{"id":19515,"date":"2017-04-15T06:42:35","date_gmt":"2017-04-14T22:42:35","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/15\/%e5%9c%a8-centos-6-x-x64-%e4%b8%8a%e5%ae%89%e8%a3%9d-ossec-hids-%e4%b8%bb%e6%a9%9f%e5%9e%8b%e5%85%a5%e4%be%b5%e5%81%b5%e6%b8%ac%e7%b3%bb%e7%b5%b1\/"},"modified":"2021-03-18T17:25:00","modified_gmt":"2021-03-18T09:25:00","slug":"%e5%9c%a8-centos-6-x-x64-%e4%b8%8a%e5%ae%89%e8%a3%9d-ossec-hids-%e4%b8%bb%e6%a9%9f%e5%9e%8b%e5%85%a5%e4%be%b5%e5%81%b5%e6%b8%ac%e7%b3%bb%e7%b5%b1","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/15\/%e5%9c%a8-centos-6-x-x64-%e4%b8%8a%e5%ae%89%e8%a3%9d-ossec-hids-%e4%b8%bb%e6%a9%9f%e5%9e%8b%e5%85%a5%e4%be%b5%e5%81%b5%e6%b8%ac%e7%b3%bb%e7%b5%b1\/","title":{"rendered":"\u5728 CentOS 6.x x64 \u4e0a\u5b89\u88dd OSSEC – HIDS \u4e3b\u6a5f\u578b\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71"},"content":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1a
OSSEC \u4e3b\u6a5f\u578b\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71 (HIDS) \u5b89\u88dd\u8207\u8a2d\u5b9a \u00ab Jamyy’s Weblog<\/a>
\u5efa\u7f6eOSSEC\u3000\u4e3b\u6a5f\u578b\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71<br>\u7db2\u8def\u5a01\u8105\u5371\u5bb3\u5927\uff0c\u842c\u5168\u6e96\u5099\u4e0d\u53ef\u5c11 – \u6280\u8853\u5c08\u6b04 – \u7db2\u7ba1\u4ebaNetAdmin<\/a>
\u6d6e\u96f2\u96c5\u7bc9: [\u7814\u7a76] OSSEC – HIDS 2.7.1 \u4e3b\u6a5f\u578b\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71 – server\/agent \u5b89\u88dd (CentOS 6.5 x64)<\/a>
How to Install OSSEC on Red Hat or CentOS 6 \u2013 scottlinux.com | Linux Blog<\/a><\/p>\n

OSSEC \u5b98\u65b9\u7db2\u7ad9\uff1ahttp:\/\/ossec.github.io<\/a><\/p>\n

1. \u589e\u52a0 atomic \u5957\u4ef6\u5eab
\u5230 http:\/\/ossec.github.io\/downloads.html<\/a> \u4e0b\u8f09\u6240\u9808\u8981\u7684\u7248\u672c
# wget http:\/\/updates.atomicorp.com\/channels\/ossec\/centos\/6\/x86_64\/RPMS\/atomic-release-1.0-21.el6.art.noarch.rpm<\/span>
# rpm -ivh atomic-release-1.0-21.el6.art.noarch.rpm<\/span>
\u6216
# wget -q -O \u2013 https:\/\/www.atomicorp.com\/installers\/atomic | sh<\/span><\/p>\n

[@more@]2. \u53d6\u6d88\u555f\u7528 atomic \u5957\u4ef6\u5eab
# sed -i ‘s\/enabled = 1\/enabled = 0\/’ \/etc\/yum.repos.d\/atomic.repo<\/span><\/p>\n

3. \u66f4\u65b0 atomic \u5957\u4ef6\u5eab
# yum update –enablerepo=atomic<\/span><\/p>\n

4. \u641c\u5c0b ossec \u76f8\u95dc\u5957\u4ef6
# yum search ossec –enablerepo=atomic<\/span>
ossec-hids-agent.x86_64 : The OSSEC HIDS Client<\/span>
ossec-hids-client.x86_64 : The OSSEC HIDS Client<\/span>
ossec-hids-debuginfo.x86_64 : Debug information for package ossec-hids<\/span>
ossec-hids-hybrid.x86_64 : The OSSEC HIDS hybrid client<\/span>
ossec-hids-mysql.x86_64 : The OSSEC HIDS Server<\/span>
ossec-hids-postgres.x86_64 : The OSSEC HIDS Server postgres connector<\/span>
ossec-hids-server.x86_64 : The OSSEC HIDS Server<\/span>
ossec-wui.noarch : OSSEC Web Interface<\/span>
ossec-hids.x86_64 : An Open Source Host-based Intrusion Detection System<\/span><\/p>\n

ossec-hids-hybird \u5305\u542b Server \/ Agent<\/span><\/p>\n

5. \u5b89\u88dd ossec \u76f8\u95dc\u5957\u4ef6
# yum install ossec-hids-mysql ossec-wui ossec-hids ossec-hids-server –enablere<\/span>po=atomic<\/span><\/p>\n

6. \u53d6\u6d88\u96fb\u5b50\u90f5\u4ef6\u901a\u77e5
# sed -i ‘s\/<email_notification>yes\/<email_notification>no\/’ \/var\/ossec\/etc\/ossec.conf<\/span><\/p>\n

7. \u5efa\u7acb ossec-wui \u7ba1\u7406\u5e33\u865f\u53ca\u5bc6\u78bc
# \/usr\/bin\/htpasswd \/usr\/share\/ossec-wui\/.htpasswd ossec<\/span>
New password:<\/span>
Re-type new password:<\/span>
Updating password for user ossec<\/span><\/p>\n

8. \u9650\u5236\u53ef\u4ee5\u9023\u7dda\u7684\u7bc4\u570d
# vim \/etc\/httpd\/conf.d\/ossec.conf<\/span>
Alias \/ossec\u00a0\u00a0\u00a0 \/usr\/share\/ossec-wui\/<\/span>
<Directory \/usr\/share\/ossec-wui\/><\/span>
\u00a0AllowOverride AuthConfig Limit<\/span>
\u00a0Order deny,allow<\/span>
\u00a0Deny from all<\/span>
\u00a0Allow from 192.168.1.0\/24<\/span><\/p>\n

\u00a0<Files *.sh><\/span>
\u00a0deny from all<\/span>
\u00a0<\/Files><\/span>
<Files ossec_conf.php><\/span>
\u00a0deny from all<\/span>
\u00a0<\/Files><\/span>
\u00a0<Files .*><\/span>
\u00a0deny from all<\/span>
\u00a0<\/Files><\/span>
<\/Directory><\/span><\/p>\n

9. \u91cd\u65b0\u555f\u52d5 Apache Web Server
# \/etc\/init.d\/httpd restart<\/span><\/p>\n

10. \u555f\u52d5 ossec-hids
# \/etc\/init.d\/ossec-hids start<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1aOSSEC \u4e3b\u6a5f\u578b\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71 (HIDS) \u5b89\u88dd\u8207\u8a2d\u5b9a \u00ab Jamyy’s Weblo … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5728 CentOS 6.x x64 \u4e0a\u5b89\u88dd OSSEC – HIDS \u4e3b\u6a5f\u578b\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117],"tags":[],"class_list":["post-19515","post","type-post","status-publish","format-standard","hentry","category-c-78462"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["687299"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19515"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19515"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19515\/revisions"}],"predecessor-version":[{"id":21031,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19515\/revisions\/21031"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19515"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19515"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19515"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}