OSSEC 2.7 Beta-0 released
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
It runs on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX and Windows.
Check out OSSEC features and how it works for more information about how OSSEC can help you solve your host-based security problems.
OSSEC Features
OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS (host-based intrusion detection), log monitoring and SIM/SIEM together in a simple, powerful and open source solution. It is also backed and fully supported by Trend Micro.
Key Benefits
Compliance Requirements
OSSEC helps customers meet specific compliance requirements such as PCI, HIPAA etc. It lets customers detect and alert on unauthorized file system modifications and malicious behavior embedded in the log files of COTS products as well as custom applications. For PCI, it covers the sections of file integrity monitoring (PCI 11.5, 10.5), log inspection and monitoring (section 10) and policy enforcement/checking.
Multi platform
OSSEC lets customers implement a comprehensive host based intrusion detection system with fine grained application/server specific policies across multiple platforms such as Linux, Solaris, AIX, HP-UX, BSD, Windows, Mac and Vmware ESX.
Real-time and Configurable Alerts
OSSEC lets customers configure incidents they want to be alerted on which lets them focus on raising the priority of critical incidents over the regular noise on any system. Integration with smtp, sms and syslog allows customers to be on top of alerts by sending these on to e-mail and handheld devices such as cell phones and pagers. Active response options to block an attack immediately is also available.
Integration with current infrastructure
OSSEC will integrate with current investments from customers such as SIM/SEM (Security Incident Management/Security Events Management) products for centralized reporting and correlation of events.
Centralized management
OSSEC provides a simplified centralized management server to manage policies across multiple operating systems. Additionally, it also lets customers define server specific overrides for finer grained policies.
Agent and agentless monitoring
OSSEC offers the flexibility of agent based and agentless monitoring of systems and networking components such as routers and firewalls. It lets customers who have restrictions on software being installed on systems (such as FDA approved systems or appliances) meet security and compliance needs.
Key Features
File Integrity checking
There is one thing in common to any attack to your networks and computers: they change your systems in some way. The goal of file integrity checking (or FIM – file integrity monitoring) is to detect these changes and alert you when they happen. It can be an attack, or a misuse by an employee or even a typo by an admin, any file, directory or registry change will be alerted to you.
Covers PCI DSS sections 11.5 and 10.5.5.
Log Monitoring
Your operating system wants to speak to you, but do you know how to listen? Every operating system, application, and device on your network generate logs (events) to let you know what is happening. OSSEC collects, analyzes and correlates these logs to let you know if something wrong is going on (attack, misuse, errors, etc). Do you want to know when an application is installed on your client box? Or when someone changes a rule in your firewall? By monitoring your logs, OSSEC will let you know of that.
Covers PCI DSS section 10 in a whole.
Rootkit detection
Criminals (also known as hackers) want to hide their actions, but using rootkit detection you can be notified when they (or trojans, viruses, etc) change your system in this way.
Active response
Take immediate and automatic responses when something happens. Why wait for hours when you can alert your admin and block an attack right way.
How It Works
OSSEC is composed of multiple pieces. It has a central manager monitoring everything and receiving information from agents, syslog, databases and from agentless devices.
Manager
The manager is the central piece of the OSSEC deployment. It stores the file integrity checking databases, the logs, events and system auditing entries. All the rules, decoders and major configuration options are stored centrally in the manager, making easy to administer even a large number of agents.
Agents
The agent is a small program installed on the systems you desire to monitor. It will collect information on real time and forward to the manager for analysis and correlation. It has a very small memory and CPU footprint by default, not affecting with the system’s usage.
Agent security: It runs with a low privilege user (created during the installation) and inside a chroot jail isolated from the system. Most of the agent configuration is pushed from the manager, with just some of them are stored locally on each agent. In case these local options are changed, the manager will receive the information and will generate an alert.
Agentless
For systems that you can’t install an agent, OSSEC allows you to perform file integrity monitoring on them without the agent installed. It can be very useful to monitor firewalls, routers and even Unix systems where you are not allowed to install the agent.
Virtualization/Vmware
OSSEC allows you to install the agent on the guest operating systems or inside the host (Vmware ESX). With the agent installed inside the VMware ESX you can get alerts about when a VM guest is being installed, removed, started, etc. It also monitors logins, logouts and errors inside the ESX server. In addition to that, OSSEC performs the CIS checks for Vmware, alerting if there is any insecure configuration option enabled or any other issue.
Firewalls, switches and routers
OSSEC can receive and analyze syslog events from a large variety of firewalls, switches and routers. It supports all Cisco routers, Cisco PIX, Cisco FWSM, Cisco ASA, Juniper Routers, Netscreen firewall, Checkpoint and many others.
Architecture
This diagram shows the central manager receiving events from the agents and system logs from remote devices. When something is detected, active responses can be executed and the admin is notified.
It has been over a year since the release of OSSEC 2.6 in July 2011. Through all this time many patches/enhancements have been contributed. We have incorporated as many of them as possible into the upcoming release. We are calling this release 2.7 beta-o, with the expectation that Beta-1, Beta-2… will follow, until it is stable enough to be called final. Here are the highlight of changes in OSSEC 2.7 Beta-0:
- Installation
- Add hybrid mode – allows the same host to be both a server and an agent, useful for multi-tier OSSEC deployment.
- Add ‘ manage_agents -f’ option for bulk generation of client keys from an input file.
- Syscheck
- Add prelinking support – reduce confusion when a file change is the result of prelinking.
- Rootcheck
- Add fine-grained configuration control – allows you to turn ON/OFF individual rootcheck tasks for more efficiency and flexibility (default is all ON).
- Log monitoring/analysis
- Add GeoIP lookup support – allows geographical city names to be associated with IP addresses in OSSEC alerts, for more intelligent correlation.
- Add multi-line log readers for Linux auditd, plus ModSec and Regex log readers.
- Alert options and syslog output
- Add syscheck MD5/SHA1 sum to alerts for easier integration with third-party file signature checking.
- Support JSON and Splunk formats in syslog output.
- Rules and other notable changes/fixes
- Windows 2000 logs support has been deprecated (but will probably still work fine). Vista and Windows Server 2008 logs are now officially supported.
- Windows registry syscheck alert level has been reduced from 7 to 5 to reduce unnecessary noise from alerts which do not indicate a compromise.
- Update decoders include: PIX, auditd, apache, pam, php…
- Many updated rules, such as new checks for vulnerable web apps exploitation attempts.
- Update rootcheck rules
- ossec-client.sh now allows for ‘reload’, in addition to ‘restart’
- Many bug fixes…
How to test the BETA?
Download the beta-0 package from here. Note that the Windows Agent build is not ready yet. You can test 2.7 Beta-0 with 2.6 agents.
How to report bugs, contribute bug fixes?
Please post successful testing of features to Google group ‘ossec-dev’ with subject line starting with identification such as [2.7-beta0-rootcheck] , similarly do the same for reporting bugs and providing bug fixes. If privacy is a concern, you can send email to us at ossecproject @ gmail.com.
OSSEC 2.7 Beta-0 - ossec-hids-2.7-beta-0.tar.gz
Downloads
Unix/Linux version 2.7 beta-0
OSSEC for Linux, Solaris, *BSD, Mac, AIX and variants:
ossec-hids-2.7-beta-0.tar.gz Checksum – License
ossec-hids-2.7-beta-0.tar.gz Checksum – License
Unix/Linux version 2.6
OSSEC for Linux, Solaris, *BSD, Mac, AIX and variants:
ossec-hids-2.6.tar.gz Sig – Checksum – License
Installation instructions here.
ossec-hids-2.6.tar.gz Sig – Checksum – License
Installation instructions here.
Windows agent version 2.6
OSSEC for Windows 2000, XP, Vista, 7 and Windows Server 2003, 2008:
ossec-agent-win32-2.6.exe Sig – Checksum – License
ossec-agent-win32-2.6.exe Sig – Checksum – License
RPMs for RHEL, CentOS, Fedora and others
Available in the AtomiCorp repository. To install:
# wget -q -O – https://www.atomicorp.com/installers/atomic |sh
# yum install ossec-hids ossec-hids-server (or ossec-hids-client for the agent)
http://www.ossec.net/
Documentation -
