File Integrity checking
There is one thing in common to any attack to your networks and computers: they change your systems in some way. The goal of file integrity checking (or FIM – file integrity monitoring) is to detect these changes and alert you when they happen. It can be an attack, or a misuse by an employee or even a typo by an admin, any file, directory or registry change will be alerted to you.
Covers PCI DSS sections 11.5 and 10.5.5.
Your operating system wants to speak to you, but do you know how to listen? Every operating system, application, and device on your network generate logs (events) to let you know what is happening. OSSEC collects, analyzes and correlates these logs to let you know if something suspicious is happening (attack, misuse, errors, etc). Do you want to know when an application is installed on your client box? Or when someone changes a rule in your firewall? By monitoring your logs, OSSEC will notify you.
This should cover PCI DSS section 10.
Criminal hackers want to hide their actions, but using rootkit detection you can be notified when the system is modified in a way common to rootkits.
Active response allows OSSEC to take immediate action when specified alerts are triggered. This may prevent an incident from spreading before an administrator can take action.
For UNIX systems, OSSEC only requires gnu make, gcc, and libc. OpenSSL is a suggested, but optional, prerequisite. However, you always have the option to pre-compile it on one system and move the binaries to the final box.
On Ubuntu you will need the build-essential package in order to compile and install OSSEC.
To install the package run the following command.
# apt-get install build-essential
If database support is needed mysql-dev or postgresql-dev should be installed. Run the following command to install these packages.
# apt-get install mysql-dev postgresql-dev
To use the SQLite features, the libsqlite3-dev package is necessary.
New in version 3.0.
# apt-get install libsqlite3-dev
RedHat should have all packages needed by default, but if database support is needed the package mysql-devel and/or postgresql-devel will need to be installed.
# yum install mysql-devel postgresql-devel
To use the SQLite features, the sqlite-devel package is necessary.
New in version 3.0.
# yum install sqlite-devel
Debian has replaced bash with dash, and this may cause issues during installation. Dash does not appear to support all of the features available in other shells, and may display an error when trying to set the server’s IP address on an agent system. The error can be ignored, but the server ip address will need to be set.
Do this by making sure something like the following information is in the agent’s ossec.conf:
<ossec_config> <client> <server-ip>SERVER'S IP</server-ip> </client>
This can also be avoided by using bash to run
# bash ./install.sh