Collecting apache logs. Manual "Detect and react to a Shellshock attack"

[Alex V.]

Hi! I'm learning wazuh with lab environment. Using wazuh OVA.
Following the instructions in "Detect and react to a Shellshock attack" manual(https://documentation.wazuh.com/current/learning-wazuh/shellshock.html), cant see any alerts generated by wazuh.

Here is my agent config, showing localfile instances.

Also I checked agent logs on /var/ossec/logs/ossec.conf, and there is no log from "wazuh-logcollector", that I assume must represent what files are scanned

So, agent doesnt send any web logs to wazuh.

[Alex V.]

Trying to collect auditd logs in next manual, and same no events coming to manager. But I still recieve authentication events "sudo to ROOT executed", so logs come to manager

вторник, 26 июля 2022 г. в 20:26:26 UTC+3, Alex V.:

[Nicolas Zapata]

Hi Alex! Thanks for using Wazuh!
Let me find more information about this. I will reply to you as soon as posible.
Regards!

[Nicolas Zapata]

Hi Alex, sorry for the delay. It is possible that your localfile setting in ossec.conf is incorrect. I recommend you check our documentation here.

In the specific documentation for the localfile section you can find more examples.
Also, keep in mind that if your logs do not follow a standard format or there are not any specific decoders for them, you will have to create custom decoders and rules. And please don't forget to restart Wazuh agent service after changes.

Best regards Nico.

[Alex V.]

Hi Nicolas!

Local config file on agent Ubuntu20.04, where web server is hosted:

<ossec_config>
  <client>
    <server>
      <address>192.168.1.30</address>
      <port>1514</port>
      <protocol>tcp</protocol>
    </server>
    <config-profile>ubuntu, ubuntu20, ubuntu20.04</config-profile>
    <notify_time>10</notify_time>
    <time-reconnect>60</time-reconnect>
    <auto_restart>yes</auto_restart>
    <crypto_method>aes</crypto_method>
    <enrollment>
      <enabled>yes</enabled>
      <groups>default</groups>
    </enrollment>
  </client>

  <client_buffer>
    <!-- Agent buffer options -->
    <disabled>no</disabled>
    <queue_size>5000</queue_size>
    <events_per_second>500</events_per_second>
  </client_buffer>

  <!-- Policy monitoring -->
  <rootcheck>
    <disabled>yes</disabled>
    <check_files>yes</check_files>
    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
    <check_ports>yes</check_ports>
    <check_if>yes</check_if>

    <!-- Frequency that rootcheck is executed - every 12 hours -->
    <frequency>43000</frequency>

    <rootkit_files>etc/shared/rootkit_files.txt</rootkit_files>
    <rootkit_trojans>etc/shared/rootkit_trojans.txt</rootkit_trojans>

    <skip_nfs>yes</skip_nfs>
  </rootcheck>

  <wodle name="cis-cat">
    <disabled>yes</disabled>
    <timeout>1800</timeout>
    <interval>1d</interval>
    <scan-on-start>yes</scan-on-start>

    <java_path>wodles/java</java_path>
    <ciscat_path>wodles/ciscat</ciscat_path>
  </wodle>

  <!-- Osquery integration -->
  <wodle name="osquery">
    <disabled>yes</disabled>
    <run_daemon>yes</run_daemon>
    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
    <config_path>/etc/osquery/osquery.conf</config_path>
    <add_labels>yes</add_labels>
  </wodle>

  <!-- System inventory -->
  <wodle name="syscollector">
    <disabled>no</disabled>
    <interval>1h</interval>
    <scan_on_start>yes</scan_on_start>
    <hardware>yes</hardware>
    <os>yes</os>
    <network>yes</network>
    <packages>yes</packages>
    <ports all="no">yes</ports>
    <processes>yes</processes>

    <!-- Database synchronization settings -->
    <synchronization>
      <max_eps>10</max_eps>
    </synchronization>
  </wodle>

  <sca>
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
    <skip_nfs>yes</skip_nfs>
  </sca>

  <!-- File integrity monitoring -->
  <syscheck>
    <disabled>no</disabled>

    <!-- Frequency that syscheck is executed default every 12 hours -->
    <frequency>43200</frequency>

    <scan_on_start>yes</scan_on_start>

    <!-- Directories to check  (perform all possible verifications) -->
    <directories>/etc,/usr/bin,/usr/sbin</directories>
    <directories>/bin,/sbin,/boot</directories>

    <!-- Files/directories to ignore -->
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/hosts.deny</ignore>
    <ignore>/etc/mail/statistics</ignore>
    <ignore>/etc/random-seed</ignore>
    <ignore>/etc/random.seed</ignore>
    <ignore>/etc/adjtime</ignore>
    <ignore>/etc/httpd/logs</ignore>
    <ignore>/etc/utmpx</ignore>
    <ignore>/etc/wtmpx</ignore>
    <ignore>/etc/cups/certs</ignore>
    <ignore>/etc/dumpdates</ignore>
    <ignore>/etc/svc/volatile</ignore>

    <!-- File types to ignore -->
    <ignore type="sregex">.log$|.swp$</ignore>

    <!-- Check the file, but never compute the diff -->
    <nodiff>/etc/ssl/private.key</nodiff>

    <skip_nfs>yes</skip_nfs>
    <skip_dev>yes</skip_dev>
    <skip_proc>yes</skip_proc>
    <skip_sys>yes</skip_sys>

    <!-- Nice value for Syscheck process -->
    <process_priority>10</process_priority>

    <!-- Maximum output throughput -->
    <max_eps>100</max_eps>

    <!-- Database synchronization settings -->
    <synchronization>
      <enabled>yes</enabled>
      <interval>5m</interval>
      <max_interval>1h</max_interval>
      <max_eps>10</max_eps>
    </synchronization>
  </syscheck>

  <!-- Log analysis -->
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/auth.log</location>
  </localfile>
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/syslog</location>
  </localfile>
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/dpkg.log</location>
  </localfile>
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/kern.log</location>
  </localfile>
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>
  </localfile>

  <!-- Custom apache logs -- >
  <localfile>
    <log_format>apache</log_format>
    <location>/var/log/apache2/access.log</location>
  </localfile>
  <localfile>
    <log_format>apache</log_format>
    <location>/var/log/apache2/error.log</location>
  </localfile>

  <localfile>
    <log_format>command</log_format>
    <command>df -P</command>
    <frequency>360</frequency>
  </localfile>

  <localfile>
    <log_format>full_command</log_format>
    <command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
    <alias>netstat listening ports</alias>
    <frequency>360</frequency>
  </localfile>

  <localfile>
    <log_format>full_command</log_format>
    <command>last -n 20</command>
    <frequency>360</frequency>
  </localfile>

  <!-- Active response -->
  <active-response>
    <disabled>no</disabled>
    <ca_store>etc/wpk_root.pem</ca_store>
    <ca_verification>yes</ca_verification>
  </active-response>

  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
  <logging>
    <log_format>plain</log_format>
  </logging>

</ossec_config>

среда, 27 июля 2022 г. в 01:04:57 UTC+3, nicolas...@wazuh.com:

[Juan Carlos Tello]

Hello Alex,

I see that you agent's ossec.conf does not include the configuration stanza suggested by the guide:

<ossec_config>
    <localfile>
        <log_format>apache</log_format>
        <location>/var/log/nginx/access.log</location>

    </localfile>

    <localfile>
        <log_format>apache</log_format>

        <location>/var/log/nginx/error.log</location>
    </localfile>
</ossec_config>

It is a common mistake to add this to the manager's /var/ossec/etc/ossec.conf file instead of in the agent. This configuration must be placed either in the agent's ossec.conf file or shared through centralized configuration (https://documentation.wazuh.com/current/user-manual/reference/centralized-configuration.html)  which uses the /var/ossec/etc/shared/*GROUP*/agent.conf file.

If this configuration is placed on the manager's ossec.conf it will only serve to monitor any apache web servers running on the manager's OS.

Let us know if you have more questions,

Best Regards,

Juan C. Tello

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/c0e66830-32c6-47fd-969e-c00d19996986n%40googlegroups.com.

[Alex V.]

Thanks everyone!

So to the mistake: agent config file ossec.conf have 2 "<ossec_conf>" entities, something like this.

<!--
  Wazuh - Agent - Default configuration for ubuntu 20.04
  More info at: https://documentation.wazuh.com
  Mailing list: https://groups.google.com/forum/#!forum/wazuh
-->

<ossec_config>
  <client>
    <server>
      <address>192.168.1.30</address>
      <port>1514</port>
      <protocol>tcp</protocol>
    </server>
    <config-profile>ubuntu, ubuntu20, ubuntu20.04</config-profile>
    <notify_time>10</notify_time>
    <time-reconnect>60</time-reconnect>
    <auto_restart>yes</auto_restart>
    <crypto_method>aes</crypto_method>

  </client>

  ...

</ossec_config>

<ossec_config>
  <localfile>
    <log_format>apache</log_format>

    <location>/var/log/apache2/error.log</location>
  </localfile>

  <localfile>

    <log_format>apache</log_format>
    <location>/var/log/apache2/access.log</location>
  </localfile>

  <localfile>

    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>

  </localfile>

   ...

</ossec_config>

Unfortunately, I had to reinstall my system to compare config files.

So here's the question: why do agent have 2 <ossec_config>?

пятница, 5 августа 2022 г. в 16:59:42 UTC+3, Juan Carlos:

[Juan Carlos Tello]

Hello Alex,

There can be multiple top level tags in the Wazuh configuration which allows you to modularly organize the settings you want to take effect. This applies to both the ossec.conf and the centralized configuration's agent.conf. When loading either the agent or the manager the Wazuh service concatenates all of these configurations so they will all take effect.

So you may safely add more if necessary to the bottom of your configuration file.

Let me know if you have any other questions that we can help with.

Best Regards,

Juan C. Tello

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/4a918322-371c-450f-9eeb-ac0522c88ab2n%40googlegroups.com.