From 495280d9dc4ff5efd555f50e65a120df1b780003 Mon Sep 17 00:00:00 2001 From: Dominik Lisiak Date: Sat, 13 Oct 2018 20:51:51 +0200 Subject: Initial commit for version 3.0.0 --- .../ossec-hids-local-config/files/agent-conf.in | 33 +++++++++ .../files/command-last-logins.sh.in | 8 +++ .../files/command-open-ports.sh.in | 19 +++++ .../ossec-hids-local-config/files/command.conf.in | 6 ++ .../files/merge-config.sh.in | 32 +++++++++ .../files/message-agent-conf.in | 3 + .../files/message-ossec-conf.in | 3 + .../ossec-hids-local-config/files/message-pf.in | 4 ++ .../ossec-hids-local-config/files/ossec-conf.in | 60 ++++++++++++++++ .../ossec-hids-local-config/files/pkg-deinstall.in | 10 +++ .../ossec-hids-local-config/files/pkg-install.in | 32 +++++++++ .../files/rules-cmdout.xml.in | 67 ++++++++++++++++++ .../files/rules-config.xml.in | 52 ++++++++++++++ .../files/template-ar-cmds-default.xml.in | 38 ++++++++++ .../files/template-ar-cmds-merge.xml.in | 10 +++ .../files/template-ar-fwdrop.xml.in | 13 ++++ .../files/template-ar-hostdeny.xml.in | 12 ++++ .../files/template-ar-merge.xml.in | 11 +++ .../files/template-ar-restart.xml.in | 11 +++ .../files/template-cmdout-last-logins.xml.in | 10 +++ .../files/template-cmdout-open-ports-tcp.xml.in | 28 ++++++++ .../files/template-cmdout-open-ports-udp.xml.in | 28 ++++++++ .../files/template-header-disabled.xml.in | 10 +++ .../files/template-header-enabled.xml.in | 4 ++ .../files/template-header-sample.xml.in | 1 + .../files/template-logs-apache.xml.in | 28 ++++++++ .../files/template-logs-default.xml.in | 68 ++++++++++++++++++ .../files/template-logs-nginx.xml.in | 28 ++++++++ .../files/template-logs-radius.xml.in | 18 +++++ .../files/template-logs-response.xml.in | 18 +++++ .../files/template-logs-vsftpd.xml.in | 18 +++++ .../files/template-rootcheck-default.xml.in | 23 ++++++ .../files/template-rules-cmdout.xml.in | 8 +++ .../files/template-rules-config.xml.in | 8 +++ .../files/template-rules-default.xml.in | 82 ++++++++++++++++++++++ .../files/template-sample-agent.xml.in | 14 ++++ .../files/template-sample-database.xml.in | 12 ++++ .../files/template-sample-local.xml.in | 17 +++++ .../files/template-sample-server.xml.in | 23 ++++++ .../files/template-syscheck-default.xml.in | 18 +++++ .../files/template-syscheck-hostdeny.xml.in | 16 +++++ .../files/template-syscheck-newfiles.xml.in | 16 +++++ .../files/template-syscheck-noauto.xml.in | 16 +++++ .../files/template-syscheck-ossec.xml.in | 18 +++++ 44 files changed, 954 insertions(+) create mode 100644 security/ossec-hids-local-config/files/agent-conf.in create mode 100644 security/ossec-hids-local-config/files/command-last-logins.sh.in create mode 100644 security/ossec-hids-local-config/files/command-open-ports.sh.in create mode 100644 security/ossec-hids-local-config/files/command.conf.in create mode 100644 security/ossec-hids-local-config/files/merge-config.sh.in create mode 100644 security/ossec-hids-local-config/files/message-agent-conf.in create mode 100644 security/ossec-hids-local-config/files/message-ossec-conf.in create mode 100644 security/ossec-hids-local-config/files/message-pf.in create mode 100644 security/ossec-hids-local-config/files/ossec-conf.in create mode 100644 security/ossec-hids-local-config/files/pkg-deinstall.in create mode 100644 security/ossec-hids-local-config/files/pkg-install.in create mode 100644 security/ossec-hids-local-config/files/rules-cmdout.xml.in create mode 100644 security/ossec-hids-local-config/files/rules-config.xml.in create mode 100644 security/ossec-hids-local-config/files/template-ar-cmds-default.xml.in create mode 100644 security/ossec-hids-local-config/files/template-ar-cmds-merge.xml.in create mode 100644 security/ossec-hids-local-config/files/template-ar-fwdrop.xml.in create mode 100644 security/ossec-hids-local-config/files/template-ar-hostdeny.xml.in create mode 100644 security/ossec-hids-local-config/files/template-ar-merge.xml.in create mode 100644 security/ossec-hids-local-config/files/template-ar-restart.xml.in create mode 100644 security/ossec-hids-local-config/files/template-cmdout-last-logins.xml.in create mode 100644 security/ossec-hids-local-config/files/template-cmdout-open-ports-tcp.xml.in create mode 100644 security/ossec-hids-local-config/files/template-cmdout-open-ports-udp.xml.in create mode 100644 security/ossec-hids-local-config/files/template-header-disabled.xml.in create mode 100644 security/ossec-hids-local-config/files/template-header-enabled.xml.in create mode 100644 security/ossec-hids-local-config/files/template-header-sample.xml.in create mode 100644 security/ossec-hids-local-config/files/template-logs-apache.xml.in create mode 100644 security/ossec-hids-local-config/files/template-logs-default.xml.in create mode 100644 security/ossec-hids-local-config/files/template-logs-nginx.xml.in create mode 100644 security/ossec-hids-local-config/files/template-logs-radius.xml.in create mode 100644 security/ossec-hids-local-config/files/template-logs-response.xml.in create mode 100644 security/ossec-hids-local-config/files/template-logs-vsftpd.xml.in create mode 100644 security/ossec-hids-local-config/files/template-rootcheck-default.xml.in create mode 100644 security/ossec-hids-local-config/files/template-rules-cmdout.xml.in create mode 100644 security/ossec-hids-local-config/files/template-rules-config.xml.in create mode 100644 security/ossec-hids-local-config/files/template-rules-default.xml.in create mode 100644 security/ossec-hids-local-config/files/template-sample-agent.xml.in create mode 100644 security/ossec-hids-local-config/files/template-sample-database.xml.in create mode 100644 security/ossec-hids-local-config/files/template-sample-local.xml.in create mode 100644 security/ossec-hids-local-config/files/template-sample-server.xml.in create mode 100644 security/ossec-hids-local-config/files/template-syscheck-default.xml.in create mode 100644 security/ossec-hids-local-config/files/template-syscheck-hostdeny.xml.in create mode 100644 security/ossec-hids-local-config/files/template-syscheck-newfiles.xml.in create mode 100644 security/ossec-hids-local-config/files/template-syscheck-noauto.xml.in create mode 100644 security/ossec-hids-local-config/files/template-syscheck-ossec.xml.in (limited to 'security/ossec-hids-local-config/files') diff --git a/security/ossec-hids-local-config/files/agent-conf.in b/security/ossec-hids-local-config/files/agent-conf.in new file mode 100644 index 0000000..673d0f6 --- /dev/null +++ b/security/ossec-hids-local-config/files/agent-conf.in @@ -0,0 +1,33 @@ +#!/bin/sh + +ossec_type="%%OSSEC_TYPE%%" +ossec_home="%%OSSEC_HOME%%" + +agent_conf_dir="${ossec_home}/etc/agent.conf.d" +agent_conf_files="${agent_conf_dir}/*.conf" + +select_elements() { + local element="$1" + sed -n "/<${element}.*>/,/<\/${element}>/p" +} + +remove_comments() { + # Comments must be on separate lines i.e. not next to uncommented code + awk '// {off=2} /([\s\S]*)/ {if (off==0) print; if (off==2) off=0}' +} + +remove_empty_lines() { + sed '/^\s*$/d' +} + +agent_conf() { + + echo "" + echo + echo "" + echo + + cat $@ | remove_comments | select_elements "agent_config" | remove_empty_lines +} + +agent_conf "${agent_conf_files}" diff --git a/security/ossec-hids-local-config/files/command-last-logins.sh.in b/security/ossec-hids-local-config/files/command-last-logins.sh.in new file mode 100644 index 0000000..7bd8242 --- /dev/null +++ b/security/ossec-hids-local-config/files/command-last-logins.sh.in @@ -0,0 +1,8 @@ +#!/bin/sh + +# This script is part of FreeBSD port - report any issues to the port MAINTAINER + +ossec_home="%%OSSEC_HOME%%" +. "${ossec_home}/etc/command.conf" + +last -n ${last_logins} diff --git a/security/ossec-hids-local-config/files/command-open-ports.sh.in b/security/ossec-hids-local-config/files/command-open-ports.sh.in new file mode 100644 index 0000000..d5ba047 --- /dev/null +++ b/security/ossec-hids-local-config/files/command-open-ports.sh.in @@ -0,0 +1,19 @@ +#!/bin/sh + +# This script is part of FreeBSD port - report any issues to the port MAINTAINER + +family=$1 +protocol=$2 +ports=$3 + +if [ -z "${ports}" ]; then + privileged_ports="1-$((`sysctl -n net.inet.ip.portrange.first` - 1))" + + ossec_home="%%OSSEC_HOME%%" + . "${ossec_home}/etc/command.conf" + + ports="privileged_${protocol}_ports" + eval ports=\$${ports} +fi + +sockstat -l -${family} -P ${protocol} -p ${ports} | grep -Eo '[^[:space:]]+:[0-9]+' | sort -u diff --git a/security/ossec-hids-local-config/files/command.conf.in b/security/ossec-hids-local-config/files/command.conf.in new file mode 100644 index 0000000..b6ef2ad --- /dev/null +++ b/security/ossec-hids-local-config/files/command.conf.in @@ -0,0 +1,6 @@ +#!/bin/sh + +last_logins=5 + +privileged_tcp_ports=${privileged_ports},10050-10051 +privileged_udp_ports=${privileged_ports} diff --git a/security/ossec-hids-local-config/files/merge-config.sh.in b/security/ossec-hids-local-config/files/merge-config.sh.in new file mode 100644 index 0000000..a7939f7 --- /dev/null +++ b/security/ossec-hids-local-config/files/merge-config.sh.in @@ -0,0 +1,32 @@ +#!/bin/sh + +# This script is part of FreeBSD port - report any issues to the port MAINTAINER + +ossec_type="%%OSSEC_TYPE%%" +ossec_home="%%OSSEC_HOME%%" +ossec_rc="%%OSSEC_RC%%" + +ACTION=$1 +USER=$2 +IP=$3 + +LOCAL=`dirname $0`; +cd $LOCAL +cd ../../tmp + +# Logging the call +echo "`date` $0 $1 $2 $3 $4 $5" >> "${ossec_home}/logs/active-responses.log" + +case ${ACTION} in + add) + "${ossec_rc}" merge_config + exit 0 + ;; + delete) + exit 0 + ;; + *) + echo "$0: invalid action: ${ACTION}" + exit 1 + ;; +esac diff --git a/security/ossec-hids-local-config/files/message-agent-conf.in b/security/ossec-hids-local-config/files/message-agent-conf.in new file mode 100644 index 0000000..8d61c0d --- /dev/null +++ b/security/ossec-hids-local-config/files/message-agent-conf.in @@ -0,0 +1,3 @@ +The "agent.conf" must no longer be used for configuration. It will be +overwritten by merged "*.conf" files from the configuration directory: +%%OSSEC_HOME%%/etc/agent.conf.d diff --git a/security/ossec-hids-local-config/files/message-ossec-conf.in b/security/ossec-hids-local-config/files/message-ossec-conf.in new file mode 100644 index 0000000..d6170ca --- /dev/null +++ b/security/ossec-hids-local-config/files/message-ossec-conf.in @@ -0,0 +1,3 @@ +The "ossec.conf" must no longer be used for configuration. It will be +overwritten by merged "*.conf" files from the configuration directory: +%%OSSEC_HOME%%/etc/ossec.conf.d diff --git a/security/ossec-hids-local-config/files/message-pf.in b/security/ossec-hids-local-config/files/message-pf.in new file mode 100644 index 0000000..707e44b --- /dev/null +++ b/security/ossec-hids-local-config/files/message-pf.in @@ -0,0 +1,4 @@ +Add the ossec_fwtable to /etc/pf.conf if using "firewall-drop" active response: + table persist + block in quick from to any + block out quick from any to diff --git a/security/ossec-hids-local-config/files/ossec-conf.in b/security/ossec-hids-local-config/files/ossec-conf.in new file mode 100644 index 0000000..d28d238 --- /dev/null +++ b/security/ossec-hids-local-config/files/ossec-conf.in @@ -0,0 +1,60 @@ +#!/bin/sh + +ossec_type="%%OSSEC_TYPE%%" +ossec_home="%%OSSEC_HOME%%" + +ossec_conf_dir="${ossec_home}/etc/ossec.conf.d" +ossec_conf_files="${ossec_conf_dir}/*.conf" + +select_elements_content() { + local element="$1" + sed -n "/<${element}>/,/<\/${element}>/{ /<${element}>/d; /<\/${element}>/d; p; }" +} + +remove_elements() { + local element="$1" + sed -e "/<${element}>/,/<\/${element}>/d" +} + +remove_comments() { + # Comments must be on separate lines i.e. not next to uncommented code + awk '// {off=2} /([\s\S]*)/ {if (off==0) print; if (off==2) off=0}' +} + +remove_empty_lines() { + sed '/^\s*$/d' +} + +ossec_conf() { + echo "" + echo + echo "" + echo + echo "" + + if [ "${ossec_type}" != "agent" ]; then + if cat $@ | remove_comments | grep -q ""; then + echo " " + cat $@ | remove_comments | select_elements_content "rules" | remove_empty_lines + echo " " + fi + fi + + if cat $@ | remove_comments | grep -q ""; then + echo " " + cat $@ | remove_comments | select_elements_content "rootcheck" | remove_empty_lines + echo " " + fi + + if cat $@ | remove_comments | grep -q ""; then + echo " " + cat $@ | remove_comments | select_elements_content "syscheck" | remove_empty_lines + echo " " + fi + + cat $@ | remove_comments | select_elements_content "ossec_config" | remove_elements "rules" | remove_elements "rootcheck" | remove_elements "syscheck" | remove_empty_lines + + echo "" +} + +ossec_conf "${ossec_conf_files}" diff --git a/security/ossec-hids-local-config/files/pkg-deinstall.in b/security/ossec-hids-local-config/files/pkg-deinstall.in new file mode 100644 index 0000000..0de19bf --- /dev/null +++ b/security/ossec-hids-local-config/files/pkg-deinstall.in @@ -0,0 +1,10 @@ +#!/bin/sh + +ossec_home="%%OSSEC_HOME%%" +ossec_conf="${ossec_home}/etc/ossec.conf" +agent_conf="${ossec_home}/etc/shared/agent.conf" + +if [ "$2" == "DEINSTALL" ]; then + rm -f "${ossec_conf}" + rm -f "${agent_conf}" +fi diff --git a/security/ossec-hids-local-config/files/pkg-install.in b/security/ossec-hids-local-config/files/pkg-install.in new file mode 100644 index 0000000..f164b9c --- /dev/null +++ b/security/ossec-hids-local-config/files/pkg-install.in @@ -0,0 +1,32 @@ +#!/bin/sh + +ossec_home="%%OSSEC_HOME%%" +ar_bin_dir="${ossec_home}/active-response/bin" +ossec_conf="${ossec_home}/etc/ossec.conf" +ossec_conf_bak="${ossec_conf}.bak" +agent_conf="${ossec_home}/etc/shared/agent.conf" +agent_conf_bak="${ossec_home}/etc/agent.conf.bak" + +if [ "$2" == "POST-INSTALL" ]; then + ln -f "${ar_bin_dir}/%%FW_DROP%%" "${ar_bin_dir}/firewall-drop.sh" + + if [ -e "${ossec_conf}" ]; then + mv -f "${ossec_conf}" "${ossec_conf_bak}" + echo + echo "WARNING:" + echo " Existing \"${ossec_conf}\" has been saved to \"${ossec_conf_bak}\"." + echo + fi + + case "$1" in + ossec-hids-server*) + if [ -e "${agent_conf}" ]; then + mv -f "${agent_conf}" "${agent_conf_bak}" + echo + echo "WARNING:" + echo " Existing \"${agent_conf}\" has been saved to \"${agent_conf_bak}\"." + echo + fi + ;; + esac +fi diff --git a/security/ossec-hids-local-config/files/rules-cmdout.xml.in b/security/ossec-hids-local-config/files/rules-cmdout.xml.in new file mode 100644 index 0000000..59e3f4b --- /dev/null +++ b/security/ossec-hids-local-config/files/rules-cmdout.xml.in @@ -0,0 +1,67 @@ + + + + + 530 + ossec: output: 'freebsd-last-logins' + + List of the last logged in users. + + + + 530 + ossec: output: 'freebsd-open-ports-tcp4-all' + + Listening IPv4 TCP port opened or closed. + + + + 530 + ossec: output: 'freebsd-open-ports-tcp4' + + Listening IPv4 TCP port opened or closed. + + + + 530 + ossec: output: 'freebsd-open-ports-tcp6-all' + + Listening IPv6 TCP port opened or closed. + + + + 530 + ossec: output: 'freebsd-open-ports-tcp6' + + Listening IPv6 TCP port opened or closed. + + + + 530 + ossec: output: 'freebsd-open-ports-udp4-all' + + Listening IPv4 UDP port opened or closed. + + + + 530 + ossec: output: 'freebsd-open-ports-udp4' + + Listening IPv4 UDP port opened or closed. + + + + 530 + ossec: output: 'freebsd-open-ports-udp6-all' + + Listening IPv6 UDP port opened or closed. + + + + 530 + ossec: output: 'freebsd-open-ports-udp6' + + Listening IPv6 UDP port opened or closed. + + + diff --git a/security/ossec-hids-local-config/files/rules-config.xml.in b/security/ossec-hids-local-config/files/rules-config.xml.in new file mode 100644 index 0000000..2853c4a --- /dev/null +++ b/security/ossec-hids-local-config/files/rules-config.xml.in @@ -0,0 +1,52 @@ + + + + + syscheck + %%OSSEC_HOME%%/etc/ossec.conf.d + ossec.conf.d has been modified + + + + syscheck + %%OSSEC_HOME%%/etc/ossec.conf + ossec.conf has been modified + + + + syscheck + /var/ossec/etc/ossec.conf.d + ossec.conf.d has been modified + + + + syscheck + /var/ossec/etc/ossec.conf + ossec.conf has been modified + + + + syscheck + %%OSSEC_HOME%%/etc/agent.conf.d + agent.conf.d has been modified + + + + syscheck + %%OSSEC_HOME%%/etc/shared/agent.conf + agent.conf has been modified + + + + syscheck + /var/ossec/etc/agent.conf.d + agent.conf.d has been modified + + + + syscheck + /var/ossec/etc/shared/agent.conf + agent.conf has been modified + + + diff --git a/security/ossec-hids-local-config/files/template-ar-cmds-default.xml.in b/security/ossec-hids-local-config/files/template-ar-cmds-default.xml.in new file mode 100644 index 0000000..1e2dfaa --- /dev/null +++ b/security/ossec-hids-local-config/files/template-ar-cmds-default.xml.in @@ -0,0 +1,38 @@ + + + + + host-deny + host-deny.sh + srcip + yes + + + + firewall-drop + firewall-drop.sh + srcip + yes + + + + disable-account + disable-account.sh + user + yes + + + + restart-ossec + restart-ossec.sh + + + + + route-null + route-null.sh + srcip + yes + + + diff --git a/security/ossec-hids-local-config/files/template-ar-cmds-merge.xml.in b/security/ossec-hids-local-config/files/template-ar-cmds-merge.xml.in new file mode 100644 index 0000000..ec2ec7e --- /dev/null +++ b/security/ossec-hids-local-config/files/template-ar-cmds-merge.xml.in @@ -0,0 +1,10 @@ + + + + + merge-config + merge-config.sh + + + + diff --git a/security/ossec-hids-local-config/files/template-ar-fwdrop.xml.in b/security/ossec-hids-local-config/files/template-ar-fwdrop.xml.in new file mode 100644 index 0000000..415de6c --- /dev/null +++ b/security/ossec-hids-local-config/files/template-ar-fwdrop.xml.in @@ -0,0 +1,13 @@ + + + + + + + firewall-drop + local + 6 + 600 + + + diff --git a/security/ossec-hids-local-config/files/template-ar-hostdeny.xml.in b/security/ossec-hids-local-config/files/template-ar-hostdeny.xml.in new file mode 100644 index 0000000..59b3488 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-ar-hostdeny.xml.in @@ -0,0 +1,12 @@ + + + + + + host-deny + local + 6 + 600 + + + diff --git a/security/ossec-hids-local-config/files/template-ar-merge.xml.in b/security/ossec-hids-local-config/files/template-ar-merge.xml.in new file mode 100644 index 0000000..f38d226 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-ar-merge.xml.in @@ -0,0 +1,11 @@ + + + + + + merge-config + local + 56001,56003,56021,56023 + + + diff --git a/security/ossec-hids-local-config/files/template-ar-restart.xml.in b/security/ossec-hids-local-config/files/template-ar-restart.xml.in new file mode 100644 index 0000000..064167e --- /dev/null +++ b/security/ossec-hids-local-config/files/template-ar-restart.xml.in @@ -0,0 +1,11 @@ + + + + + + restart-ossec + local + 56002,56004,56022,56024 + + + diff --git a/security/ossec-hids-local-config/files/template-cmdout-last-logins.xml.in b/security/ossec-hids-local-config/files/template-cmdout-last-logins.xml.in new file mode 100644 index 0000000..88975ca --- /dev/null +++ b/security/ossec-hids-local-config/files/template-cmdout-last-logins.xml.in @@ -0,0 +1,10 @@ + + + + + full_command + %%OSSEC_HOME%%/bin/command/last-logins.sh + freebsd-last-logins + + + diff --git a/security/ossec-hids-local-config/files/template-cmdout-open-ports-tcp.xml.in b/security/ossec-hids-local-config/files/template-cmdout-open-ports-tcp.xml.in new file mode 100644 index 0000000..c602821 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-cmdout-open-ports-tcp.xml.in @@ -0,0 +1,28 @@ + + + + + full_command + %%OSSEC_HOME%%/bin/command/open-ports.sh 4 tcp 1-65535 + freebsd-open-ports-tcp4-all + + + + full_command + %%OSSEC_HOME%%/bin/command/open-ports.sh 4 tcp + freebsd-open-ports-tcp4 + + + + full_command + %%OSSEC_HOME%%/bin/command/open-ports.sh 6 tcp 1-65535 + freebsd-open-ports-tcp6-all + + + + full_command + %%OSSEC_HOME%%/bin/command/open-ports.sh 6 tcp + freebsd-open-ports-tcp6 + + + diff --git a/security/ossec-hids-local-config/files/template-cmdout-open-ports-udp.xml.in b/security/ossec-hids-local-config/files/template-cmdout-open-ports-udp.xml.in new file mode 100644 index 0000000..d5c3fc8 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-cmdout-open-ports-udp.xml.in @@ -0,0 +1,28 @@ + + + + + full_command + %%OSSEC_HOME%%/bin/command/open-ports.sh 4 udp 1-65535 + freebsd-open-ports-udp4-all + + + + full_command + %%OSSEC_HOME%%/bin/command/open-ports.sh 4 udp + freebsd-open-ports-udp4 + + + + full_command + %%OSSEC_HOME%%/bin/command/open-ports.sh 6 udp 1-65535 + freebsd-open-ports-udp6-all + + + + full_command + %%OSSEC_HOME%%/bin/command/open-ports.sh 6 udp + freebsd-open-ports-udp6 + + + diff --git a/security/ossec-hids-local-config/files/template-header-disabled.xml.in b/security/ossec-hids-local-config/files/template-header-disabled.xml.in new file mode 100644 index 0000000..627fa27 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-header-disabled.xml.in @@ -0,0 +1,10 @@ + + + + + + diff --git a/security/ossec-hids-local-config/files/template-header-enabled.xml.in b/security/ossec-hids-local-config/files/template-header-enabled.xml.in new file mode 100644 index 0000000..224916b --- /dev/null +++ b/security/ossec-hids-local-config/files/template-header-enabled.xml.in @@ -0,0 +1,4 @@ + + + + diff --git a/security/ossec-hids-local-config/files/template-header-sample.xml.in b/security/ossec-hids-local-config/files/template-header-sample.xml.in new file mode 100644 index 0000000..e0772c3 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-header-sample.xml.in @@ -0,0 +1 @@ + diff --git a/security/ossec-hids-local-config/files/template-logs-apache.xml.in b/security/ossec-hids-local-config/files/template-logs-apache.xml.in new file mode 100644 index 0000000..b88ed1a --- /dev/null +++ b/security/ossec-hids-local-config/files/template-logs-apache.xml.in @@ -0,0 +1,28 @@ + + + + + apache + /var/log/httpd-error.log + + + + apache + /var/log/httpd-access.log + + + + + + + + apache + /var/log/apache2/error.log + + + + apache + /var/log/apache2/access.log + + + diff --git a/security/ossec-hids-local-config/files/template-logs-default.xml.in b/security/ossec-hids-local-config/files/template-logs-default.xml.in new file mode 100644 index 0000000..47b9a77 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-logs-default.xml.in @@ -0,0 +1,68 @@ + + + + + syslog + /var/log/auth.log + + + + syslog + /var/log/maillog + + + + syslog + /var/log/messages + + + + syslog + /var/log/security + + + + syslog + /var/log/userlog + + + + syslog + /var/log/xferlog + + + + + + + + syslog + /var/log/auth.log + + + + syslog + /var/log/dpkg.log + + + + syslog + /var/log/kern.log + + + + syslog + /var/log/mail.log + + + + syslog + /var/log/messages + + + + syslog + /var/log/syslog + + + diff --git a/security/ossec-hids-local-config/files/template-logs-nginx.xml.in b/security/ossec-hids-local-config/files/template-logs-nginx.xml.in new file mode 100644 index 0000000..7d25cf8 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-logs-nginx.xml.in @@ -0,0 +1,28 @@ + + + + + apache + /var/log/nginx/error.log + + + + apache + /var/log/nginx/access.log + + + + + + + + apache + /var/log/nginx/error.log + + + + apache + /var/log/nginx/access.log + + + diff --git a/security/ossec-hids-local-config/files/template-logs-radius.xml.in b/security/ossec-hids-local-config/files/template-logs-radius.xml.in new file mode 100644 index 0000000..0b10c4b --- /dev/null +++ b/security/ossec-hids-local-config/files/template-logs-radius.xml.in @@ -0,0 +1,18 @@ + + + + + syslog + /var/log/radius.log + + + + + + + + syslog + /var/log/freeradius/radius.log + + + diff --git a/security/ossec-hids-local-config/files/template-logs-response.xml.in b/security/ossec-hids-local-config/files/template-logs-response.xml.in new file mode 100644 index 0000000..17828ea --- /dev/null +++ b/security/ossec-hids-local-config/files/template-logs-response.xml.in @@ -0,0 +1,18 @@ + + + + + syslog + %%OSSEC_HOME%%/logs/active-responses.log + + + + + + + + syslog + /var/ossec/logs/active-responses.log + + + diff --git a/security/ossec-hids-local-config/files/template-logs-vsftpd.xml.in b/security/ossec-hids-local-config/files/template-logs-vsftpd.xml.in new file mode 100644 index 0000000..9f63a21 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-logs-vsftpd.xml.in @@ -0,0 +1,18 @@ + + + + + syslog + /var/log/vsftpd.log + + + + + + + + syslog + /var/log/vsftpd.log + + + diff --git a/security/ossec-hids-local-config/files/template-rootcheck-default.xml.in b/security/ossec-hids-local-config/files/template-rootcheck-default.xml.in new file mode 100644 index 0000000..63e5f1e --- /dev/null +++ b/security/ossec-hids-local-config/files/template-rootcheck-default.xml.in @@ -0,0 +1,23 @@ + + + + + %%OSSEC_HOME%%/etc/shared/rootkit_files.txt + %%OSSEC_HOME%%/etc/shared/rootkit_trojans.txt + %%OSSEC_HOME%%/etc/shared/system_audit_rcl.txt + %%OSSEC_HOME%%/etc/shared/system_audit_ssh.txt + + + + + + + + /var/ossec/etc/shared/rootkit_files.txt + /var/ossec/etc/shared/rootkit_trojans.txt + /var/ossec/etc/shared/system_audit_rcl.txt + /var/ossec/etc/shared/system_audit_ssh.txt + /var/ossec/etc/shared/cis_debian_linux_rcl.txt + + + diff --git a/security/ossec-hids-local-config/files/template-rules-cmdout.xml.in b/security/ossec-hids-local-config/files/template-rules-cmdout.xml.in new file mode 100644 index 0000000..482efd6 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-rules-cmdout.xml.in @@ -0,0 +1,8 @@ + + + + + freebsd_cmdout_rules.xml + + + diff --git a/security/ossec-hids-local-config/files/template-rules-config.xml.in b/security/ossec-hids-local-config/files/template-rules-config.xml.in new file mode 100644 index 0000000..2e9102f --- /dev/null +++ b/security/ossec-hids-local-config/files/template-rules-config.xml.in @@ -0,0 +1,8 @@ + + + + + freebsd_config_rules.xml + + + diff --git a/security/ossec-hids-local-config/files/template-rules-default.xml.in b/security/ossec-hids-local-config/files/template-rules-default.xml.in new file mode 100644 index 0000000..e7c18be --- /dev/null +++ b/security/ossec-hids-local-config/files/template-rules-default.xml.in @@ -0,0 +1,82 @@ + + + + + rules_config.xml + ossec_rules.xml + syslog_rules.xml + sendmail_rules.xml + postfix_rules.xml + spamd_rules.xml + imapd_rules.xml + mailscanner_rules.xml + ms-exchange_rules.xml + courier_rules.xml + firewall_rules.xml + pix_rules.xml + netscreenfw_rules.xml + cisco-ios_rules.xml + sonicwall_rules.xml + pam_rules.xml + telnetd_rules.xml + sshd_rules.xml + solaris_bsm_rules.xml + asterisk_rules.xml + ms_dhcp_rules.xml + arpwatch_rules.xml + symantec-av_rules.xml + symantec-ws_rules.xml + trend-osce_rules.xml + hordeimp_rules.xml + roundcube_rules.xml + wordpress_rules.xml + cimserver_rules.xml + dovecot_rules.xml + vmpop3d_rules.xml + vpopmail_rules.xml + ftpd_rules.xml + proftpd_rules.xml + pure-ftpd_rules.xml + vsftpd_rules.xml + ms_ftpd_rules.xml + named_rules.xml + exim_rules.xml + smbd_rules.xml + racoon_rules.xml + vpn_concentrator_rules.xml + msauth_rules.xml + mcafee_av_rules.xml + ms-se_rules.xml + vmware_rules.xml + ids_rules.xml + apache_rules.xml + web_rules.xml + zeus_rules.xml + nginx_rules.xml + php_rules.xml + web_appsec_rules.xml + squid_rules.xml + attack_rules.xml + systemd_rules.xml + firewalld_rules.xml + mysql_rules.xml + postgresql_rules.xml + dropbear_rules.xml + openbsd_rules.xml + apparmor_rules.xml + clam_av_rules.xml + openbsd-dhcpd_rules.xml + nsd_rules.xml + owncloud_rules.xml + proxmox-ve_rules.xml + opensmtpd_rules.xml + psad_rules.xml + sysmon_rules.xml + unbound_rules.xml + local_rules.xml + + + + + + diff --git a/security/ossec-hids-local-config/files/template-sample-agent.xml.in b/security/ossec-hids-local-config/files/template-sample-agent.xml.in new file mode 100644 index 0000000..8a2fa7b --- /dev/null +++ b/security/ossec-hids-local-config/files/template-sample-agent.xml.in @@ -0,0 +1,14 @@ + + + + + + 1.2.3.4 + + + + + + + + diff --git a/security/ossec-hids-local-config/files/template-sample-database.xml.in b/security/ossec-hids-local-config/files/template-sample-database.xml.in new file mode 100644 index 0000000..80f156f --- /dev/null +++ b/security/ossec-hids-local-config/files/template-sample-database.xml.in @@ -0,0 +1,12 @@ + + + + + localhost + ossec + secret + ossec + %%DB_TYPE%% + + + diff --git a/security/ossec-hids-local-config/files/template-sample-local.xml.in b/security/ossec-hids-local-config/files/template-sample-local.xml.in new file mode 100644 index 0000000..bf1ec5c --- /dev/null +++ b/security/ossec-hids-local-config/files/template-sample-local.xml.in @@ -0,0 +1,17 @@ + + + + + + + + + 127.0.0.1 + + + diff --git a/security/ossec-hids-local-config/files/template-sample-server.xml.in b/security/ossec-hids-local-config/files/template-sample-server.xml.in new file mode 100644 index 0000000..d4efd19 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-sample-server.xml.in @@ -0,0 +1,23 @@ + + + + + secure + + 1.2.3.4 + + + + + + + + 127.0.0.1 + + + diff --git a/security/ossec-hids-local-config/files/template-syscheck-default.xml.in b/security/ossec-hids-local-config/files/template-syscheck-default.xml.in new file mode 100644 index 0000000..78ae8f8 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-syscheck-default.xml.in @@ -0,0 +1,18 @@ + + + + + /bin,/sbin,/usr/bin,/usr/sbin,%%PREFIX%%/bin,%%PREFIX%%/sbin + /etc,%%PREFIX%%/etc + + + + + + + + /bin,/sbin,/usr/bin,/usr/sbin,/usr/local/bin,/usr/local/sbin + /etc,/usr/local/etc + + + diff --git a/security/ossec-hids-local-config/files/template-syscheck-hostdeny.xml.in b/security/ossec-hids-local-config/files/template-syscheck-hostdeny.xml.in new file mode 100644 index 0000000..f35f4d5 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-syscheck-hostdeny.xml.in @@ -0,0 +1,16 @@ + + + + + /etc/hosts.allow + + + + + + + + /etc/hosts.deny + + + diff --git a/security/ossec-hids-local-config/files/template-syscheck-newfiles.xml.in b/security/ossec-hids-local-config/files/template-syscheck-newfiles.xml.in new file mode 100644 index 0000000..7a303e5 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-syscheck-newfiles.xml.in @@ -0,0 +1,16 @@ + + + + + yes + + + + + + + + yes + + + diff --git a/security/ossec-hids-local-config/files/template-syscheck-noauto.xml.in b/security/ossec-hids-local-config/files/template-syscheck-noauto.xml.in new file mode 100644 index 0000000..03f5943 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-syscheck-noauto.xml.in @@ -0,0 +1,16 @@ + + + + + no + + + + + + + + no + + + diff --git a/security/ossec-hids-local-config/files/template-syscheck-ossec.xml.in b/security/ossec-hids-local-config/files/template-syscheck-ossec.xml.in new file mode 100644 index 0000000..8342f63 --- /dev/null +++ b/security/ossec-hids-local-config/files/template-syscheck-ossec.xml.in @@ -0,0 +1,18 @@ + + + + + %%OSSEC_SYSCHECK_BIN_DIRS%% + %%OSSEC_SYSCHECK_ETC_DIRS%% + + + + + + + + /var/ossec/bin,/var/ossec/active-response,/var/ossec/agentless + /var/ossec/etc,/var/ossec/rules + + + -- cgit v1.2.3