OSSEC: Ubuntu 18.04 - Revision history

Onnowpurbo: /* Pranala Menarik */

2020-03-30T00:36:51Z

Pranala Menarik

← Older revision		Revision as of 00:36, 30 March 2020
Line 134:		Line 134:
	* [[IDS]]		* [[IDS]]
	* [[OSSEC]]		* [[OSSEC]]
			* [[OSSEC: Ubuntu 18.04]]
	* [[OSSEC: whitelisting]]		* [[OSSEC: whitelisting]]

Onnowpurbo: /* Pranala Menarik */

2020-03-30T00:30:00Z

Pranala Menarik

← Older revision		Revision as of 00:30, 30 March 2020
Line 133:		Line 133:

	* [[IDS]]		* [[IDS]]
			* [[OSSEC]]
			* [[OSSEC: whitelisting]]

Onnowpurbo: /* Run */

2020-03-30T00:17:35Z

Run

← Older revision		Revision as of 00:17, 30 March 2020
Line 118:		Line 118:
	Konfigurasi di		Konfigurasi di
	/var/ossec/etc/ossec.conf		/var/ossec/etc/ossec.conf

			==Log==

			Log penting yang di catat oleh OSSEC HIDS dapat di baca di

			/var/ossec/logs/

			File yang berisi hal yang penting antara lain adalah

			/var/ossec/logs/active-responses.log
			/var/ossec/logs/alerts/alerts.log

	==Pranala Menarik==		==Pranala Menarik==

	* [[IDS]]		* [[IDS]]

Onnowpurbo: /* Run */

2020-03-29T23:53:34Z

Run

@@ Line 117: / Line 117: @@
 Konfigurasi di
+  /var/ossec/etc/ossec.conf
 ==Pranala Menarik==
 * [[IDS]]

Onnowpurbo: /* Selesai & Bisa digunakan */

2020-03-29T23:53:08Z

Selesai & Bisa digunakan

← Older revision		Revision as of 23:53, 29 March 2020
Line 108:		Line 108:


	==~~Selesai & Bisa digunakan~~==		==Run==

	Run		Run
Line 116:		Line 116:
	/var/ossec/bin/ossec-control stop		/var/ossec/bin/ossec-control stop

			Konfigurasi di

Onnowpurbo: /* Cuplikan Proses Instalasi */

2020-03-29T23:52:10Z

Cuplikan Proses Instalasi

← Older revision		Revision as of 23:52, 29 March 2020
Line 17:		Line 17:
	==Cuplikan Proses Instalasi==		==Cuplikan Proses Instalasi==

	'''CATATAN:''' Sebagian besar cukup tekan '''ENTER'''		'''CATATAN:'''
			* Sebagian besar cukup tekan '''ENTER'''
			* Jika notifikasi email di enable, kita perlu memasukan email address.

Onnowpurbo: /* Selesai Compile */

2020-03-29T23:51:21Z

Selesai Compile

← Older revision		Revision as of 23:51, 29 March 2020
Line 88:		Line 88:

	- Configuration finished properly.		- Configuration finished properly.

	- To start OSSEC HIDS:		- To start OSSEC HIDS:
	/var/ossec/bin/ossec-control start		/var/ossec/bin/ossec-control start

	- To stop OSSEC HIDS:		- To stop OSSEC HIDS:
	/var/ossec/bin/ossec-control stop		/var/ossec/bin/ossec-control stop

	- The configuration can be viewed or modified at /var/ossec/etc/ossec.conf		- The configuration can be viewed or modified at /var/ossec/etc/ossec.conf


	Thanks for using the OSSEC HIDS.		Thanks for using the OSSEC HIDS.
	If you have any question, suggestion or if you find any bug,		If you have any question, suggestion or if you find any bug,
Line 103:		Line 102:
	our public maillist at		our public maillist at
	https://groups.google.com/forum/#!forum/ossec-list		https://groups.google.com/forum/#!forum/ossec-list

	More information can be found at http://www.ossec.net		More information can be found at http://www.ossec.net


			==Selesai & Bisa digunakan==

			Run
			/var/ossec/bin/ossec-control start

			Stop
			/var/ossec/bin/ossec-control stop

Onnowpurbo: /* Cuplikan Proses Instalasi */

2020-03-29T23:46:38Z

Cuplikan Proses Instalasi

← Older revision		Revision as of 23:46, 29 March 2020
Line 84:		Line 84:
	Any questions about the configuration can be answered		Any questions about the configuration can be answered
	by visiting us online at http://www.ossec.net .		by visiting us online at http://www.ossec.net .

			==Selesai Compile==

			- Configuration finished properly.

			- To start OSSEC HIDS:
			/var/ossec/bin/ossec-control start

			- To stop OSSEC HIDS:
			/var/ossec/bin/ossec-control stop

			- The configuration can be viewed or modified at /var/ossec/etc/ossec.conf


			Thanks for using the OSSEC HIDS.
			If you have any question, suggestion or if you find any bug,
			contact us at https://github.com/ossec/ossec-hids or using
			our public maillist at
			https://groups.google.com/forum/#!forum/ossec-list

			More information can be found at http://www.ossec.net

Onnowpurbo: /* Cuplikan Proses Instalasi */

2020-03-29T23:44:40Z

Cuplikan Proses Instalasi

← Older revision		Revision as of 23:44, 29 March 2020
Line 50:		Line 50:
	- Running syscheck (integrity check daemon).		- Running syscheck (integrity check daemon).
	3.3- Do you want to run the rootkit detection engine? (y/n) [y]: '''ENTER'''		3.3- Do you want to run the rootkit detection engine? (y/n) [y]: '''ENTER'''
			3.4- Active response allows you to execute a specific
			command based on the events received. For example,
			you can block an IP address or disable access for
			a specific user.
			More information at:
			http://www.ossec.net/en/manual.html#active-response
			- Do you want to enable active response? (y/n) [y]: ''''ENTER'''
			- Active response enabled.

			- By default, we can enable the host-deny and the
			firewall-drop responses. The first one will add
			a host to the /etc/hosts.deny and the second one
			will block the host on iptables (if linux) or on
			ipfilter (if Solaris, FreeBSD or NetBSD).
			- They can be used to stop SSHD brute force scans,
			portscans and some other forms of attacks. You can
			also add them to block on snort events, for example.
			- Do you want to enable the firewall-drop response? (y/n) [y]: '''ENTER'''

			- firewall-drop enabled (local) for levels >= 6
			-
			- 127.0.0.53
			- Do you want to add more IPs to the white list? (y/n)? [n]: '''ENTER'''

			3.5- Do you want to enable remote syslog (port 514 udp)? (y/n) [y]:
			- Remote syslog enabled.
			3.6- Setting the configuration to analyze the following logs:
			-- /var/log/auth.log
			-- /var/log/syslog
			-- /var/log/dpkg.log
			- If you want to monitor any other file, just change
			the ossec.conf and add a new localfile entry.
			Any questions about the configuration can be answered
			by visiting us online at http://www.ossec.net .

Onnowpurbo: /* Cuplikan Proses Instalasi */

2020-03-29T23:41:51Z

Cuplikan Proses Instalasi

← Older revision		Revision as of 23:41, 29 March 2020
Line 15:		Line 15:


	===Cuplikan Proses Instalasi===		==Cuplikan Proses Instalasi==

	'''CATATAN:''' Sebagian besar cukup tekan '''ENTER'''		'''CATATAN:''' Sebagian besar cukup tekan '''ENTER'''