Deploying Ossec HIDS via Active Directory Part 2 - Automating the Windows Agent Configuration

In the first part of this series we went over getting a large number of agents to the Ossec Server from an easy to setup list of machines via script and getting the client.keys file ready.  Then we went ahead and installed the MAKEMSI package and all of it's requisites.  After a little break, here we are again to go over the next part... automating the windows agent installation.

There's been a void for some time in the Ossec world - no pre-designed Windows deployment tools.  Many people have been left with the option of either figuring this out themselves or sneaker-netting all around the company and installing and configuring the agents one at a time.  One at a time was just not an option for me with a few hundred agents to install, so I figured it out - with some help.  Now that the work has been done I'm trying to help fill that void so that other admins might be able to get this done and move on to the next project more quickly.

Our next step is to setup some scripts that will need to handle some key tasks for us to automate the install.

We need this script to:
             a: determine where the Ossec Agent is installed
             b: get the key for the machine we are deploying to and generate it's ossec.keys file
             c: configure the Ossec Agent to connect to our Server and
             d: restart the Ossec service on our client PC so that it starts reporting

We might also want the script to perform some checks throughout the process and let our users know if the install failed so that they can let us know.

Here is the setup script for 32-bit machines (text shrunken to preserve formatting).  You should keep the names of the script files as noted unless you are very familiar with MAKEMSI and can do the editing needed to the MSI build scripts.

ossec_distribute_keys.cmd


<*Begin copy here*>

@ECHO OFF

::*****************************************

::* SET YOUR OSSEC SERVER IP ADDRESS *

::*****************************************

SET OSSECSERVER=***Ossec Server IP here***

::*******************************************************************************************************

::* DEFINE OSSECPATH VARIABLE AS SET BY THE Ossec HIDS INSTALLATION IN THE WINDOWS REGISTRY *

::*******************************************************************************************************

FOR /f "tokens=1-2,*" %%i in ('reg query HKEY_LOCAL_MACHINE\SOFTWARE\ossec

^| find "Install_Dir"') do SET OSSECPATH=%%k

IF "%OSSECPATH:~-1%"==" " SET OSSECPATH=%OSSECPATH:~0,-1% 

::*********************************************************************************************

::* VERIFY THAT OSSEC INSTALLED SUCCESSFULLY BEFORE PROCEEDING TO CONFIGURATION *

::*********************************************************************************************

IF DEFINED OSSECPATH (ECHO Ossec installation found at %OSSECPATH%. Continuing with configuration.)

IF NOT DEFINED OSSECPATH GOTO EXIT_ON_ERROR

::****************************************

::* CHECK FOR MASTER CLIENT KEYFILE *

::****************************************

 IF EXIST "%CD%\ossec.keys" ECHO Client keyfile index found - Getting security configuration information.

IF NOT EXIST "%CD%\ossec.keys" GOTO MASTER_KEYFILE_NOT_FOUND

::*******************************************

::* ENABLE DELAYED VARIABLE EXPANSION *

::*******************************************

@ECHO OFF > "%OSSECPATH%\client.keys" & SETLOCAL ENABLEDELAYEDEXPANSION

::********************************************************************************************************

::* FIND COMPUTERNAME IN  MASTER KEYFILE THEN GENERATE SPECIFIC AGENT KEYFILE IN OSSECPATH *

::********************************************************************************************************

findstr /I /C:"%COMPUTERNAME%" ossec.keys > "%OSSECPATH%\client.keys"

::***********************************************************************

::* CONFIGURE ossec.conf FILE BEFORE RESTARTING OSSEC HIDS SERVICE *

::***********************************************************************

SET LINE1=^<ossec_config^>

SET LINE2=  ^<client^>

SET LINE3=   ^<server-ip^>%OSSECSERVER%^</server-ip^>

SET LINE4=  ^</client^>

SET LINE5=^</ossec_config^>

ECHO !LINE1!>>"%OSSECPATH%\ossec.conf"

ECHO !LINE2!>>"%OSSECPATH%\ossec.conf"

ECHO !LINE3!>>"%OSSECPATH%\ossec.conf"

ECHO !LINE4!>>"%OSSECPATH%\ossec.conf"

ECHO !LINE5!>>"%OSSECPATH%\ossec.conf"

::**************************************

::* Restart Ossec Service and begin monitoring *

::**************************************

NET STOP OSSECSVC

NET START OSSECSVC

::**************************************************************************************

::* NOTIFY USERS/TECHS THAT INSTALLATION AND CONFIGURATION WAS SUCCESSFUL *

::**************************************************************************************

MSG * Ossec HIDS installation and configuration completed successfully. Click OK to exit

::***********************************************************************
::* DELETE SENSITIVE FILES ONCE INSTALL IS COMPLETE AND VERIFIED *
::***********************************************************************

DEL "%OSSECPATH%\ossec.keys"

DEL "%OSSECPATH%\ossec_distribute_keys.cmd"

EXIT

::*********************************************************

::* NOTIFY USERS/TECHS IF OSSEC INSTALLATION FAILED *

::*********************************************************

:EXIT_ON_ERROR

MSG * Ossec installation Failed.  Please contact support for assistance.

EXIT

::***********************************************************

::* NOTIFY USERS/TECHS IF MASTER KEYFILE IS NOT FOUND *

::***********************************************************

:MASTER_KEYFILE_NOT_FOUND

MSG * Client keyfile not found - Manual security configuration required.  Please contact support for assistance.

EXIT

<*End copy here*>

And here is the script for x64 machines

ossec_distribute_keys_x64.cmd

<*Begin copy below here*>

@ECHO OFF


::**********************************************
::* SET YOUR OSSEC SERVER IP ADDRESS HERE *
::**********************************************
SET OSSECSERVER=***Ossec Server IP here***

::*******************************************************************************************************
::* DEFINE OSSECPATH VARIABLE AS SET BY THE Ossec HIDS INSTALLATION IN THE WINDOWS REGISTRY *
::*******************************************************************************************************
SETLOCAL ENABLEDELAYEDEXPANSION
FOR /f "tokens=1-2,*" %%i in ('reg query HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ossec
^| find "Install_Dir"') do SET OSSECPATH=%%k
IF "!OSSECPATH:~-1!"==" " SET OSSECPATH="!OSSECPATH:~0,-1!"

::*********************************************************************************************
::* VERIFY THAT OSSEC INSTALLED SUCCESSFULLY BEFORE PROCEEDING TO CONFIGURATION *
::*********************************************************************************************
IF DEFINED OSSECPATH (ECHO Ossec installation found at !OSSECPATH!. Continuing with configuration.)
IF NOT DEFINED OSSECPATH GOTO EXIT_ON_ERROR

::****************************************
::* CHECK FOR MASTER CLIENT KEYFILE *
::****************************************
IF EXIST "%CD%\ossec.keys" ECHO Client keyfile index found - Getting security configuration information.
IF NOT EXIST "%CD%\ossec.keys" GOTO MASTER_KEYFILE_NOT_FOUND

::*******************************************
::* ENABLE DELAYED VARIABLE EXPANSION *
::*******************************************
@ECHO OFF > %OSSECPATH%\ossec.keys & SETLOCAL ENABLEDELAYEDEXPANSION

::********************************************************************************************************
::* FIND COMPUTERNAME IN  MASTER KEYFILE THEN GENERATE SPECIFIC AGENT KEYFILE IN OSSECPATH *
::********************************************************************************************************
findstr /I /C:"%COMPUTERNAME%" ossec.keys > "%OSSECPATH%\client.keys"

::***********************************************************************
::* CONFIGURE ossec.conf FILE BEFORE RESTARTING OSSEC HIDS SERVICE *
::***********************************************************************
SET LINE1=^<ossec_config^>
SET LINE2=  ^<client^>
SET LINE3=   ^<server-ip^>%OSSECSERVER%^</server-ip^>
SET LINE4=  ^</client^>
SET LINE5=^</ossec_config^>

ECHO !LINE1!>>"%OSSECPATH%\ossec.conf"
ECHO !LINE2!>>"%OSSECPATH%\ossec.conf"
ECHO !LINE3!>>"%OSSECPATH%\ossec.conf"
ECHO !LINE4!>>"%OSSECPATH%\ossec.conf"
ECHO !LINE5!>>"%OSSECPATH%\ossec.conf"

::**************************************
::* Restart Ossec Service and begin monitoring *
::**************************************
NET STOP OSSECSVC
NET START OSSECSVC

::**************************************************************************************
::* NOTIFY USERS/TECHS THAT INSTALLATION AND CONFIGURATION WAS SUCCESSFUL *
::**************************************************************************************
MSG * Ossec HIDS installation and configuration completed successfully. Click OK to EXIT

::***********************************************************************

::* DELETE SENSITIVE FILES ONCE INSTALL IS COMPLETE AND VERIFIED *

::***********************************************************************

DEL "%OSSECPATH%\ossec.keys"
DEL "%OSSECPATH%\ossec_distribute_keys_x64.cmd"
EXIT



::*********************************************************
::* NOTIFY USERS/TECHS IF OSSEC INSTALLATION FAILED *
::*********************************************************
:EXIT_ON_ERROR
MSG * Ossec installation Failed.  Please contact support for assistance.
EXIT



::******************************************************I*****
::* NOTIFY USERS/TECHS IF MASTER KEYFILE IS NOT FOUND *
::***********************************************************
:MASTER_KEYFILE_NOT_FOUND
MSG * Client keyfile not found - Manual security configuration required.  Please contact support for assistance.
EXIT

<*End copy here*>


You'll need to edit the first variable to configure this to work in your environment. 


SET OSSECSERVER=***Ossec Server IP here***


This should be pretty self-explanatory.  The rest of the script should not need any modification.  Save these files and tuck them away for now...we need to get our MAKEMSI scripts ready.  These are quite a bit more complicated so i'll do my best to keep all of the configuration items on the tops of the scripts.


The reason for separate 32-bit and 64-bit configuration files is that even though the installs are somewhat similar, the differences that exist make it very difficult to merge the code into one file and I am trying to keep it as simple and easy to understand as possible so that everyone can follow what is happening in the scripts so that if there is something else that you need to do in your deployment you will be able to make those changes with minimal time and difficulty.


At this time you should, if you have not already, go ahead and setup a directory where you will place all of the files that will need.  They should all be kept together so that everything works as designed.  The directory I used is C:\MSIBuilds\ossec but of course you can put the files your anywhere on your dev box... as long as they are all together.


The rest of the files needed to place in your MSI Build directory (most of which I will provide here) are as follows...


Company.mmh
DEPT.mmh
ossec.keys - You should have your own by now so for security reasons I can't post mine.
OSSEC.mmh
ossec-agent-win32-version#.exe -Must be at least version 2.5 for the automated installation to work.
OssecHIDS.MM
OssecHIDS.rtf
OssecHIDS.VER
and
OssecHIDSx64.MM


You will likely want to edit the uisample.mmh file located in your main MAKEMSI install directory,  C:\Program Files (x86)\MakeMsi for 64-bit machines or C:\Program Files\MakeMsi for 32-bit.  Specifically, you will want to look at line 1088 of the uisample.mmh file.

Set this value to 1 instead of 0 for installs that you want to have a progress bar but no user interaction.

#define? UISAMPLE_REDUCED_UI_VALUE         0               ;;0 = normal, 1 = reduced UI (on install only)

The rest of the code has been generalized so you will want to fill in your information in them.  Most of the code does not need to be edited, but if you want to customize the builds with your company information it will be very easy to do so.  The few things that MUST be changed will be very clearly defined in the next post coming tomorrow.


By the end of tomorrows post you should be able to build customized and automated deployment MSIs for your companies and will be able to update them to the latest versions or setup deployments adding new machines in your companies in minutes instead of hours or days.


Tomorrow in Part 3 of the series I will tie it all together and show you how it works.  

Part 2 Delayed

To everyone who read the blog yesterday and are waiting for the rest of this article, I apologize for the delay.  Some unforeseen things came up today so I did not get a chance to follow up on this article.  I will post it up tomorrow for you all to go over barring Armageddon breaking out.

Deploying Ossec HIDS via Active Directory - Part 1

In my first blog series I'm going to go over one way to deploy Ossec HIDS to windows PCs in a network via Active Directory software deployment.  In it's current form, Ossec HIDS is fairly easy to deploy to larger Linux environments but it's not nearly as friendly for deployment to larger numbers of Windows clients.  The latest Ossec HIDS client for Windows now supports the /s switch which makes it easier to deploy windows agents using tools like PSEXEC.  Michael Starks will be going over the PSEXEC deployment process in his blog this week (Week of Ossec) at http://www.immutablesecurity.com/ so I will not cover that deployment scenario here.

While this is a good step in the direction of making the deployment process easier for Windows Administrators, there are more tasks that could be automated.  I am confident that the process I am going to outline here will make the task of deploying Ossec HIDS easier for both Windows and Linux Administrators.  In this process, I tie together some of great work that others have done in the Ossec community with my own work to create a fully automated deployment process that is designed to make this task easier and more time efficient for Administrators.  The second and arguably more important reason for this automation process is to address the need for being able to quickly rebuild the entire system in a disaster recovery scenario.  

Now that we've gone over some of the background and reasons that brought me to creating this automation process we'll get into the actual process.  For the purposes of this blog and to keep things as short as possible we are going to assume that you are familiar with building an Ossec Server and/or already have one setup and that you are at least somewhat  familiar with Active Directory Software Deployment.  This being the case, in this scenario we have hundreds of agents to add to our Ossec Server before we even start installing the Ossec HIDS client on our Windows agents.  I personally did not want to have to do this by hand so I found this automation script at http://www.mail-archive.com/ossec-list@googlegroups.com/msg05128.html.  There are no instructions included so I had do a little bit of figuring out to get it working.

Here's how I did it....

**NOTE:  Some Ossec Server installs are located in /var/ossec/ instead of /opt/ossec/ so double-check your paths before moving on.***

Create a shell script in /opt/ossec/ (I named the file "agentsaddfromlist.sh") and paste the following code into it.

  #!/bin/bash

   ## this is the last key's index number, taken via bin/agent_control

   ##

   ## -chuck

   indexStart=`/opt/ossec/bin/agent_control -l |grep ID: |awk '{print $2}' |tail -1 |cut -f1 -d,`

   indexStart=`expr $indexStart + 1`

   ## loop through the list of clients

   ##

   for line in `cat /opt/ossec/ossec_client_add.lst`

   do

   HOST=`echo $line|awk -F":" ' { print $1 } '`

   IP=`echo $line|awk -F":" ' { print $2 } '`

   echo "<<EOF" > /opt/ossec/ossec_input_host.txt

   echo "A" >> /opt/ossec/ossec_input_host.txt

   echo $HOST >> /opt/ossec/ossec_input_host.txt

   echo $IP >> /opt/ossec/ossec_input_host.txt

   echo "$indexStart" >> /opt/ossec/ossec_input_host.txt

   echo "" >> /opt/ossec/ossec_input_host.txt

   echo "y" >> /opt/ossec/ossec_input_host.txt

   echo "q" >> /opt/ossec/ossec_input_host.txt

   echo ">>EOF" >> /opt/ossec/ossec_input_host.txt

   sudo /opt/ossec/bin/manage_agents < ossec_input_host.txt

   ## test the addition of this client to OSSEC.  if we pass then add 1

   ## to the value of index.  if we fail leave the index value as is

   if [ $? -eq 0 ]

           then

           indexStart=`expr $indexStart + 1`

           echo "Added $HOST to client.keys"

           else :

   fi

   ##

   ## done looping through the list of clients

   done

Next we need to setup a list with the machines we want to add to our server.  This should also be placed in the /opt/ossec/ folder on your server.  As you can see in the script above the list file will need to be called  "ossec_client_add.lst".  This is just a simple text file but it needs to be formatted specifically for the script to properly parse it.  Below is a small sample of what your list should look like.  

**Note that there are no spaces, the machine name and IP address are separated by a colon ":" and subnet masks work fine in here for those of us that have DHCP assigned IP addresses**

abcd4321:172.10.14.45

qwerty321:10.7.0.0/16

As a suggestion, I created my list by querying the AD for computer names in the OU that I needed to deploy OssecHIDS to and exporting the list to csv.  I then opened it in MS Excel.  In the second column I put a : and in the 3rd column I put the IP Address of the machines.  I did this using a subnet mask so it was very quick to do it this way (explained at http://www.ossec.net/wiki/Know_How:DynamicIPs).  Once the list was complete in Excel, I copied the text to Notepad++ and removed the leading and trailing spaces around the : so the list went from this...

abcd4321  :  172.10.14.45

qwerty321  :  10.7.0.0/16

to this 

abcd4321:172.10.14.45

qwerty321:10.7.0.0/16

Now that we have the script to add the agents via list and the list in /opt/ossec/ we need to run it.

Type this into a console on your ossec server and watch it run:

sudo ./opt/ossec/addagentsfromlist.sh

You could be logged into the server as root and run the command without sudo.  It works well like that, but it's less security conscious.  The script should not take very long to run.  I ran it with 350 PC names in the list and it completed in about 30 seconds.  Now double check that everything went as planned by looking at your list of agents using /opt/ossec/bin/manage_agents.  If you are satisfied with the results, restart the ossec service by typing "/opt/ossec/bin/ossec-control restart".  


At this point we've added all of our agents to our Ossec Server.  Next we need to generate the client.keys file using manage agents and copy it over to the machine we are going to create the Windows Ossec HIDS agent deployment on.  We will need this to create the MSI we are going to create to deploy it using Active Directory. This will also be needed if you are going to deploy the agent to the PCs using the PSEXEC method that Michael Starks will be outlining as mentioned earlier in this post.


Before we begin setting up the files for deployment we are going to want to make sure we have the right tools installed on our development machine.  


First you're going to need to install the MAKEMSI package and all associated packages to properly build the deployment installation files.  All the information you could ever need to do this is located on Dennis Barries site at http://dennisbareis.com/makemsi.htm.  This MSI packaging tool is very flexible and very powerful.  I will provide all of the scripts that are needed to create the OssecHIDS installation package so you won't NEED to read through the MAKEMSI manual if you are not familiar with it but I very highly recommend it so that you will know what the scripts are doing and will be able to use it to create more MSI packages in the future.  Dennis Barries' method for building MSI packages is far superior to the before/after snapshot method of generating MSI packages for a number of reasons not the least of which is that MSI packages created this way are more robust and reliable than the snapshot methods that many of us are familiar with, especially when re-packaging existing installers like we are going to do in this write-up.

Admittedly there are alot of things needed to install MAKEMSI and have it working properly, but it is not very difficult and we end up with a very good package development machine in the process.  For now I;ll leave you to the task of setting up your development box.  Tomorrow we will cover the rest of this deployment process.

I'll show you the scripts to fully automate the configuration of the OssecHIDS windows agents to connect to our Ossec server and distribute the individual keys to each agent.  I know what you're thinking now, but don't worry...we won't leave the master client.keys file on any of our agent machines and the client.keys file that is generated by the scripts will have only the line that each individual agent machine needs to connect to the server.  Good luck setting up your development box.  Tomorrow will be a big day with a number of scripts and configuration but the payoff is that once we are done with everything we will be able to re-create the MSI packages we're going to use to deploy to our agents very quickly (maybe a couple of minutes whenever there is an update to the Windows Agent posted on the main OSSEC site or a new agent added to the Ossec server).