Closed jotacarma90 closed 9 months ago
Agent installed at the RHEL 9.3 machine by following this guide. The manager was implemented by running an the OVA 4.6.0 release.
Using default configuration (just changed frequency to 60 seconds):
Configuration:
<directories realtime="yes">/testrealtime</directories>
Configuration:
<directories whodata="yes">/testwhodata</directories>
Configuration
SCA is officially supported on RHEL 9. Default configuration was used.
Configuration by default
RHEL 9 is officially supported in Version 4.6.0
Both vulnerability detection module as well as RHEL vulnerability detection were enabled at the manager's ossec.log
<vulnerability-detector>
<enabled>yes</enabled>
<interval>5m</interval>
<min_full_scan_interval>6h</min_full_scan_interval>
<run_on_start>yes</run_on_start>
...
<!-- RedHat OS vulnerabilities -->
<provider name="redhat">
<enabled>yes</enabled>
<os>5</os>
<os>6</os>
<os>7</os>
<os>8</os>
<os>9</os>
<update_interval>1h</update_interval>
</provider>
Use case: Restarting the Wazuh agent with active response
Manager ossec.conf configuration:
<active-response>
<command>restart-wazuh</command>
<location>local</location>
<rules_id>100009</rules_id>
</active-response>
Manager's /var/ossec/etc/rules/local_rules.xml
file:
<group name="restart,">
<rule id="100009" level="5">
<if_sid>550</if_sid>
<match>ossec.conf</match>
<description>Changes made to the agent configuration file - $(file)</description>
</rule>
</group>
We force an alert by adding a line in the ossec.conf file in the agent:
<directories realtime="yes">/root</directories>
A log file will be traced and a log entry will be added to verify it is successfully detected
Agent's configuration:
<localfile>
<log_format>syslog</log_format>
<location>/var/logs/file.log</location>
</localfile>
We force an event in the file:
echo 'Sep 10 22:12:41 example pvedaemon[6427]: authentication failure; rhost=192.168.0.1 user=root@pam
msg=Authentication failure' >/var/log/file.log
WPK was downloaded from here and this procedure was follow (from step 2)
[root@wazuh-server wazuh-user]# /var/ossec/bin/agent_upgrade -a 003 -f /home/wazuh-user/wazuh_agent_v4.6.0_linux_x86_64.wpk -x upgrade.sh
Upgrading...
Upgraded agents:
Agent 003 upgraded: Wazuh v4.6.0 -> Wazuh v4.6.0
[root@wazuh-server wazuh-user]#
LGTM!
LGMT
Description
Hello team, this issue is to check the full compatibility of Wazuh on the newfound version of Red Hat Enterprise Linux 9.3 operating system.
OSs checks issue: https://github.com/wazuh/wazuh/issues/20373
For this, it is necessary to perform the following tests to check that everything works as expected: