blob: e80a18d10064896f54e36d213612d61fc2cdf878 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
--- etc/ossec-server.conf 2024-05-10 18:10:43.842257000 -0500
+++ etc/ossec-server.conf 2024-05-10 18:15:26.471699000 -0500
@@ -28,7 +28,8 @@
<remote>
<connection>secure</connection>
<port>1514</port>
- <protocol>tcp</protocol>
+ <protocol>udp</protocol>
+ <queue_size>131072</queue_size>
</remote>
<!-- Policy monitoring -->
@@ -200,7 +201,7 @@
<localfile>
<log_format>syslog</log_format>
- <location>/var/log/syslog</location>
+ <location>/var/log/userlog</location>
</localfile>
<localfile>
@@ -211,7 +212,7 @@
<localfile>
<log_format>full_command</log_format>
- <command>netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort</command>
+ <command>(netstat -n -f inet && netstat -n -f inet) | grep -e "udp" -e "tcp" | sed 's/\([[:alnum:]]*\)\ *[[:digit:]]*\ *[[:digit:]]*\ *\([[:digit:]\.]*\)\.\([[:digit:]]*\)\ *\([[:digit:]\.]*\).*/\1 \2 == \3 == \4/' | sort -k4 -g | sed 's/ == \(.*\) ==/.\1/'</command>
<frequency>360</frequency>
</localfile>
@@ -233,4 +234,32 @@
<rule_dir>etc/rules</rule_dir>
</ruleset>
+ <!-- Configuration for wazuh-authd -->
+ <auth>
+ <disabled>no</disabled>
+ <port>1515</port>
+ <use_source_ip>no</use_source_ip>
+ <purge>yes</purge>
+ <use_password>yes</use_password>
+ <ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
+ <!-- <ssl_agent_ca></ssl_agent_ca> -->
+ <ssl_verify_host>no</ssl_verify_host>
+ <ssl_manager_cert>etc/sslmanager.cert</ssl_manager_cert>
+ <ssl_manager_key>etc/sslmanager.key</ssl_manager_key>
+ <ssl_auto_negotiate>no</ssl_auto_negotiate>
+ </auth>
+
+ <cluster>
+ <name>wazuh</name>
+ <node_name>indexer1</node_name>
+ <node_type>master</node_type>
+ <key></key>
+ <port>1516</port>
+ <bind_addr>0.0.0.0</bind_addr>
+ <nodes>
+ <node>NODE_IP</node>
+ </nodes>
+ <hidden>no</hidden>
+ <disabled>yes</disabled>
+ </cluster>
</ossec_config>
|
