OSSEC Documentation Release 2.7.2b1 Jeremy Rossi January 29, 2014 Contents 1 Manual & FAQ 3 1.1 Manual..................................................3 1.2 Frequently asked questions........................................ 64 2 Reference 77 2.1 Syntax and Options............................................ 77 2.2 Man pages................................................ 115 2.3 Rules/Decoders Documentation..................................... 141 2.4 Rootcheck / Syscheck Reference..................................... 141 2.5 Log Samples............................................... 146 2.6 Glossary................................................. 243 3 Indices and tables 245 i ii OSSEC Documentation, Release 2.7.2b1 OSPatrol is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, OpenBSD, FreeBSD, Mac OS X, Solaris and Windows. A list with all supported platforms is available at: Supported Systems Contents 1 OSSEC Documentation, Release 2.7.2b1 2 Contents CHAPTER 1 Manual & FAQ 1.1 Manual 1.1.1 Getting started with OSPatrol OSPatrol is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS (host-based intrusion detection), log monitoring and SIM/SIEM together in a simple, powerful and open source solution. It is also backed and fully supported by Trend Micro. Key Benefits Compliance Requirements OSPatrol helps customers meet specific compliance requirements such as PCI, HIPAA etc. It lets customers detect and alert on unauthorized file system modifications and malicious behavior embedded in the log files of COTS products as well as custom applications. For PCI, it covers the sections of file integrity monitoring (PCI 11.5, 10.5), log inspection and monitoring (section 10) and policy enforcement/checking. Multi platform OSPatrol lets customers implement a comprehensive host based intrusion detection system with fine grained applica- tion/server specific policies across multiple platforms such as Linux, Solaris, AIX, BSD, Windows, Mac OS X and VMware ESX. Real-time and Configurable Alerts OSPatrol lets customers configure incidents they want to be alerted on which lets them focus on raising the priority of critical incidents over the regular noise on any system. Integration with smtp, sms and syslog allows customers to be on top of alerts by sending these on to e-mail and handheld devices such as cell phones and pagers. Active response options to block an attack immediately is also available. Integration with current infrastructure OSPatrol will integrate with current investments from customers such as SIM/SEM (Security Incident Manage- ment/Security Events Management) products for centralized reporting and correlation of events. 3 OSSEC Documentation, Release 2.7.2b1 Centralized management OSPatrol provides a simplified centralized management server to manage policies across multiple operating systems. Additionally, it also lets customers define server specific overrides for finer grained policies. Agent and agentless monitoring OSPatrol offers the flexibility of agent based and agentless monitoring of systems and networking components such as routers and firewalls. It lets customers who have restrictions on software being installed on systems (such as FDA approved systems or appliances) meet security and compliance needs. Key Features File Integrity checking There is one thing in common to any attack to your networks and computers: they change your systems in some way. The goal of file integrity checking (or FIM - file integrity monitoring) is to detect these changes and alert you when they happen. It can be an attack, or a misuse by an employee or even a typo by an admin, any file, directory or registry change will be alerted to you. Covers PCI DSS sections 11.5 and 10.5.5. Log Monitoring Your operating system wants to speak to you, but do you know how to listen? Every operating system, application, and device on your network generate logs (events) to let you know what is happening. OSPatrol collects, analyzes and correlates these logs to let you know if something wrong is going on (attack, misuse, errors, etc). Do you want to know when an application is installed on your client box? Or when someone changes a rule in your firewall? By monitoring your logs, OSPatrol will let you know of that. Covers PCI DSS section 10 in a whole. Rootkit detection Criminals (also known as hackers) want to hide their actions, but using rootkit detection you can be notified when they (or trojans, viruses, etc) change your system in this way. Active response Take immediate and automatic responses when something happens. Why wait for hours when you can alert your admin and block an attack right way? 1.1.2 OSPatrol Architecture OSPatrol is composed of multiple pieces. It has a central manager monitoring everything and receiving information from agents, syslog, databases and from agentless devices. 4 Chapter 1. Manual & FAQ OSSEC Documentation, Release 2.7.2b1 Manager The manager is the central piece of the OSPatrol deployment. It stores the file integrity checking databases, the logs, events and system auditing entries. All the rules, decoders and major configuration options are stored centrally in the manager, making it easy to administer even a large number of agents. Agents The agent is a small program or collection of programs installed on the systems you desire to monitor. The agent will collect information in real time and forward it to the manager for analysis and correlation. It has a very small memory and CPU footprint by default, not affecting system?x80x99s usage. Agent security: It runs with a low privilege user (created during the installation) and inside a chroot jail isolated from the system. Most of the agent configuration is pushed from the manager, with just some of configuration stored locally on each agent. In case these local options are changed, the manager will receive the information and will generate an alert. Agentless For systems that you can’t install an agent, OSPatrol allows you to perform file integrity monitoring on them without the agent installed. It can be very useful to monitor firewalls, routers and even Unix systems where you are not allowed to install the agent. Virtualization/VMware OSPatrol allows you to install the agent on the guest operating systems or inside the host (VMware ESX). With the agent installed inside VMware ESX you can get alerts about when a VM guest is being installed, removed, started, etc. It also monitors logins, logouts and errors inside the ESX server. In addition to that, OSPatrol performs the Center for Internet Security (CIS) checks for VMware, alerting if there is any insecure configuration option enabled or any other issue. Firewalls, switches and routers OSPatrol can receive and analyze syslog events from a large variety of firewalls, switches and routers. It supports all Cisco routers, Cisco PIX, Cisco FWSM, Cisco ASA, Juniper Routers, Netscreen firewall, Checkpoint and many others. Architecture This diagram shows the central manager receiving events from the agents and system logs from remote devices. When something is detected, active responses can be executed and the admin is notified. manual/ossec-arch.jpg 1.1. Manual 5 OSSEC Documentation, Release 2.7.2b1 Internal Architecture For technical and deep detailed information on how it works, please read the following documents: OSSEC log analysis/inspection architecture (PDF) - by Daniel Cid This was the Architecture slide for OSSEC from which OSPatrol was forked from. Support 1.1.3 Supported Systems OSPatrol supports the following operating systems and log formats. Operating Systems The following operating systems are supported by the OSPatrol agent: • GNU/Linux (all distributions, including RHEL, Ubuntu, Slackware, Debian, etc) • Windows XP, 2003, Vista, 2008 • VMWare ESX 3.0,3.5 (including CIS checks) • FreeBSD (all current versions) • OpenBSD (all current versions) • NetBSD (all current versions) • Solaris 2.7, 2.8, 2.9 and 10 • AIX 5.2 and 5.3 • Mac OS X 10.x • HP-UX 11 Devices supported via Syslog These systems/devices are also supported via remote syslog: • Cisco PIX, ASA and FWSM (all versions) • Cisco IOS routers (all versions) • Juniper Netscreen (all versions) • SonicWall firewall (all versions) • Checkpoint firewall (all versions) • Cisco IOS IDS/IPS module (all versions) • Sourcefire (Snort) IDS/IPS (all versions) • Dragon NIDS (all versions) • Checkpoint Smart Defense (all versions) • McAfee VirusScan Enterprise (v8 and v8.5) • Bluecoat proxy (all versions) 6 Chapter 1. Manual & FAQ OSSEC Documentation, Release 2.7.2b1 • Cisco VPN concentrators (all versions) • VMWare ESXi 4.x Devices and Operating Systems via Agentless Using OSPatrol agentless options, the following systems are also supported (for log analysis and file integrity check- ing): • Cisco PIX, ASA and FWSM (all versions) • Cisco IOS routers (all versions) • Juniper Netscreen (all versions) • SonicWall firewall (all versions) • Checkpoint firewall (all versions) • All operating systems specified in the “operating systems” section 1.1.4 Installation The best installation tutorial is available in the OSPatrol book. OSPatrol HIDS Manager/Agent Installation Installation of the OSPatrol HIDS is very simple. Just follow these few steps to have it working. Please make sure that you understand the type of installation you are choosing (manager, agent, local, or hybrid)