Ossec is a great tool to monitor the security of a set of systems. Servers, VMs, PCs... Ossec can keep an eye on your systems and send alerts when "something" happens. "something" being defined by Ossec rules that can be a little tricky to write and keep under control.

GITS-InformationAge_clip_image003.jpg

While working at AWeber, I had to integrate the deployment of Ossec agents in Chef. The security model of Ossec requires one agent and one server to share a secret key, and this usually means that someone has to go into the server, generate the key, and push it to the agent. Ossec solved in early 2011 with a daemon called ossec-authd, but the lack of access-control and confidence in the code prevented us from using it. Instead, I wrote a cookbook for chef called chef-autossec that takes care of the entire provisioning of an ossec infrastructure:

  • Provision the Ossec server, including decoders and custom rules, using node attributes
  • Provision the Ossec agents and generate the keys based on the server configuration automatically
  • Help keep agents online by cleaning up broken connections, and forcing agents restarts
  • hostname_search leverages Chef search capability to automatically populate a list of hosts in a rule. If you want a given rule to apply to all postgres database server, and only those, you could create the rule with ':hostname_search => "roles:postgres"' and the resulting rule would have all the postgres hostnames in the "<hostname>" parameter.
  • event_location_tag and event_location_search do the same thing as hostname_search but for <email_alerts> blocks

The cookbook is available on github: https://github.com/jvehent/AutOssec

Feel free to use it, comment on it, and contribute code !