OSSEC简要介绍:
ossec-hids-2.7-beta1
10.10.10.240 ossec server
10.10.10.141 ossec client1
[root@logserver src]# cd ossec-hids-2.7-beta1/
[root@logserver ossec-hids-2.7-beta1]# cd src
[root@logserver src]# make setdb
Info: Compiled with MySQL support
[root@logserver ossec-hids-2.7-beta1]# mysql -u root -p
mysql> create database ossec;
Query OK, 1 row affected (0.04 sec)
mysql> grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on ossec.* to ossecuser@ identified by 'ossecpass';
Query OK, 0 rows affected (0.10 sec)
Query OK, 0 rows affected (0.00 sec)
# PARAMS USED BY OSSEC2BASED
dbhost=localhost
database=ossecuser
debug=5
dbport=3306
dbpasswd=ossecpass
dbuser=ossec
daemonize=0
sensor=centralserver
hids_inter>
<hostname>10.10.10.137</hostname>
<username>ossecuser</username>
<password>ossecpass</password>
<database>ossec</database>
<type>mysql</type>
</database_output>
</ossec_config>
Starting OSSEC HIDS v2.7-beta1 (by Trend Micro Inc.)...
Started ossec-execd...
Started ossec-agentd...
Started ossec-logcollector...
Started ossec-syscheckd...
Completed.
You have new mail in /var/spool/mail/root
udp 0 0 10.10.10.141:35928 10.10.10.240:1514 ESTABLISHED 28558/ossec-agentd
[root@db ossec-wui-0.3]# ls
CONTRIB css htaccess_def.txt img index.php js lib LICENSE ossec_conf.php README README.search setup.sh site
[root@db ossec-wui-0.3]# cp -Rf * /usr/local/ossec/
[root@db ossec-wui-0.3]# cd /usr/local/ossec/
Alias /ossec/ "/usr/local/ossec/"
<Directory "/usr/local/ossec/">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
# Order deny,allow
# Deny from all
# Allow from 127.0.0.1
AuthName "OSSEC AUTH"
AuthType Basic
AuthUserFile /usr/local/ossec/.htpasswd
Require valid-user