cookbook-ossec-ng/attributes/ossec.rb

default["ossec"]["version"] = "2.8"
default["ossec"]["syslog_output"]["ip"] = "172.16.254.254"
default["ossec"]["syslog_output"]["port"] = "514"
default["ossec"]["syslog_output"]["min_level"] = "5"
default["ossec"]["receiver_port"] = "1514"
default["ossec"]["log_alert_level"] = "1"
default["ossec"]["email_alert_level"] = "7"
default["ossec"]["email_maxperhour"] = "9999"
default["ossec"]["email_idsname"] = "ossec"
default["ossec"]["memory_size"] = "100000"
default["ossec"]["remote"]["connection"] = "secure"
default["ossec"]["agents"] = {}
default["ossec"]["rules"] = {}
default["ossec"]["email_alerts"] = {}
if node["roles"].include?("ossec-server")
  default["ossec"]["agent"]["enable"] = false
else
  default["ossec"]["agent"]["enable"] = true
end

if platform_family?('debian')
  default["ossec"]["server"]["service_name"] = "ossec-hids-server"
  default["ossec"]["client"]["service_name"] = "ossec-hids-client"
elsif platform_family?('rhel')
  default["ossec"]["server"]["service_name"] = "ossec-hids"
  default["ossec"]["client"]["service_name"] = "ossec-hids"
end

# Sane defaults for each distribution platform for syslog files
if platform_family?('debian')
  default["ossec"]["syslog_files"]["/var/log/auth.log"] = {}
  default["ossec"]["syslog_files"]["/var/log/daemon.log"] = {}
  default["ossec"]["syslog_files"]["/var/log/kern.log"] = {}
  default["ossec"]["syslog_files"]["/var/log/mail.log"] = {}
  default["ossec"]["syslog_files"]["/var/log/syslog"] = {}
  default["ossec"]["syslog_files"]["/var/log/user.log"] = {}
  default["ossec"]["syslog_files"]["/var/log/chef/client.log"] = {}

elsif platform_family?('rhel')
  default["ossec"]["syslog_files"]["/var/log/cron"] = {}
  default["ossec"]["syslog_files"]["/var/log/dmesg"] = {}
  default["ossec"]["syslog_files"]["/var/log/maillog"] = {}
  default["ossec"]["syslog_files"]["/var/log/messages"] = {}
  default["ossec"]["syslog_files"]["/var/log/secure"] = {}
  default["ossec"]["syslog_files"]["/var/log/spooler"] = {}
  default["ossec"]["syslog_files"]["/var/log/yum.log"] = {}
  default["ossec"]["syslog_files"]["/var/log/chef/client.log"] = {}
end

# Sane defaults for syscheck
default["ossec"]["syscheck"]["frequency"] = '7200'
default["ossec"]["syscheck"]["alert_new_files"] = 'yes'
default["ossec"]["syscheck"]["auto_ignore"] = 'no'

default["ossec"]["syscheck"]["directories"]['/bin'] = {
  'report_changes' => 'no',
  'realtime' => 'yes'
}
default["ossec"]["syscheck"]["directories"]['/boot'] = {
  'report_changes' => 'no',
  'realtime' => 'no'
}
default["ossec"]["syscheck"]["directories"]['/etc'] = {
  'report_changes' => 'yes',
  'realtime' => 'no'
}
default["ossec"]["syscheck"]["directories"]['/lib/lsb'] = {
  'report_changes' => 'no',
  'realtime' => 'yes'
}
default["ossec"]["syscheck"]["directories"]['/lib/modules'] = {
  'report_changes' => 'no',
  'realtime' => 'yes'
}
default["ossec"]["syscheck"]["directories"]['/lib/plymouth'] = {
  'report_changes' => 'no',
  'realtime' => 'yes'
}
default["ossec"]["syscheck"]["directories"]['/lib/security'] = {
  'report_changes' => 'no',
  'realtime' => 'yes'
}
default["ossec"]["syscheck"]["directories"]['/lib/terminfo'] = {
  'report_changes' => 'no',
  'realtime' => 'yes'
}
default["ossec"]["syscheck"]["directories"]['/lib/ufw'] = {
  'report_changes' => 'no',
  'realtime' => 'yes'
}
default["ossec"]["syscheck"]["directories"]['/lib/xtables'] = {
  'report_changes' => 'no',
  'realtime' => 'no'
}
default["ossec"]["syscheck"]["directories"]['/media'] = {
  'report_changes' => 'no',
  'realtime' => 'no'
}
default["ossec"]["syscheck"]["directories"]['/opt'] = {
  'report_changes' => 'no',
  'realtime' => 'no'
}
default["ossec"]["syscheck"]["directories"]['/root'] = {
  'report_changes' => 'yes',
  'realtime' => 'no'
}
default["ossec"]["syscheck"]["directories"]['/srv'] = {
  'report_changes' => 'no',
  'realtime' => 'no'
}
default["ossec"]["syscheck"]["directories"]['/sbin'] = {
  'report_changes' => 'no',
  'realtime' => 'yes'
}
default["ossec"]["syscheck"]["directories"]['/usr/'] = {
  'report_changes' => 'yes',
  'realtime' => 'yes'
}
default["ossec"]["syscheck"]["directories"]['/tmp'] = {
  'report_changes' => 'no',
  'realtime' => 'no'
}

# Syscheck Ignore Files
default["ossec"]["syscheck"]["ignore"]['/etc/openvpn/openvpn-status.log'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/motd'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/blkid.tab'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/mtab'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/mail/statistics'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/random-seed'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/adjtime'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/prelink.cache'] = {}
default["ossec"]["syscheck"]["ignore"]['/root/.bash_history'] = {}
default["ossec"]["syscheck"]["ignore"]['/root/.viminfo'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/dnscache/stats'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/dnscache/log'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/dnscache2/stats'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/dnscache2/log'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/tinydns/stats'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/tinydns/log'] = {}

# Commands
default["ossec"]["command"]["host-deny"]["enabled"] = false
default["ossec"]["command"]["host-deny"]["executable"] = 'host-deny.sh'
default["ossec"]["command"]["host-deny"]["expect"] = 'srcip'
default["ossec"]["command"]["host-deny"]["timeout_allowed"] = 'yes'

default["ossec"]["command"]["firewall-stop"]["enabled"] = true
default["ossec"]["command"]["firewall-stop"]["executable"] = 'firewall-drop.sh'
default["ossec"]["command"]["firewall-stop"]["expect"] = 'srcip'
default["ossec"]["command"]["firewall-stop"]["timeout_allowed"] = 'yes'

default["ossec"]["command"]["disable-account"]["enabled"] = false
default["ossec"]["command"]["disable-account"]["executable"] = 'disable-account.sh'
default["ossec"]["command"]["disable-account"]["expect"] = 'user'
default["ossec"]["command"]["disable-account"]["timeout_allowed"] = 'yes'

default["ossec"]["local_command"] = {}

# Active-Responses
default["ossec"]["active-response"]["host-deny"]["enabled"] = true
default["ossec"]["active-response"]["host-deny"]["location"] = 'local'
default["ossec"]["active-response"]["host-deny"]["level"] = '10'
default["ossec"]["active-response"]["host-deny"]["timeout"] = '600'

default["ossec"]["active-response"]["firewall-stop"]["enabled"] = true
default["ossec"]["active-response"]["firewall-stop"]["location"] = 'local'
default["ossec"]["active-response"]["firewall-stop"]["level"] = '10'
default["ossec"]["active-response"]["firewall-stop"]["timeout"] = '600'

default["ossec"]["active-response"]["disable-account"]["enabled"] = false
default["ossec"]["active-response"]["disable-account"]["location"] = 'local'
default["ossec"]["active-response"]["disable-account"]["level"] = '10'
default["ossec"]["active-response"]["disable-account"]["timeout"] = '600'


# internal options, you probably don't want to touch that
default["ossec"]["internal"]["analysisd"]["default_timeframe"] = "360"
default["ossec"]["internal"]["analysisd"]["stats_maxdiff"] = "25000"
default["ossec"]["internal"]["analysisd"]["stats_mindiff"] = "250"
default["ossec"]["internal"]["analysisd"]["stats_percent_diff"] = "30"
default["ossec"]["internal"]["analysisd"]["fts_list_size"] = "32"
default["ossec"]["internal"]["analysisd"]["fts_min_size_for_str"] = "14"
default["ossec"]["internal"]["analysisd"]["log_fw"] = "1"
default["ossec"]["internal"]["logcollector"]["loop_timeout"] = "2"
default["ossec"]["internal"]["logcollector"]["open_attempts"] = "8"
default["ossec"]["internal"]["logcollector"]["remote_commands"] = 1
default["ossec"]["internal"]["remoted"]["recv_counter_flush"] = "128"
default["ossec"]["internal"]["remoted"]["comp_average_printout"] = "19999"
default["ossec"]["internal"]["remoted"]["verify_msg_id"] = "1"
default["ossec"]["internal"]["maild"]["strict_checking"] = "1"
default["ossec"]["internal"]["maild"]["groupping"] = "0"
default["ossec"]["internal"]["maild"]["full_subject"] = "1"
default["ossec"]["internal"]["maild"]["geoip"] = "1"
default["ossec"]["internal"]["monitord"]["compress"] = "1"
default["ossec"]["internal"]["monitord"]["sign"] = "1"
default["ossec"]["internal"]["monitord"]["monitor_agents"] = "1"
default["ossec"]["internal"]["syscheck"]["sleep"] = "2"
default["ossec"]["internal"]["syscheck"]["sleep_after"] = "15"
default["ossec"]["internal"]["dbd"]["reconnect_attempts"] = "10"
default["ossec"]["internal"]["window"]["debug"] = "0"
default["ossec"]["internal"]["syscheck"]["debug"] = "0"
default["ossec"]["internal"]["remoted"]["debug"] = "0"
default["ossec"]["internal"]["analysisd"]["debug"] = "0"
default["ossec"]["internal"]["logcollector"]["debug"] = "0"
default["ossec"]["internal"]["agent"]["debug"] = "0"

# What OSSEC fules files to load
default["ossec"]["load_rules"] = {
  'rules_config.xml'		=> true,
  'pam_rules.xml'		=> true,
  'sshd_rules.xml'		=> true,
  'telnetd_rules.xml'		=> false,
  'syslog_rules.xml'		=> true,
  'arpwatch_rules.xml'		=> true,
  'symantec-av_rules.xml'	=> false,
  'symantec-ws_rules.xml'	=> false,
  'pix_rules.xml'		=> false,
  'named_rules.xml'		=> true,
  'smbd_rules.xml'		=> true,
  'vsftpd_rules.xml'		=> false,
  'pure-ftpd_rules.xml'		=> false,
  'proftpd_rules.xml'		=> false,
  'ms_ftpd_rules.xml'		=> false,
  'ftpd_rules.xml'		=> false,
  'hordeimp_rules.xml'		=> false,
  'roundcube_rules.xml'		=> false,
  'wordpress_rules.xml'		=> false,
  'cimserver_rules.xml'		=> false,
  'vpopmail_rules.xml'		=> false,
  'vmpop3d_rules.xml'		=> false,
  'courier_rules.xml'		=> false,
  'web_rules.xml'		=> true,
  'web_appsec_rules.xml'	=> true,
  'apache_rules.xml'		=> true,
  'nginx_rules.xml'		=> true,
  'php_rules.xml'		=> true,
  'mysql_rules.xml'		=> true,
  'postgresql_rules.xml'	=> true,
  'ids_rules.xml'		=> true,
  'squid_rules.xml'		=> false,
  'firewall_rules.xml'		=> true,
  'cisco-ios_rules.xml'		=> false,
  'netscreenfw_rules.xml'	=> false,
  'sonicwall_rules.xml'		=> false,
  'postfix_rules.xml'		=> true,
  'sendmail_rules.xml'		=> false,
  'imapd_rules.xml'		=> false,
  'mailscanner_rules.xml'	=> false,
  'dovecot_rules.xml'		=> false,
  'ms-exchange_rules.xml'	=> false,
  'racoon_rules.xml'		=> false,
  'vpn_concentrator_rules.xml'	=> false,
  'spamd_rules.xml'		=> false,
  'msauth_rules.xml'		=> false,
  'clam_av_rules.xml'		=> true,
  'mcafee_av_rules.xml'		=> false,
  'trend-osce_rules.xml'	=> false,
  'ms-se_rules.xml'		=> false,
  'zeus_rules.xml'		=> false,
  'solaris_bsm_rules.xml'	=> false,
  'vmware_rules.xml'		=> false,
  'ms_dhcp_rules.xml'		=> false,
  'asterisk_rules.xml'		=> false,
  'ossec_rules.xml'		=> true,
  'attack_rules.xml'		=> true,
  'local_rules.xml'		=> true,
}