Install and configure OSSEC ( Host-based Intrusion Detection System ) - By Subhash C

OSSEC is  used to meet PCI Compliance central logging and intrusion monitoring requirements with a free and self-managed solution. OSSEC monitors all types of logs such as syslog, apache, maillogs, mysql logs, ftp logs, and more.

1.     Deploying OSSEC core server:

2.       Extract the compressed OSSEC package and run the “./” script (It will guide you through the installation).

# tar -xvf ossec-hids-2.7.tar.gz 
# cd ossec-hids-2.7
# ./

The interactive installation begins and during this process it prompts for installation type either server or agent or local. However, installation path for OSSEC can be defined but by default it installs in (/var/ossec) directory. It is advised to select default settings and follow accordingly till the end of the installation. Finally, it is compiled and installed successfully according to the specification provided.

Select the language (in this example it is EN)

Select the type of installation as server

Accept the default folder, unless you want to change it:

Enable email notification by specifying the email address which will be used to send email alerts FROM:

If setup fails to determine your SMTP gateway automatically, you may specify it manually (change the IP as necessary to reflect your environment):

Enable integrity check daemon:

Enable rootkit detection daemon:

Whether or not you want to have “Active response” enabled is up to you. Although in prod environment, it can be quite risky.

We will not be using Syslog daemon feature in this example, so disable it.

OSSEC core server installation is now completed.

1.     Generating client keys

OSSEC server with the agent names in order to generate unique authentication keys required to bind the agent to the corresponding OSSEC server.

a. Firstly, create agents.TXT file containing the IPs and names separated by comma, of all target Linux Servers:,rwca1
b. Place this file to /var/ossec folder on OSSEC server.
c. Now execute the following command: /var/ossec/bin/manage_agents -f /agents.txt

1.    Start OSSEC Server

# /var/ossec/bin/ossec-control start
# /var/ossec/bin/ossec-control restart
#/var/ossec/bin/ossec-control stop

2.     Install the OSSEC Agents

Follow above server installation steps, instead of server choose type agent

            # tar -xvf ossec-hids-2.7.tar.gz 
# cd ossec-hids-2.7
# ./
Select the type of installation as agent

3.     Add Agents to OSSEC Manager

To add an agent to an OSSEC manager with manage_agents you need to follow the steps below.
  1. Run manage_agents on the OSSEC server.
  2. Add an agent.
  3. Extract the key for the agent.
  4. Copy that key to the agent.
  5. Run manage_agents on the agent.
  6. Import the key copied from the manager.
  7. Restart the manager’s OSSEC processes.
  8. Start and restart the agent.

4.     Verify successful installation of the agent

Then verify that the client has been installed successfully and communicating with the OSSEC server.

# tail –f /var/ossec/log/ossec.log

5.     Deploy OSSEC Web UI dashboard

Install PHP for OSSEC UI

#  yum install php-mysql php-devel php-gd php-pecl-memcache php-pspell php-snmp php-xmlrpc php-xml

# Start Apache:  /etc/init.d/httpd  start
# Configure Apache autostart: /sbin/chkconfig httpd on
# Restart Apache: /etc/init.d/httpd restart
Download OSSEC webUI module

# cd /var/ww/html/
# tar –xvf ossec-wui-0.8-alpha-0.tar.gz
# mv ossec-wui-0.8-alpha ossec-wui
# Switch to the ossec-wui and run
./ -  specify user and password to protect Web UI.

# Add apache user to ossec group: 
Change permissions for /var/ossec/tmp directory:
# chmod 770 /var/ossec/ tmp/
# chgrp apache  /var/ossec/tmp/
# /etcinit.d/httpd restart
# /var/ossec/bin/ossec-control restart (restart the OSSEC server)

Access the OSSEC web portal: http://your-ip-address/ossec-wui

in the above URL replace your-ip-address with ip address where you installed ossec-wui

Step by step tutorial to configure two node redhat clustering By -- Sojan VM

Two node Red Hat and Clustering
  management server
Configure the Shared Storage

Install the clustering software on the nodes
High availability application service “High Availability”
package group  and webserver
service ricci start
provide  passwd for ricci

Install the cluster management software on
the management server
yum groupinstall “High Availability Management”
chkconfig luci on
service luci start

Define a cluster
Node1 and Node2

Then create a partition and format

Define kvm Fence device
Cluster.conf--------------------cluster configuration fine

<?xml version="1.0"?>

<cluster config_version="6" name="cluster">


                <clusternode name="cluster_node1" nodeid="1">


                                <method name="kvm">

                                        <device domain="cluster_node1" name="kvm"/>




                <clusternode name="cluster_node2" nodeid="2">


                                <method name="kvm">

                                        <device domain="cluster_node2" name="kvm"/>





        <cman expected_votes="1" two_node="1"/>


                <fencedevice agent="fence_xvm" name="kvm"/>



Kvm Host configuration
Let's start Installing the necessary packages on the host:
yum install   fence-virt fence-virtd fence-virtd-libvirt fence-virtd-multicast
Then create the key needed for the host to authenticate all the fencing requests from the guest cluster:
dd if=/dev/urandom of=/etc/cluster/fence_xvm.key bs=4096 count=1
The key should then be copied to /etc/cluster/fence_xvm.key of every guest.
Now run the configuration tool:
fence_virtd –c
service fence_virtd start
check your fence is working or not:
fence_xvm -o reboot –H node2
Define Resources For Clustered Web Service
Shared Storage (if not in fstab)
IP address

Apache Resource

Define Failover Domains


Define Clustered Web Service
Define service
Add storage resource (if not in fstab)
Add ip address resource

add script resource

Fix : rpmdb: unable to lock mutex: Invalid argument

If you are getting this message printed out repeatedly on the terminal screen while trying to install some packages using yum
# rpmdb: unable to lock mutex: Invalid argument
yum -y update glibc ( This works sometimes )
If that doesn not work then execute below command 
rpmdb --rebuilddb -vv