Added email_idsname, fixed email_alerts to not require location

This commit is contained in:
Eric Renfro 2016-07-24 18:12:09 -04:00
parent 6b18d206ed
commit c35f2a4de5
5 changed files with 25 additions and 5 deletions

View File

@ -39,6 +39,7 @@ Default attributes from the ossec-server role:
'ossec@example.net',
],
"email_from" => 'ossec-server@example.net',
"email_idsname" => 'ossec',
"smtp_server" => 'localhost',
"white_list" => [
'127.0.0.1',

View File

@ -6,6 +6,7 @@ default["ossec"]["receiver_port"] = "1514"
default["ossec"]["log_alert_level"] = "1"
default["ossec"]["email_alert_level"] = "7"
default["ossec"]["email_maxperhour"] = "9999"
default["ossec"]["email_idsname"] = "ossec"
default["ossec"]["memory_size"] = "100000"
default["ossec"]["remote"]["connection"] = "secure"
default["ossec"]["agents"] = {}

View File

@ -32,7 +32,7 @@ module OssecCore
def ossec_event_location_search()
# resolve the location search of an email_alert block to a hostname
node["ossec"]["email_alerts"].each do|recipient,params|
node["ossec"]["email_alerts"].each do |recipient, params|
if params.has_key?('event_location_search')
if Chef::Config[:solo]
Chef::Log.warn('This recipe uses search. Chef Solo does not support search.')

View File

@ -4,7 +4,7 @@ maintainer_email "psi-jack@linux-help.org"
license "GPLv2"
description "Installs/Configures ossec"
long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
version "1.2.1"
version "1.2.2"
issues_url "http://git.linux-help.org/Linux-Help/ossec-ng/issues"
source_url "http://git.linux-help.org/Linux-Help/ossec-ng"

View File

@ -6,8 +6,9 @@
<email_to><%= recipient %></email_to>
<% end -%>
<smtp_server><%= node["ossec"]["smtp_server"] %></smtp_server>
<email_from><%= node["ossec"]["email_from"]%></email_from>
<email_maxperhour><%=node["ossec"]["email_maxperhour"]%></email_maxperhour>
<email_from><%= node["ossec"]["email_from"] %></email_from>
<email_maxperhour><%= node["ossec"]["email_maxperhour"] %></email_maxperhour>
<email_idsname><%= node["ossec"]["email_idsname"] %></email_idsname>
<memory_size><%=node["ossec"]["memory_size"]%></memory_size>
<% node["ossec"]["white_list"].sort_by {|k| k}.each do |ip| -%>
<white_list><%= ip %></white_list>
@ -93,10 +94,27 @@
elsif params.has_key?('resolved_search')
locations = params[:resolved_search]
end
locations.sort_by {|k| k}.each do |location| -%>
if locations.count > 0
locations.sort_by {|k| k}.each do |location| -%>
<email_alerts>
<email_to><%= recipient %></email_to>
<event_location><%= location %></event_location>
<% params.sort_by {|k,v| k}.each do |key, value|
unless key =~ /event_location_tag|event_location_search|resolved_search/
if key.eql?('tags')
value.sort_by {|k| k}.each do |tag| -%>
<<%= tag %> />
<% end
else -%>
<<%= key %>><%= value %></<%= key %>>
<% end
end
end -%>
</email_alerts>
<% end
else -%>
<email_alerts>
<email_to><%= recipient %></email_to>
<% params.sort_by {|k,v| k}.each do |key, value|
unless key =~ /event_location_tag|event_location_search|resolved_search/
if key.eql?('tags')