Linux: OSSEC Agent Installer
The Linux shell script installer will install the agent on the system using a private yum or apt repo contained on the SaaS Hub server. It will then configure the agent (ossec.conf), and register the agent to the hub.
These instructions can also be found in your Atomic HUB by navigating to Asset Management > Add Agent
Requirements
- Root or sudo permissions
- bash
Network Security Policy
The following ports are required to be open to the Atomic hub server from the agent
- Outbound TCP port 80/443 (Used to download and update the agent software)
- Outbound TCP port 1515 (Used to issue the agent key)
- Outbound TCP/UDP port 1514 (Used for agent data communication)
Step 1: Log into the system, and download the installer from the Atomic SaaS HUB
wget https://<hub_address>/installers/ossec-installer.sh
Step 2: Change permissions of the installer
chmod +x ossec-installer.sh
Step 3: Execute the script with the HUB Address of the SaaS server and port/protocol requirements
sudo ./ossec-installer.sh --server <HUB_Address> --port 1514 --protocol udpInstaller options
Pass options after the server IP or use --server <hub_ip> then:
- --server <ip>
Hub IP or hostname (required)
- --auth <ip>
Registration service IP (default: server)
- --port <port>
Remoted port (default: 1514)
- --protocol <tcp|udp>
Protocol (default: udp)
- --agent-name <name>
Agent name (default: hostname)
- --group <group>
Agent group (default: default)
- --password <pass>
Registration auth password
- --https
Use HTTPS for package download
- --https-enrollment
Register agent over HTTPS
- --install-only
Install only, do not register
- --proxy <url|disable>
HTTP proxy for download
- --use-aws
Use AWS instance ID as agent name
- --default-name
Prepend external IP to agent name
- --enable-unattended-upgrades
Auto-updates (Debian/Ubuntu)
- --exclude-clamav
Skip ClamAV packages