Difference between revisions of "Automated OSSEC installation using ansible"

From Notes_Wiki
m
m
 
(4 intermediate revisions by the same user not shown)
Line 1: Line 1:
<yambe:breadcrumb>OSSEC|OSSEC</yambe:breadcrumb>
[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[Security tools]] > [[OSSEC]] > [[Automated OSSEC installation using ansible]]
=Automated OSSEC installation using ansible=


==OSSEC server installation==
[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[System administration tools]] > [[Ansible|ansible]] > [[Ansible roles]] > [[Automated OSSEC installation using ansible]]


For server installation following playbook can be used:
==ossec-server role==
<pre>---
  - name: Ossec server installation
    hosts: ossec-server
    remote_user: root


    vars:
Automated OSSEC installation using ansible roles can be done using ossec-server role as follows:
      ossec_url: https://github.com/ossec/ossec-hids/releases/download/v2.8.0/ossec-hids-2.8.tar.gz
      ossec_path: /root/ossec-hids-2.8
      webui_url: http://www.ossec.net/files/ossec-wui-0.8.tar.gz
      webui_path: /root/ossec-wui-0.8
      webui_install_path: /var/www/html/ossec
      extract_path: /root
      document_root: /var/www/html
      admin_email_address: saurabh@rekallsoftware.com
      smtp_server_address: smtp.admin.iiit.ac.in


    tasks:
Create roles/ossec-server/{files,handlers,tasks,templates,vars} folders using:
    - name: Install necessary packages - gcc, postgresql-devel, mysql-devel, php and expect
<pre>
      yum: name="{{item}}" state=present
mkdir -p roles/ossec-server/{files,handlers,tasks,templates,vars}
      with_items:
</pre>
        - gcc
        - postgresql-devel
        - mysql-devel
        - php
        - expect
        - httpd


    - name: Download Ossec server/agent
Change directory to roles/ossec-server folder:
      get_url: url="{{ossec_url}}" dest="{{ossec_path}}".tar.gz
<pre>
cd roles/ossec-server
</pre>


    - name: Extract Ossec server code
Create files/add_agent.sh file with following contents:
      unarchive: copy=no src="{{ossec_path}}".tar.gz dest="{{extract_path}}" creates="{{ossec_path}}"
<pre>
#!/bin/bash


    - name: Copy the Ossec_input file
cat > ossec_agent_input.txt <<EOF
      template: src=ossec_server_input.j2 dest="{{ossec_path}}/ossec_server_input.txt"
A
$1
$2


    - name: Install Ossec server
y
      shell: ./install.sh < ossec_server_input.txt
Q
      args:
EOF
        chdir: "{{ossec_path}}"
        creates: /var/ossec/etc/ossec.conf


    - name: Start ossec server
/var/ossec/bin/manage_agents < ossec_agent_input.txt
      service: name=ossec state=started


    - name: Download Ossec web UI
rm -f ossec_agent_input.txt
      get_url: url="{{webui_url}}" dest="{{webui_path}}".tar.gz
 
    - name: Extract Ossec web UI code
      unarchive: copy=no src="{{webui_path}}".tar.gz dest="{{extract_path}}" creates="{{webui_install_path}}"


    - name: Move the extracted web UI code to document root
exit 0
      command: mv "{{webui_path}}" "{{webui_install_path}}"
      args:
        creates: "{{webui_install_path}}"


    - name: Copy the Ossec_webui_input file
      copy: src=ossec_webui_setup.sh dest="{{webui_install_path}}" mode=544


    - name: Install Ossec web UI
</pre>
      shell: ./ossec_webui_setup.sh
      args:
        chdir: /var/www/html/ossec
        creates: /var/www/html/ossec/.htpasswd


    - name: Create index.html to automatically redirect to /ossec
      copy: src=index.html dest="{{document_root}}" owner=root group=root mode=644
       
    - name: Ensure that apache service is running
      service: name=httpd state=started
</pre>


The above playbook refers to following files:
Create files/index.html with following contents:
*index.html
<pre>
<pre>
&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"&gt;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
&lt;html xmlns="http://www.w3.org/1999/xhtml"&gt;
<html xmlns="http://www.w3.org/1999/xhtml">
&lt;head>
<head>
&lt;meta http-equiv="Content-type" content="text/html;charset=UTF-8" /&gt;
<meta http-equiv="Content-type" content="text/html;charset=UTF-8" />
&lt;meta http-equiv="Refresh" content="0; URL=ossec" /&gt;
<meta http-equiv="Refresh" content="0; URL=ossec" />
&lt;/head&gt;
</head>
&lt;body&gt;
<body>
&lt;/body&gt;
</body>
&lt;/html&gt;
</html>
</pre>
</pre>
*ossec_server_input.j2
<pre>
en
server
{{ admin_email_address }}
{{ smtp_server_address }}
n
y




</pre>
Create files/ossec_webui_setup.sh with following contents:
*ossec_webui_setup.sh
<pre>
<pre>
#!/usr/bin/expect -f
#!/usr/bin/expect -f
Line 126: Line 73:
expect "anything that will not be there krati is responsible"
expect "anything that will not be there krati is responsible"
send_user "$expect_out(buffer)"
send_user "$expect_out(buffer)"


</pre>
</pre>




==OSSEC client installation==
Create handlers/main.yaml with following contents:
<pre>
---
- name: restart ossec
  service: name=ossec state=restarted
 
</pre>
 


For ossec client installation hosts file should have host-group named ossec-client with names of all clients.  Further IP address of all clients should be replaced in client_ips variable.  Also remember to configure server_ip in server_ip variable.
Create tasks/main.yaml with following contents:
<pre>
<pre>
---
---
   - name: Ossec agent installation on OSSEC server
- name: Install necessary packages - gcc, postgresql-devel, mysql-devel, php and expect
    hosts: ossec-server
  yum: name="{{item}}" state=present
    remote_user: root
   with_items:
    
    - gcc
     vars:
    - postgresql-devel
      client_ips:  
    - mysql-devel
        - 192.168.122.103
    - php
        - 192.168.122.104
    - expect
    - httpd
 
- name: Download Ossec server/agent  
  get_url: url="{{ossec_url}}" dest="{{ossec_path}}".tar.gz
 
- name: Extract Ossec server code
  unarchive: copy=no src="{{ossec_path}}".tar.gz dest="{{extract_path}}" creates="{{ossec_path}}"
 
- name: Copy the Ossec_input file
  template: src=ossec_server_input.j2 dest="{{ossec_path}}/ossec_server_input.txt"
 
- name: Install Ossec server
  shell: ./install.sh < ossec_server_input.txt
   args:
    chdir: "{{ossec_path}}"
     creates: /var/ossec/etc/ossec.conf
 
- name: Start ossec server
  service: name=ossec state=started
 
- name: Download Ossec web UI
  get_url: url="{{webui_url}}" dest="{{webui_path}}".tar.gz
 
- name: Extract Ossec web UI code
  unarchive: copy=no src="{{webui_path}}".tar.gz dest="{{extract_path}}" creates="{{webui_install_path}}"
 
- name: Move the extracted web UI code to document root
  command: mv "{{webui_path}}" "{{webui_install_path}}"
  args:
    creates: "{{webui_install_path}}"
 
- name: Copy the Ossec_webui_input file
  copy: src=ossec_webui_setup.sh dest="{{webui_install_path}}" mode=544


    tasks:
- name: Install Ossec web UI
    - name: Copy add_agent.sh script
  shell: ./ossec_webui_setup.sh  
      copy: src=add_agent.sh dest=/root/add_agent.sh mode=755 owner=root group=root
  args:
    chdir: /var/www/html/ossec
    creates: /var/www/html/ossec/.htpasswd


    - name: Add agent to the server
- name: Create index.html to automatically redirect to /ossec
      shell: /root/add_agent.sh "{{item}}"
  copy: src=index.html dest="{{document_root}}" owner=root group=root mode=644
      with_items: client_ips
      notify:
      - restart ossec
      
      
    - name: Get all client keys from OSSEC server to ansible server
- name: Ensure that apache service is running
      fetch: src=/var/ossec/etc/client.keys dest=/root/client.keys flat=yes
  service: name=httpd state=started
   
 
    handlers:
#Tasks related to configuring client keys
      - name: restart ossec
- name: Copy add_agent.sh script
        service: name=ossec state=restarted
  copy: src=add_agent.sh dest=/root/add_agent.sh mode=755 owner=root group=root
 
- name: Add agent to the server
  shell: /root/add_agent.sh "{{item.hostname}}" "{{item.ip}}"
  with_items: ossec_client_ips
  notify:
  - restart ossec
 
- name: Get all client keys from OSSEC server to ansible server
  fetch: src=/var/ossec/etc/client.keys dest=fetched
</pre>
 
 
Create templates/ossec_server_input.j2 with following contents:
<pre>
en
 
server
 
 
{{ admin_email_address }}
{{ smtp_server_address }}
 
 
n
y
 
 
 
 
 
</pre>
Do not remove empty lines from this file.  This file is used for input redirection and empty lines are necessary for corresponding input confirmation.
 
 
Create vars/main.yaml with following contents:
<pre>
---
ossec_url: https://github.com/ossec/ossec-hids/releases/download/v2.8.0/ossec-hids-2.8.tar.gz
ossec_path: /root/ossec-hids-2.8
webui_url: http://www.ossec.net/files/ossec-wui-0.8.tar.gz
webui_path: /root/ossec-wui-0.8
webui_install_path: /var/www/html/ossec
extract_path: /root
document_root: /var/www/html
</pre>
Note that a newer version of OSSEC might be available. It may make sense to setup a newer OSSEC server by replacing above URLs and values
 
 
Finally following additional variables should be defined at a central location (eg common_vars), in vars file of ossec-server role or in play-book.
<pre>
admin_email_address: logs@example.com
smtp_server_address: smtp.example.com
 
ossec_client_ips:
  - { hostname: ca.sbarjatiya.com, ip: 10.4.20.150 }
  - { hostname: ns1.sbarjatiya.com, ip: 10.4.20.151 }
</pre>
SMTP server must accept emails from OSSEC server without asking for authentications  (postfix trusted_network, etc.) at least to admin_email_address.  ossec_client_ips dictionary must be populated with list of all clients that will get monitored using current ossec-server.  '''OSSEC server cannot / need not monitor itself by using ossec_client_ips list'''.
 
 


==ossec-client role==


  - name: Ossec agent installation on OSSEC client
Automated OSSEC client installation using ansible roles can be done using ossec-client role as follows:
    hosts: ossec-client
    user: root


    vars:
Create roles/ossec-client/{tasks,templates,vars} folders using:
      ossec_url: https://github.com/ossec/ossec-hids/releases/download/v2.8.0/ossec-hids-2.8.tar.gz
<pre>
      ossec_path: /root/ossec-hids-2.8
mkdir -p roles/ossec-client/{tasks,templates,vars}
      server_ip: 192.168.122.102
</pre>
      ossec_manage_agent_input: /root/ossec_manage_agent_input.txt
      extract_path: /root


    tasks:
Change directory to roles/ossec-client folder:
    - name: Install gcc postgres and mysql
<pre>
      yum: name="{{item}}" state=present
cd roles/ossec-client
      with_items:
        - gcc
        - postgresql-devel
        - mysql-devel
 
    - name: Download Ossec server/agent
      get_url: url="{{ossec_url}}" dest="{{ossec_path}}".tar.gz
    - name: Extract Ossec server code
      unarchive: copy=no src="{{ossec_path}}".tar.gz dest="{{extract_path}}" creates="{{ossec_path}}"
    - name: Copy the Ossec_input file
      template: src=ossec_client_input.j2 dest="{{ossec_path}}/ossec_client_input.txt"
    - name: Install Ossec-agent
      shell: ./install.sh < ossec_client_input.txt
      args:
        chdir: "{{ossec_path}}"
        creates: /var/ossec/etc/ossec.conf
    - name: Get the client key from server
      copy: src=/root/client.keys dest=/var/ossec/etc/client2.keys 
    - name: Extract only the key for current client
      shell: grep "{{ansible_default_ipv4.address}}" /var/ossec/etc/client2.keys > /var/ossec/etc/client.keys
    - name: Delete other client keys 
      file: name=/var/ossec/etc/client2.keys state=absent
    - name: Start Ossec server
      service: name=ossec state=started
</pre>
</pre>
This playbook requires following files:
 
*add_agent.sh
Create tasks/main.yaml file with following contents:
<pre>
<pre>
#!/bin/bash
---
- name: Install gcc postgres and mysql
  yum: name="{{item}}" state=present
  with_items:
    - gcc
    - postgresql-devel
    - mysql-devel
 
- name: Download Ossec server/agent
  get_url: url="{{ossec_url}}" dest="{{ossec_path}}".tar.gz
 
- name: Extract Ossec server code
  unarchive: copy=no src="{{ossec_path}}".tar.gz dest="{{extract_path}}" creates="{{ossec_path}}"
 
- name: Copy the Ossec_input file
  template: src=ossec_client_input.j2 dest="{{ossec_path}}/ossec_client_input.txt"


cat > ossec_agent_input.txt <<EOF
- name: Install Ossec-agent
A
  shell: ./install.sh < ossec_client_input.txt  
$1
  args:
$1
    chdir: "{{ossec_path}}"
    creates: /var/ossec/etc/ossec.conf


y
- name: Get the client key from server
Q
  copy: src="fetched/{{ossec_server_ip}}/var/ossec/etc/client.keys" dest=/var/ossec/etc/client2.keys 
EOF


/var/ossec/bin/manage_agents < ossec_agent_input.txt
- name: Extract only the key for current client
  shell: grep "{{ansible_default_ipv4.address}}" /var/ossec/etc/client2.keys > /var/ossec/etc/client.keys


rm -f ossec_agent_input.txt
- name: Delete other client keys 
  file: name=/var/ossec/etc/client2.keys state=absent


exit 0
- name: Start Ossec server
  service: name=ossec state=restarted
</pre>
</pre>
*ossec_client_input.j2
 
 
Create templates/ossec_client_input.j2 file with following contents:
<pre>
<pre>
en
en
Line 235: Line 269:
agent
agent
/var/ossec
/var/ossec
{{ server_ip }}
{{ ossec_server_ip }}
y
y
y
y
Line 242: Line 276:




</pre>
Do not remove empty lines from this file.  This file is used for input redirection and empty lines serve very important purpose of input confirmation.
Create vars/main.yaml file with following contents:
<pre>
---
ossec_url: http://www.ossec.net/files/ossec-hids-2.8.2.tar.gz
ossec_path: /root/ossec-hids-2.8.2
ossec_manage_agent_input: /root/ossec_manage_agent_input.txt
extract_path: /root
</pre>
If a newer version of OSSEC is available than paths and URLs can be changed accordingly.  Note that input file also may need to change if the installation has changed.  Typically new clients can connect to older version of server (2.8.2 clients to 2.8 server) without any issue.
Following variables must be defined in common_vars or in ossec-client role or in playbook which implements ossec-client role:
<pre>
ossec_server_ip: 10.4.20.153
</pre>
</pre>




<yambe:breadcrumb>OSSEC|OSSEC</yambe:breadcrumb>
 
 
 
[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[Security tools]] > [[OSSEC]] > [[Automated OSSEC installation using ansible]]
 
[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[System administration tools]] > [[Ansible|ansible]] > [[Ansible roles]] > [[Automated OSSEC installation using ansible]]

Latest revision as of 12:05, 28 July 2022

Home > CentOS > CentOS 6.x > Security tools > OSSEC > Automated OSSEC installation using ansible

Home > CentOS > CentOS 6.x > System administration tools > ansible > Ansible roles > Automated OSSEC installation using ansible

ossec-server role

Automated OSSEC installation using ansible roles can be done using ossec-server role as follows:

Create roles/ossec-server/{files,handlers,tasks,templates,vars} folders using: 

mkdir -p roles/ossec-server/{files,handlers,tasks,templates,vars}

Change directory to roles/ossec-server folder: 

cd roles/ossec-server

Create files/add_agent.sh file with following contents: 

#!/bin/bash

cat > ossec_agent_input.txt <<EOF
A
$1
$2

y
Q
EOF

/var/ossec/bin/manage_agents < ossec_agent_input.txt

rm -f ossec_agent_input.txt

exit 0


Create files/index.html with following contents: 

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
	<meta http-equiv="Content-type" content="text/html;charset=UTF-8" />
	<meta http-equiv="Refresh" content="0; URL=ossec" />
</head>
<body>
</body>
</html>


Create files/ossec_webui_setup.sh with following contents: 

#!/usr/bin/expect -f
 
spawn ./setup.sh

expect "Username:" 
send "saurabh\r"
expect "password:" 
send "rekall123\r"
expect "password:"
send "rekall123\r"
expect "user name"
send "apache\r"
expect "directory path"
send "/var/ossec\r"

expect "anything that will not be there krati is responsible"
send_user "$expect_out(buffer)"


Create handlers/main.yaml with following contents: 

---
- name: restart ossec
  service: name=ossec state=restarted


Create tasks/main.yaml with following contents: 

---
- name: Install necessary packages - gcc, postgresql-devel, mysql-devel, php and expect
  yum: name="{{item}}" state=present
  with_items:
    - gcc
    - postgresql-devel
    - mysql-devel
    - php
    - expect
    - httpd

- name: Download Ossec server/agent 
  get_url: url="{{ossec_url}}" dest="{{ossec_path}}".tar.gz

- name: Extract Ossec server code
  unarchive: copy=no src="{{ossec_path}}".tar.gz dest="{{extract_path}}" creates="{{ossec_path}}"

- name: Copy the Ossec_input file
  template: src=ossec_server_input.j2 dest="{{ossec_path}}/ossec_server_input.txt"

- name: Install Ossec server
  shell: ./install.sh < ossec_server_input.txt
  args:
    chdir: "{{ossec_path}}"
    creates: /var/ossec/etc/ossec.conf

- name: Start ossec server
  service: name=ossec state=started

- name: Download Ossec web UI
  get_url: url="{{webui_url}}" dest="{{webui_path}}".tar.gz

- name: Extract Ossec web UI code
  unarchive: copy=no src="{{webui_path}}".tar.gz dest="{{extract_path}}" creates="{{webui_install_path}}" 

- name: Move the extracted web UI code to document root
  command: mv "{{webui_path}}" "{{webui_install_path}}"
  args:
    creates: "{{webui_install_path}}"

- name: Copy the Ossec_webui_input file
  copy: src=ossec_webui_setup.sh dest="{{webui_install_path}}" mode=544

- name: Install Ossec web UI
  shell: ./ossec_webui_setup.sh 
  args:
    chdir: /var/www/html/ossec
    creates: /var/www/html/ossec/.htpasswd

- name: Create index.html to automatically redirect to /ossec
  copy: src=index.html dest="{{document_root}}" owner=root group=root mode=644
    
- name: Ensure that apache service is running
  service: name=httpd state=started

#Tasks related to configuring client keys
- name: Copy add_agent.sh script
  copy: src=add_agent.sh dest=/root/add_agent.sh mode=755 owner=root group=root

- name: Add agent to the server
  shell: /root/add_agent.sh "{{item.hostname}}" "{{item.ip}}"
  with_items: ossec_client_ips
  notify: 
  - restart ossec

- name: Get all client keys from OSSEC server to ansible server
  fetch: src=/var/ossec/etc/client.keys dest=fetched


Create templates/ossec_server_input.j2 with following contents: 

en

server


{{ admin_email_address }}
{{ smtp_server_address }}


n
y

Do not remove empty lines from this file. This file is used for input redirection and empty lines are necessary for corresponding input confirmation.


Create vars/main.yaml with following contents: 

---
ossec_url: https://github.com/ossec/ossec-hids/releases/download/v2.8.0/ossec-hids-2.8.tar.gz
ossec_path: /root/ossec-hids-2.8
webui_url: http://www.ossec.net/files/ossec-wui-0.8.tar.gz
webui_path: /root/ossec-wui-0.8
webui_install_path: /var/www/html/ossec
extract_path: /root
document_root: /var/www/html

Note that a newer version of OSSEC might be available. It may make sense to setup a newer OSSEC server by replacing above URLs and values


Finally following additional variables should be defined at a central location (eg common_vars), in vars file of ossec-server role or in play-book. 

admin_email_address: logs@example.com
smtp_server_address: smtp.example.com

ossec_client_ips:
  - { hostname: ca.sbarjatiya.com, ip: 10.4.20.150 }
  - { hostname: ns1.sbarjatiya.com, ip: 10.4.20.151 }

SMTP server must accept emails from OSSEC server without asking for authentications (postfix trusted_network, etc.) at least to admin_email_address. ossec_client_ips dictionary must be populated with list of all clients that will get monitored using current ossec-server. OSSEC server cannot / need not monitor itself by using ossec_client_ips list.


ossec-client role

Automated OSSEC client installation using ansible roles can be done using ossec-client role as follows:

Create roles/ossec-client/{tasks,templates,vars} folders using: 

mkdir -p roles/ossec-client/{tasks,templates,vars}

Change directory to roles/ossec-client folder: 

cd roles/ossec-client

Create tasks/main.yaml file with following contents: 

---
- name: Install gcc postgres and mysql
  yum: name="{{item}}" state=present
  with_items:
    - gcc
    - postgresql-devel
    - mysql-devel

- name: Download Ossec server/agent 
  get_url: url="{{ossec_url}}" dest="{{ossec_path}}".tar.gz

- name: Extract Ossec server code
  unarchive: copy=no src="{{ossec_path}}".tar.gz dest="{{extract_path}}" creates="{{ossec_path}}"

- name: Copy the Ossec_input file
  template: src=ossec_client_input.j2 dest="{{ossec_path}}/ossec_client_input.txt"

- name: Install Ossec-agent
  shell: ./install.sh < ossec_client_input.txt 
  args:
    chdir: "{{ossec_path}}"
    creates: /var/ossec/etc/ossec.conf

- name: Get the client key from server
  copy: src="fetched/{{ossec_server_ip}}/var/ossec/etc/client.keys" dest=/var/ossec/etc/client2.keys  

- name: Extract only the key for current client
  shell: grep "{{ansible_default_ipv4.address}}" /var/ossec/etc/client2.keys > /var/ossec/etc/client.keys

- name: Delete other client keys   
  file: name=/var/ossec/etc/client2.keys state=absent

- name: Start Ossec server
  service: name=ossec state=restarted


Create templates/ossec_client_input.j2 file with following contents: 

en

agent
/var/ossec
{{ ossec_server_ip }}
y
y
y

Do not remove empty lines from this file. This file is used for input redirection and empty lines serve very important purpose of input confirmation.


Create vars/main.yaml file with following contents: 

---
ossec_url: http://www.ossec.net/files/ossec-hids-2.8.2.tar.gz 
ossec_path: /root/ossec-hids-2.8.2
ossec_manage_agent_input: /root/ossec_manage_agent_input.txt
extract_path: /root

If a newer version of OSSEC is available than paths and URLs can be changed accordingly. Note that input file also may need to change if the installation has changed. Typically new clients can connect to older version of server (2.8.2 clients to 2.8 server) without any issue.


Following variables must be defined in common_vars or in ossec-client role or in playbook which implements ossec-client role: 

ossec_server_ip: 10.4.20.153



Home > CentOS > CentOS 6.x > Security tools > OSSEC > Automated OSSEC installation using ansible

Home > CentOS > CentOS 6.x > System administration tools > ansible > Ansible roles > Automated OSSEC installation using ansible

Retrieved from "http://www.sbarjatiya.com/notes_wiki/index.php?title=Automated_OSSEC_installation_using_ansible&oldid=6683"