環境準備
server:192.168.244.3
client: 192.168.244.4
2.搭建ftp來下載配置文件
[root@ossec-server ~]# yum -y install httpd [root@ossec-server ~]# service httpd start [root@ossec-server ~]# mkdir /var/www/html/ossec [root@ossec-server ~]# cd /var/www/html/ossec [root@ossec-server ossec]# systemctl stop firewalld
3.訪問http://192.168.244.3/ossec
4.創建存放ip地址信息的文件ip.txt
[root@ossec-server ~]# cat ip.txt agent01:192.168.244.4
5. 創建用來生成key的腳本
#!python # -*- coding: utf-8 -*- import os if __name__ == '__main__': save_keys_path = "keys.logs" f = open("ip.txt") lines = f.read().splitlines() f.close() #perl文件在安裝包裏面 shell_path ="/root/ossec-hids-2.8.3/contrib/ossec-batch-manager.pl" for line in lines: arr = line.split(":") host_name = arr[0] ip = arr[1] #服務端根據name和ip添加客戶端 cmd = "%s -a --ip %s --name %s" % (shell_path,ip,host_name) os.system(cmd) cmd = "%s -e %s >> %s" % (shell_path,ip,save_keys_path) os.system(cmd)
6.安裝必要的包
yum -y install perl-Digest-MD5 yum -y install perl-Time-HiRes
7.生成key文件/var/ossec/etc/client.keys
8.執行腳本
[root@ossec-server ~]# python key_gen.py [root@ossec-server ~]# cat /var/ossec/etc/client.keys 001 agent01 192.168.244.4 316260854925970ce8953064b1ff2fafe1245f38dd06ed1203a60f9a465a9f44
9,將客戶端所需文件和包放在ftp裏
[root@ossec-server ~]# cd /var/www/html/ossec [root@ossec-server ossec]# tar xf ossec_client_conf.tar.gz [root@ossec-server ossec]# ll total 2416 -rw-r--r-- 1 root root 93 Dec 15 21:49 client.keys -rw-r--r-- 1 root root 820077 Dec 16 02:22 ossec_client_conf.tar.gz -rw-r--r-- 1 root root 2781 Dec 28 23:55 ossec.conf -rw-r--r-- 1 root root 1634812 Apr 17 2015 ossec-hids-2.8.3.tar.gz -rwxr-xr-x 1 root root 3275 Dec 16 02:16 preloaded-vars.conf 修改配置文件變成無交互自動安裝 [root@ossec-server ossec]# grep -Ev '^#|^$' preloaded-vars.conf USER_LANGUAGE="en" # For english USER_NO_STOP="y" USER_INSTALL_TYPE="agent" USER_DIR="/var/ossec" USER_ENABLE_ACTIVE_RESPONSE="y" USER_ENABLE_SYSCHECK="y" USER_ENABLE_ROOTCHECK="y" USER_AGENT_SERVER_IP="192.168.244.3"
10.客戶端批量agent批量安裝
[root@ossec-client01 ~]# yum -y install gcc [root@ossec-client01 ~]# systemctl stop firewalld
11.執行腳本自動安裝agent客戶端
[root@ossec-client01 ~]# sh ossec-agent-batch-install.sh [root@ossec-client01 ~]# cat ossec-agent-batch-install.sh #!/bin/bash yum -y install gcc cd /usr/local wget http://192.168.244.3/ossec/ossec-hids-2.8.3.tar.gz tar xf ossec-hids-2.8.3.tar.gz cd ossec-hids-2.8.3/etc/ mv preloaded-vars.conf preloaded-vars.conf.bak wget http://192.168.244.3/ossec/preloaded-vars.conf cd .. ./install.sh cd /opt/ossec/etc wget http://192.168.244.3/ossec/client.keys HOST_IP=`/sbin/ifconfig eth0 |grep 'Bcast' |cut -d: -f2 |cut -d' ' -f1` sed -i '/'$HOST_IP'/!'d /opt/ossec/etc/client.keys rm -rf ossec.conf wget http://192.168.244.3/ossec/ossec.conf cd .. ./bin/ossec-control start
12. 查看端口
[root@ossec-client01 ~]# netstat -lanpu |grep ossec udp 0 0 192.168.244.4:60090 192.168.244.3:1514 ESTABLISHED 4827/ossec-agentd [root@ossec-server ~]# /var/ossec/bin/agent_control -lc OSSEC HIDS agent_control. List of available agents: ID: 000, Name: ossec-server (server), IP: 127.0.0.1, Active/Local ID: 001, Name: agent01, IP: 192.168.244.4, Active