1 ossec rules reordering Mini Howto
4 Patching an Ossec installation
9 root@topgun:/var/ossec#/etc/init.d/ossec stop
13 * Backup the whole ossec directory
15 /root# tar -C /var -zcpvf ossec-orig.tar.gz ossec
19 * Move the contrib directory from the source package to the oseec installation
21 /var/ossec# cp -a /tmp/ossec/contrib .
24 * Create directories to host the rules
26 /var/ossec# mkdir signatures user_signatures repository
29 * Move the file rules_config.xml to the etc directory.
31 /var/ossec# mv rules/rules_config.xml etc/
34 * Move the rest of the rules to the repository directory
36 /var/ossec# mv rules/* repository/
39 * copy the rules tag portion to a file under /var/ossec. i.e. rules.txt
40 * delete the rules opening and closing tags
41 * remove all xml code leaving only the list of the files. i.e.
69 * modify the rules tag to:
72 <include>rules_ossec.xml</include>
75 * list of repository directory.
77 /var/ossec# ls -1 repository/
108 * Viewing the content of file rules.txt
110 /var/ossec# cat rules.txt
127 netscreenfw_rules.xml
138 * Build links to the original rules files under the signatures directory
140 /var/ossec# COUNT=0; for i in `cat rules.txt`; do
141 (( COUNT = COUNT + 1)) ;
142 ln -s ../repository/$i `printf "signatures/%02d%s" $COUNT $i`;
147 * If you wish to alterate a rule you should remove the link of the file from signature where XX denotes the two digits number prefixing the name of the file.
149 /var/ossec# unlink signatures/XXattack_rules.xml
153 * Copy the file to be modified
155 /var/ossec# cp repository/attack_rules.xml signatures/XXattack_rules.xml
161 * write your own rules file under the directory user_signatures
163 /var/ossec# cat user_signatures/user_defined.xml
164 <group name="syslog,scans">
165 <rule id="9000" level="0">
166 <regex>Accepted publickey</regex>
167 <description>Accepted publickey bypass</description>
172 * List the rules under signature
174 /var/ossec# ls -l signatures/
176 lrwxrwxrwx 1 root root 27 2006-07-24 23:37 01pam_rules.xml -> ../repository/pam_rules.xml
177 lrwxrwxrwx 1 root root 28 2006-07-24 23:37 02sshd_rules.xml -> ../repository/sshd_rules.xml
178 lrwxrwxrwx 1 root root 31 2006-07-24 23:37 03telnetd_rules.xml -> ../repository/telnetd_rules.xml
179 lrwxrwxrwx 1 root root 30 2006-07-24 23:37 04syslog_rules.xml -> ../repository/syslog_rules.xml
180 lrwxrwxrwx 1 root root 27 2006-07-24 23:37 05pix_rules.xml -> ../repository/pix_rules.xml
181 lrwxrwxrwx 1 root root 29 2006-07-24 23:37 06named_rules.xml -> ../repository/named_rules.xml
182 lrwxrwxrwx 1 root root 28 2006-07-24 23:37 07smbd_rules.xml -> ../repository/smbd_rules.xml
183 lrwxrwxrwx 1 root root 30 2006-07-24 23:37 08vsftpd_rules.xml -> ../repository/vsftpd_rules.xml
184 lrwxrwxrwx 1 root root 33 2006-07-24 23:37 09pure-ftpd_rules.xml -> ../repository/pure-ftpd_rules.xml
185 lrwxrwxrwx 1 root root 31 2006-07-24 23:37 10proftpd_rules.xml -> ../repository/proftpd_rules.xml
186 lrwxrwxrwx 1 root root 32 2006-07-24 23:37 11hordeimp_rules.xml -> ../repository/hordeimp_rules.xml
187 lrwxrwxrwx 1 root root 27 2006-07-24 23:37 12web_rules.xml -> ../repository/web_rules.xml
188 lrwxrwxrwx 1 root root 30 2006-07-24 23:37 13apache_rules.xml -> ../repository/apache_rules.xml
189 lrwxrwxrwx 1 root root 27 2006-07-24 23:37 14ids_rules.xml -> ../repository/ids_rules.xml
190 lrwxrwxrwx 1 root root 29 2006-07-24 23:37 15squid_rules.xml -> ../repository/squid_rules.xml
191 lrwxrwxrwx 1 root root 32 2006-07-24 23:37 16firewall_rules.xml -> ../repository/firewall_rules.xml
192 lrwxrwxrwx 1 root root 35 2006-07-24 23:37 17netscreenfw_rules.xml -> ../repository/netscreenfw_rules.xml
193 lrwxrwxrwx 1 root root 31 2006-07-24 23:37 18postfix_rules.xml -> ../repository/postfix_rules.xml
194 lrwxrwxrwx 1 root root 32 2006-07-24 23:37 19sendmail_rules.xml -> ../repository/sendmail_rules.xml
195 lrwxrwxrwx 1 root root 29 2006-07-24 23:37 20imapd_rules.xml -> ../repository/imapd_rules.xml
196 lrwxrwxrwx 1 root root 29 2006-07-24 23:37 21spamd_rules.xml -> ../repository/spamd_rules.xml
197 lrwxrwxrwx 1 root root 30 2006-07-24 23:37 22msauth_rules.xml -> ../repository/msauth_rules.xml
198 lrwxrwxrwx 1 root root 30 2006-07-24 23:37 23policy_rules.xml -> ../repository/policy_rules.xml
199 lrwxrwxrwx 1 root root 30 2006-07-24 23:37 24attack_rules.xml -> ../repository/attack_rules.xml
203 * Compile the alerts into a monolitic rule file.
205 /var/ossec# perl contrib/compile_alerts.pl --user-signatures /var/ossec/user_signatures --signatures \
206 /var/ossec/signatures --rules-config /var/ossec/etc/rules_config.xml > rules/rules_ossec.xml
207 Adding /var/ossec/etc/rules_config.xml
208 Adding /var/ossec/user_signatures/user_defined_rules.xml
209 Adding /var/ossec/signatures/01pam_rules.xml
210 Adding /var/ossec/signatures/02sshd_rules.xml
211 Adding /var/ossec/signatures/03telnetd_rules.xml
212 Adding /var/ossec/signatures/04syslog_rules.xml
213 Adding /var/ossec/signatures/05pix_rules.xml
214 Adding /var/ossec/signatures/06named_rules.xml
215 Adding /var/ossec/signatures/07smbd_rules.xml
216 Adding /var/ossec/signatures/08vsftpd_rules.xml
217 Adding /var/ossec/signatures/09pure-ftpd_rules.xml
218 Adding /var/ossec/signatures/10proftpd_rules.xml
219 Adding /var/ossec/signatures/11hordeimp_rules.xml
220 Adding /var/ossec/signatures/12web_rules.xml
221 Adding /var/ossec/signatures/13apache_rules.xml
222 Adding /var/ossec/signatures/14ids_rules.xml
223 Adding /var/ossec/signatures/15squid_rules.xml
224 Adding /var/ossec/signatures/16firewall_rules.xml
225 Adding /var/ossec/signatures/17netscreenfw_rules.xml
226 Adding /var/ossec/signatures/18postfix_rules.xml
227 Adding /var/ossec/signatures/19sendmail_rules.xml
228 Adding /var/ossec/signatures/20imapd_rules.xml
229 Adding /var/ossec/signatures/21spamd_rules.xml
230 Adding /var/ossec/signatures/22msauth_rules.xml
231 Adding /var/ossec/signatures/23policy_rules.xml
232 Adding /var/ossec/signatures/24attack_rules.xml
233 processing: /var/ossec/etc/rules_config.xml
234 processing: /var/ossec/user_signatures/user_defined_rules.xml
235 processing: /var/ossec/signatures/01pam_rules.xml
236 processing: /var/ossec/signatures/02sshd_rules.xml
237 processing: /var/ossec/signatures/03telnetd_rules.xml
238 processing: /var/ossec/signatures/04syslog_rules.xml
239 processing: /var/ossec/signatures/05pix_rules.xml
240 processing: /var/ossec/signatures/06named_rules.xml
241 processing: /var/ossec/signatures/07smbd_rules.xml
242 processing: /var/ossec/signatures/08vsftpd_rules.xml
243 processing: /var/ossec/signatures/09pure-ftpd_rules.xml
244 processing: /var/ossec/signatures/10proftpd_rules.xml
245 processing: /var/ossec/signatures/11hordeimp_rules.xml
246 processing: /var/ossec/signatures/12web_rules.xml
247 processing: /var/ossec/signatures/13apache_rules.xml
248 processing: /var/ossec/signatures/14ids_rules.xml
249 processing: /var/ossec/signatures/15squid_rules.xml
250 processing: /var/ossec/signatures/16firewall_rules.xml
251 processing: /var/ossec/signatures/17netscreenfw_rules.xml
252 processing: /var/ossec/signatures/18postfix_rules.xml
253 processing: /var/ossec/signatures/19sendmail_rules.xml
254 processing: /var/ossec/signatures/20imapd_rules.xml
255 processing: /var/ossec/signatures/21spamd_rules.xml
256 processing: /var/ossec/signatures/22msauth_rules.xml
257 processing: /var/ossec/signatures/23policy_rules.xml
258 processing: /var/ossec/signatures/24attack_rules.xml
262 * Now you can start again ossec
264 /var/ossec#/etc/init.d/ossec start
265 Starting OSSEC Starting OSSEC HIDS v0.9 (by Daniel B. Cid)...
266 Started ossec-maild...
267 Started ossec-execd...
268 Started ossec-analysisd...
269 Started ossec-logcollector...
270 Started ossec-remoted...
271 Started ossec-syscheckd...
276 Extract of ossec.conf with the modified rules tag
278 /var/ossec# cat etc/ossec.conf
281 <include>rules_ossec.xml</include>