CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #192 from Security-Onion-Solutions/feature/wazuh_updates

Browse Source 
Wazuh: Add auth log path for Centos
This commit is contained in:
Mike Reeves
2019-12-30 13:47:13 -05:00
committed by GitHub
parent 9ee0273180 df722c173f
commit c6345a8950
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
salt/wazuh/files/agent/ossec.conf
View File

@@ -179,12 +179,17 @@
<log_format>syslog</log_format> <log_format>syslog</log_format>
<location>/var/ossec/logs/active-responses.log</location> <location>/var/ossec/logs/active-responses.log</location>
</localfile> </localfile>
{%- if grains['os'] == 'Ubuntu' %}
<localfile> <localfile>
<log_format>syslog</log_format> <log_format>syslog</log_format>
<location>/var/log/auth.log</location> <location>/var/log/auth.log</location>
</localfile> </localfile>
{%- else %}
<localfile>
<log_format>syslog</log_format>
<location>/var/log/secure</location>
</localfile>
{%- endif %}
<localfile> <localfile>
<log_format>syslog</log_format> <log_format>syslog</log_format>
<location>/var/log/syslog</location> <location>/var/log/syslog</location>

8
salt/wazuh/files/agent/wazuh-register-agent
View File

@@ -31,6 +31,7 @@ USER="foo"
PASSWORD="bar" PASSWORD="bar"
AGENT_NAME=$(hostname) AGENT_NAME=$(hostname)
AGENT_IP="{{ip}}" AGENT_IP="{{ip}}"
AGENT_ID=001
display_help() { display_help() {
cat <<HELP_USAGE cat <<HELP_USAGE
@@ -135,5 +136,10 @@ shift $(($OPTIND - 1))
# Default action -> try to register the agent # Default action -> try to register the agent
sleep 10s sleep 10s
register_agent STATUS=$(curl -s -k -u $USER:$PASSWORD $PROTOCOL://$API_IP:$API_PORT/agents/$AGENT_ID | jq .data.status | sed s'/"//g')
if [[ $STATUS == "Active" ]]; then
echo "Agent $AGENT_ID already registered!"
else
register_agent
fi
#remove_agent #remove_agent