全网最详细的最新稳定OSSEC搭建部署（ossec-server（CentOS7.X）和ossec-agent（CentOS7.X）)（图文详解）

vim /etc/selinux/config 

systemctl stop firewalld.service #停止firewall 
systemctl disable firewalld.service #禁止firewall开机启动 

yum install iptables-services #安装 
gedit /etc/sysconfig/iptables #编辑防火墙配置文件 

# Firewall configuration written by system-config-firewall 
# Manual customization of this file isnot recommended. 
*filter 
:INPUT ACCEPT [0:0] 
:FORWARD ACCEPT [0:0] 
:OUTPUT ACCEPT [0:0] 
-A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT 
-A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT 
-A INPUT -m state –state NEW -m tcp -p tcp –dport 3306 -j ACCEPT 
-A INPUT -m state –state NEW -m udp -p udp –dport 514 -j ACCEPT 
-A INPUT -m state –state NEW -m udp -p udp –dport 1514 -j ACCEPT 
-A INPUT -j REJECT –reject-with icmp-host-prohibited 
-A FORWARD -j REJECT –reject-with icmp-host-prohibited 
COMMIT 

-A INPUT -m state –state NEW -m udp -p udp –dport 514 -j ACCEPT 
-A INPUT -m state –state NEW -m udp -p udp –dport 1514 -j ACCEPT

systemctl restart iptables.service #最后重启防火墙使配置生效 
systemctl enable iptables.service #设置防火墙开机启动

[root@ossec-server ~] yum install wget gcc make mysql mysql-server mysql-devel httpd php php-mysql sendmail

[root@ossec-server ~] /etc/init.d/httpd start

[root@ossec-server ~] /etc/init.d/mysqld start

[root@ossec-server ~] /etc/init.d/sendmail start

[root@ossec-server ~] for i in {httpd,mysqld,sendmail}; do service $i restart; done

[root@ossec-server ~] mysql -uroot -p
mysql>create database ossec;
mysql> grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on ossec.*to ossec@localhost;
mysql> set password for ossec@localhost =PASSWORD('ossec');
mysql>flush privileges;
mysql> exit

[root@ossec-server ~] # wget http://www.ossec.net/files/ossec-hids-2.8.1.tar.gz
[root@ossec-server ~] # tar zxf ossec-hids-2.8.1.tar.gz
[root@ossec-server ~] # cd ossec-hids-2.8.1

[root@ossec-server ~] # cd src; make setdb; cd ..

Info: Compiled with MySQL support.

[root@ossec-server  ossec-hids-2.8.1]# ./install.sh
  ** Para instalação em português, escolha [br].
  ** 要使用中文进行安装, 请选择 [cn].
  ** Fur eine deutsche Installation wohlen Sie [de].
  ** Για εγκατάσταση στα Ελληνικά, επιλέξτε [el].
  ** For installation in English, choose [en].
  ** Para instalar en Español , eliga [es].
  ** Pour une installation en français, choisissez [fr]
  ** A Magyar nyelvű telepítéshez válassza [hu].
  ** Per l'installazione in Italiano, scegli [it].
  ** 日本語でインストールします．選択して下さい．[jp].
  ** Voor installatie in het Nederlands, kies [nl].
  ** Aby instalować w języku Polskim, wybierz [pl][/pl].
  ** Для инструкций по установке на русском ,введите [ru].
  ** Za instalaciju na srpskom, izaberi [sr].
  ** Türkçe kurulum için seçin [tr].
  (en/br/cn/de/el/es/fr/hu/it/jp/nl/pl/ru/sr/tr) [en]: cn
 OSSEC HIDS v2.8.1 安装脚本 - http://www.ossec.net

[root@ossec-server ossec-hids-2.8.1]# /var/ossec/bin/ossec-control enable database

[root@ossec-server ossec-hids-2.8.1]# mysql -uossec -p ossec < ./src/os_dbd/mysql.schema

[root@ossec-server ossec-hids-2.8.1]# chmod u+w /var/ossec/etc/ossec.conf

<ossec_config>
    <database_output>
        <hostname>192.168.80.31</hostname>
        <username>ossec</username>
        <password>ossec</password>
        <database>ossec</database>
        <type>mysql</type>
    </database_output>
</ossec_config>

  <remote>
    <connection>syslog</connection>
    <allowed-ips>192.168.0.0/16</allowed-ips>
  </remote>

[[root@ossec-server logs]# cat /var/ossec/logs/ossec.log
2018/03/5 23:43:15 ossec-analysisd(1210): ERROR: Queue '/queue/alerts/ar' not accessible: 'Connection refused'.
2018/03/5 23:43:15 ossec-analysisd(1301): ERROR: Unable to connect to active response queue.

[[root@ossec-server logs]# /var/ossec/bin/manage_agents
   ****************************************
   * OSSEC HIDS v2.8.1 Agent manager.     *
   * The following options are available: *
   ****************************************
      (A)dd an agent (A).
      (E)xtract key for an agent (E).
      (L)ist already added agents (L).
      (R)emove an agent (R).
      (Q)uit.

****************************************
   * OSSEC HIDS v2.8.1 Agent manager.     *
   * The following options are available: *
   ****************************************
      (A)dd an agent (A).
      (E)xtract key for an agent (E).
      (L)ist already added agents (L).
      (R)emove an agent (R).
      (Q)uit.

[root@ossec-server ~] # /var/ossec/bin/ossec-control start

[root@ossec-server ~] # /etc/init.d/ossec start

[root@ossec-agent ~]# wget http://www.ossec.net/files/ossec-hids-2.8.1.tar.gz
[root@ossec-agent ~]# tar zxf ossec-hids-2.8.1.tar.gz
[root@ossec-agent ~]# cd ossec-hids-2.8.1
[root@ossec-agent ~]# ./install.sh 

[root@ossec-agent ossec-hids-2.8.1]# /var/ossec/bin/manage_agents

***************************************
* OSSEC HIDS v2.8.1 Agent manager.     *
* The following options are available: *
****************************************
   (I)mport key from the server (I).
   (Q)uit.

[root@ossec-agent ossec-hids-2.8.1]# /var/ossec/bin/ossec-control start

[root@ossec-agent ossec-hids-2.8.1]# /etc/init.d/ossec start

[root@ossec-server ~]# wget https://github.com/ECSC/analogi/archive/master.zip
[root@ossec-server ~]# unzip master
[root@ossec-server ~]# mv analogi-master/ /var/www/html/analogi
[root@ossec-server ~]# cd /var/www/html/
[root@ossec-serverhtml]# chown -R apache.apache analogi/
[root@ossec-server html]# cd analogi/
[root@ossec-server analogi]# cp db_ossec.php.new db_ossec.php

define ('DB_USER_O', 'ossec');
define ('DB_PASSWORD_O', 'ossec');
define ('DB_HOST_O', '127.0.0.1');
define ('DB_NAME_O', 'ossec');

[root@ossec-server ~]# vim /etc/httpd/conf.d/analogi.conf

Alias /analogi /var/www/html/analogi
<Directory /var/www/html/analogi>
    Order deny,allow
    Deny from all
    Allow from 192.168.0.0/16
</Directory>

[root@ossec-server ~]# /etc/init.d/httpd restart

[root@ossec-server html]# service httpd status
Redirecting to /bin/systemctl status httpd.service
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
   Active: active (running) since Tue 2018-03-06 05:47:09 CST; 23s ago
     Docs: man:httpd(8)
           man:apachectl(8)
  Process: 3873 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=0/SUCCESS)
 Main PID: 3878 (httpd)
   Status: "Total requests: 21; Current requests/sec: 0; Current traffic:   0 B/sec"
   CGroup: /system.slice/httpd.service
           ├─3878 /usr/sbin/httpd -DFOREGROUND
           ├─3880 /usr/sbin/httpd -DFOREGROUND
           ├─3881 /usr/sbin/httpd -DFOREGROUND
           ├─3882 /usr/sbin/httpd -DFOREGROUND
           ├─3883 /usr/sbin/httpd -DFOREGROUND
           ├─3884 /usr/sbin/httpd -DFOREGROUND
           └─3889 /usr/sbin/httpd -DFOREGROUND
Mar 06 05:47:08 ossec-server systemd[1]: Starting The Apache HTTP Server...
Mar 06 05:47:09 ossec-server httpd[3878]: AH00558: httpd: Could not reliably determin...ge
Mar 06 05:47:09 ossec-server systemd[1]: Started The Apache HTTP Server.
Hint: Some lines were ellipsized, use -l to show in full.
[root@ossec-server html]# 

[root@localhost conf.d]# systemctl stop firewalld.service
[root@localhost httpd]# setenforce 0

https://github.com/ossec/ossec-wui/releases

[root@ossec-server html]# pwd
/var/www/html
[root@ossec-server html]# ls
analogi  ossec-wui-0.9.zip
[root@ossec-server html]# unzip ossec-wui-master.zip
unzip:  cannot find or open ossec-wui-master.zip, ossec-wui-master.zip.zip or ossec-wui-master.zip.ZIP.
[root@ossec-server html]# ll
total 184
drwxr-xr-x 5 apache apache   4096 Mar  6 05:48analogi
-rw-r--r-- 1 root   root   182791 Mar  6 10:40 ossec-wui-0.9.zip
[root@ossec-server html]# yum -y install unzip
[root@ossec-server html]# unzip ossec-wui-master.zip

[root@ossec-server html]# pwd
/var/www/html
[root@ossec-server html]# ls
analogi  ossec-wui-0.9.tar.gz
[root@ossec-server html]# tar -zxvf ossec-wui-0.9.tar.gz 

[root@ossec-server html]# pwd
/var/www/html
[root@ossec-server html]# ls
analogi  ossec-wui-0.9  ossec-wui-0.9.tar.gz
[root@ossec-server html]# rm ossec-wui-0.9.tar.gz 
rm: remove regular file ‘ossec-wui-0.9.tar.gz’?y
[root@ossec-server html]# mv ossec-wui-0.9/ossec
[root@ossec-server html]# ls
analogi  ossec
[root@ossec-server html]# cd ossec/
[root@ossec-server ossec]# ls
CONTRIB  htaccess_def.txt  index.php  lib      ossec_conf.php  README.search  site
css      img               js         LICENSE  README          setup.sh
[root@ossec-server ossec]# ./setup.sh 
Setting up ossec ui...
Username: ossec
New password: 
Re-type newpassword: 
Adding password foruser ossec
Enter your web server user name (e.g. apache, www, nobody, www-data, ...)
apache
You must restart your web server after this setup isdone.
Setup completed successfully.
[root@ossec-server ossec]# 

[root@ossec-server ossec]# vim /etc/httpd/conf.d/ossec.conf 

同时，大家可以关注我的个人博客：

http://www.cnblogs.com/zlslch/和 http://www.cnblogs.com/lchzls/ http://www.cnblogs.com/sunnyDream/

详情请见：http://www.cnblogs.com/zlslch/p/7473861.html

人生苦短，我愿分享。本公众号将秉持活到老学到老学习无休止的交流分享开源精神，汇聚于互联网和个人学习工作的精华干货知识，一切来于互联网，反馈回互联网。
目前研究领域：大数据、机器学习、深度学习、人工智能、数据挖掘、数据分析。 语言涉及：Java、Scala、Python、Shell、Linux等 。同时还涉及平常所使用的手机、电脑和互联网上的使用技巧、问题和实用软件。 只要你一直关注和呆在群里，每天必须有收获

对应本平台的讨论和答疑QQ群：大数据和人工智能躺过的坑（总群）（161156071）