OSSEC 101: The Slackening

In a small attempt to stop slacking I managed to add a bit to the OSSEC 101 project. Yesterday I wrote the initial draft of the OSSEC Linux agent installation. I had already written the companion OSSEC server installation, so an agent install was the next logical step. Since I don't have a lot of Windows machines, capturing the Linux agent installation was much easier. (I just noticed the server installation is missing an image, and I'm sure it needs some polish.)

Hoping that a bit of color would differentiate the agent bits from the server bits, I decided to use red backgrounds for putty in the agent installation screenshots. Please let me know if it just looks stupid, or if a different color would be more appropriate.

I'm not quite sure how much information should be in these sections. I don't want OSSEC 101 to turn into the typical how-to document, with a bunch of copy & paste commands. I want you to know what you're running and why you're running it. There will probably be more added to these install pages before I consider them done, but they're already useful.

The Windows agent page might stay blank for a while. I do have a Windows machine I could reinstall OSSEC onto, but meh.

Along with the slacking I've been trying to come up with scenarios for OSSEC 101. I thought it might be easier to explain things if I had real world examples of how some people use OSSEC, and I have a few ideas already. I'm always looking for more ideas, so feel free to send me any ideas (or create an issue at my bitbucket).

So that's 2 sections down, a LOT more to go. Hopefully I'll be able to devote more time to this next year. Hopefully.

I'm a slacker

I know I've been ignoring the blog, and I'd make some excuse if I had a good one. I don't, so it must be laziness. It's a new year, and a good time to change that.

Besides catching up on Chrono Trigger, I've been playing around with a few things that might lead to blog posts.

I've gotten the chance to learn a bit more about Splunk, and if I can ever stop violating my 500MB/day license (I didn't think I'd ever violate that on my home network) I hope to write something up on it. I want to specifically dig into the Splunk for OSSEC app.

DragonFly BSD is something else I've been playing with. The HAMMER file system sounded really interesting, and I wanted to give it a shot. I haven't been disappointed so far.

Finally, network flow data has interested me for a while. I wanted to dig into it a bit more so I went looking for a tool. The one I chose is Argus. There are a lot of options available in argus, but I'll post a few of the things I look at.

Here's to a good 2011!