/ossec-local.SlackBuild b/system/ossec-local/ossec-local.SlackBuild new file mode 100644 index 0000000000..b7047d6e92 --- /dev/null +++ b/system/ossec-local/ossec-local.SlackBuild @@ -0,0 +1,152 @@ +#!/bin/sh + +# Slackware build script for ossec-local + +# Copyright 2016 Mario Preksavec, Zagreb, Croatia +# All rights reserved. +# +# Redistribution and use of this script, with or without modification, is +# permitted provided that the following conditions are met: +# +# 1. Redistributions of this script must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO +# EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; +# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF +# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +PRGNAM=ossec-local +VERSION=${VERSION:-2.9rc3} +BUILD=${BUILD:-1} +TAG=${TAG:-_SBo} + +SRCNAM=ossec-hids + +if [ -z "$ARCH" ]; then + case "$( uname -m )" in + i?86) ARCH=i586 ;; + arm*) ARCH=arm ;; + *) ARCH=$( uname -m ) ;; + esac +fi + +CWD=$(pwd) +TMP=${TMP:-/tmp/SBo} +PKG=$TMP/package-$PRGNAM +OUTPUT=${OUTPUT:-/tmp} + +if [ "$ARCH" = "i586" ]; then + SLKCFLAGS="-O2 -march=i586 -mtune=i686" + LIBDIRSUFFIX="" +elif [ "$ARCH" = "i686" ]; then + SLKCFLAGS="-O2 -march=i686 -mtune=i686" + LIBDIRSUFFIX="" +elif [ "$ARCH" = "x86_64" ]; then + SLKCFLAGS="-O2 -fPIC" + LIBDIRSUFFIX="64" +else + SLKCFLAGS="-O2" + LIBDIRSUFFIX="" +fi + +USERID=${USERID:-333} +USERID_MAIL=${USERID_MAIL:-334} +USERID_REMOTE=${USERID_REMOTE:-335} +GROUPID=${GROUPID:-333} + +if ! grep ^ossec: /etc/group 2>&1 > /dev/null \ +|| ! grep -E '^(ossec|ossecm|ossecr):' /etc/passwd 2>&1 > /dev/null; then + echo -e "\n You must have ossec users and a group to run this script\n" +fi + +if ! grep ^ossec: /etc/group 2>&1 > /dev/null; then + echo " # groupadd -g $GROUPID ossec" +fi + +if ! grep ^ossec: /etc/passwd 2>&1 > /dev/null; then + echo " # useradd -u $USERID -d /var/ossec -s /bin/false -g ossec ossec" + echo " # passwd -l ossec" +fi + +if ! grep ^ossecm: /etc/passwd 2>&1 > /dev/null; then + echo " # useradd -u $USERID_MAIL -d /var/ossec -s /bin/false -g ossec ossecm" + echo " # passwd -l ossecm" +fi + +if ! grep ^ossecr: /etc/passwd 2>&1 > /dev/null; then + echo " # useradd -u $USERID_REMOTE -d /var/ossec -s /bin/false -g ossec ossecr" + echo " # passwd -l ossecr" +fi + +if ! grep ^ossec: /etc/group 2>&1 > /dev/null \ +|| ! grep -E '^(ossec|ossecm|ossecr):' /etc/passwd 2>&1 > /dev/null; then + echo + exit +fi + +set -e + +rm -rf $PKG +mkdir -p $TMP $PKG $OUTPUT +cd $TMP +rm -rf $SRCNAM-$VERSION +tar xvf $CWD/$SRCNAM-$VERSION.tar.gz +cd $SRCNAM-$VERSION +chown -R root:root . +find -L . \ + \( -perm 777 -o -perm 775 -o -perm 750 -o -perm 711 -o -perm 555 \ + -o -perm 511 \) -exec chmod 755 {} \; -o \ + \( -perm 666 -o -perm 664 -o -perm 640 -o -perm 600 -o -perm 444 \ + -o -perm 440 -o -perm 400 \) -exec chmod 644 {} \; + +# Makefile fixes +sed -e 's|\(./init/adduser.sh.*\)|#\1|' \ + -e 's|\(DEFINES+=-DDEFAULTDIR=\).*|\1\\"/var/ossec\\"|' \ + -i src/Makefile + +# There is no configure script and install.sh is a bit limited +( cd src + make PREFIX=$PKG/var/ossec TARGET=local build + make PREFIX=$PKG/var/ossec TARGET=local install +) + +# Prepare system /etc +mkdir -p $PKG/etc/{logrotate.d,rc.d} +cat << EOF > $PKG/etc/ossec-init.conf.new +DIRECTORY="/var/ossec" +VERSION="$(cat src/VERSION)" +DATE="$(date)" +TYPE="local" +EOF +chmod 600 $PKG/etc/ossec-init.conf.new +cat src/init/ossec-hids.init > $PKG/etc/rc.d/rc.ossec.new +cat $CWD/ossec.logrotate > $PKG/etc/logrotate.d/ossec.new + +# Stock ossec.conf is just an example - we prefer our own +mv $PKG/var/ossec/etc/ossec.conf $PKG/var/ossec/etc/ossec.conf.example +cat $CWD/ossec-local.conf > $PKG/var/ossec/etc/ossec.conf.new +chmod 640 $PKG/var/ossec/etc/ossec.conf.new +chown root:ossec $PKG/var/ossec/etc/ossec.conf.new +for i in $PKG/var/ossec/etc/*.{conf,keys,xml} ; do mv $i $i.new ; done +mv $PKG/var/ossec/rules/local_rules.xml $PKG/var/ossec/rules/local_rules.xml.new + +find $PKG -print0 | xargs -0 file | grep -e "executable" -e "shared object" | grep ELF \ + | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null || true + +mkdir -p $PKG/usr/doc/$PRGNAM-$VERSION +cp -a BUGS CHANGELOG CONFIG CONTRIBUTORS LICENSE README.md doc/{*.txt,README.*} \ + $CWD/README.SLACKWARE $PKG/usr/doc/$PRGNAM-$VERSION +cat $CWD/$PRGNAM.SlackBuild > $PKG/usr/doc/$PRGNAM-$VERSION/$PRGNAM.SlackBuild + +mkdir -p $PKG/install +cat $CWD/slack-desc > $PKG/install/slack-desc + +cd $PKG +/sbin/makepkg -l y -c n $OUTPUT/$PRGNAM-$VERSION-$ARCH-$BUILD$TAG.${PKGTYPE:-tgz} diff --git a/system/ossec-local/ossec-local.conf b/system/ossec-local/ossec-local.conf new file mode 100644 index 0000000000..9e7ca62e6b --- /dev/null +++ b/system/ossec-local/ossec-local.conf @@ -0,0 +1,229 @@ + + + + + + no + root@example.com + smtp.example.com + ossecm@ossec.example.com + + + + rules_config.xml + pam_rules.xml + sshd_rules.xml + telnetd_rules.xml + syslog_rules.xml + arpwatch_rules.xml + symantec-av_rules.xml + symantec-ws_rules.xml + pix_rules.xml + named_rules.xml + smbd_rules.xml + vsftpd_rules.xml + pure-ftpd_rules.xml + proftpd_rules.xml + ms_ftpd_rules.xml + ftpd_rules.xml + hordeimp_rules.xml + roundcube_rules.xml + wordpress_rules.xml + cimserver_rules.xml + vpopmail_rules.xml + vmpop3d_rules.xml + courier_rules.xml + web_rules.xml + web_appsec_rules.xml + apache_rules.xml + nginx_rules.xml + php_rules.xml + mysql_rules.xml + postgresql_rules.xml + ids_rules.xml + squid_rules.xml + firewall_rules.xml + apparmor_rules.xml + cisco-ios_rules.xml + netscreenfw_rules.xml + sonicwall_rules.xml + postfix_rules.xml + sendmail_rules.xml + imapd_rules.xml + mailscanner_rules.xml + dovecot_rules.xml + ms-exchange_rules.xml + racoon_rules.xml + vpn_concentrator_rules.xml + spamd_rules.xml + msauth_rules.xml + mcafee_av_rules.xml + trend-osce_rules.xml + ms-se_rules.xml + + zeus_rules.xml + solaris_bsm_rules.xml + vmware_rules.xml + ms_dhcp_rules.xml + asterisk_rules.xml + ossec_rules.xml + attack_rules.xml + systemd_rules.xml + firewalld_rules.xml + dropbear_rules.xml + unbound_rules.xml + sysmon_rules.xml + opensmtpd_rules.xml + local_rules.xml + + + + + 72000 + + + /etc,/usr/bin,/usr/sbin + /bin,/sbin,/boot + + + /etc/mtab + /etc/hosts.deny + /etc/mail/statistics + /etc/random-seed + /etc/adjtime + /etc/ntp/drift + + + + /var/ossec/etc/shared/rootkit_files.txt + /var/ossec/etc/shared/rootkit_trojans.txt + /var/ossec/etc/shared/system_audit_rcl.txt + /var/ossec/etc/shared/cis_debian_linux_rcl.txt + /var/ossec/etc/shared/cis_rhel_linux_rcl.txt + /var/ossec/etc/shared/cis_rhel5_linux_rcl.txt + /var/ossec/etc/shared/cis_rhel6_linux_rcl.txt + /var/ossec/etc/shared/cis_rhel7_linux_rcl.txt + + + + 127.0.0.1 + ::1 + + + + 1 + 7 + + + + host-deny + host-deny.sh + srcip + yes + + + + firewall-drop + firewall-drop.sh + srcip + yes + + + + disable-account + disable-account.sh + user + yes + + + + + + host-deny + local + 6 + 600 + + + + + firewall-drop + local + 6 + 600 + + + + + + syslog + /var/log/messages + + + + syslog + /var/log/syslog + + + + syslog + /var/log/debug + + + + syslog + /var/log/secure + + + + syslog + /var/log/cron + + + + syslog + /var/log/maillog + + + + syslog + /var/log/spooler + + + + apache + /var/log/httpd/access_log + + + + apache + /var/log/httpd/error_log + + + + command + df -h + + + + full_command + netstat -tan | grep LISTEN | grep -v 127.0.0.1 | sort + + + + full_command + last -n 5 + + + + full_command + lastb -n 5 + + diff --git a/system/ossec-local/ossec-local.info b/system/ossec-local/ossec-local.info new file mode 100644 index 0000000000..8323b29212 --- /dev/null +++ b/system/ossec-local/ossec-local.info @@ -0,0 +1,10 @@ +PRGNAM="ossec-local" +VERSION="2.9rc3" +HOMEPAGE="http://ossec.github.io/" +DOWNLOAD="https://github.com/ossec/ossec-hids/archive/2.9rc3/ossec-hids-2.9rc3.tar.gz" +MD5SUM="a4ce5872f32c0ab045215017198eb5a3" +DOWNLOAD_x86_64="" +MD5SUM_x86_64="" +REQUIRES="" +MAINTAINER="Mario Preksavec" +EMAIL="mario at slackware dot hr" diff --git a/system/ossec-local/ossec.logrotate b/system/ossec-local/ossec.logrotate new file mode 100644 index 0000000000..7b6406819f --- /dev/null +++ b/system/ossec-local/ossec.logrotate @@ -0,0 +1,5 @@ +/var/ossec/logs/active-responses.log /var/ossec/logs/ossec.log { + missingok + notifempty + copytruncate +} diff --git a/system/ossec-local/slack-desc b/system/ossec-local/slack-desc new file mode 100644 index 0000000000..d16002cea0 --- /dev/null +++ b/system/ossec-local/slack-desc @@ -0,0 +1,19 @@ +# HOW TO EDIT THIS FILE: +# The "handy ruler" below makes it easier to edit a package description. +# Line up the first '|' above the ':' following the base package name, and +# the '|' on the right side marks the last column you can put a character in. +# You must make exactly 11 lines for the formatting to be correct. It's also +# customary to leave one space after the ':' except on otherwise blank lines. + + |-----handy-ruler------------------------------------------------------| +ossec-local: ossec-local (Open Source Host-based Intrusion Detection System) +ossec-local: +ossec-local: OSSEC is an Open Source Host-based Intrusion Detection System that +ossec-local: performs log analysis, file integrity checking, policy monitoring, +ossec-local: rootkit detection, real-time alerting and active response. +ossec-local: +ossec-local: Homepage: http://ossec.github.io/ +ossec-local: +ossec-local: +ossec-local: +ossec-local: -- cgit v1.2.3