Wondering how to setup OSSEC authentication key? We can help you.

At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Service.

Let’s take a look at how our Support Team help a customer  deal with this query.

How to setup OSSEC authentication key?

Today, let us see the steps followed by our Support Techs to add an agent to an OSSEC manager with manage_agents.

1. Firstly, run manage_agents on the OSSEC server.
2. Then, add an agent.
3. Next, extract the key for the agent.
4. Then, copy that key to the agent.
5. Run manage_agents on the agent.
6. Then, import the key copied from the manager.
7. Next, restart the manager’s OSSEC processes.
8. Finally, start the agent.

Each agent share a key-pair with the manager.

To make it easier we added a new daemon on the manager, called ossec-authd. 

Once you have the new version running, you need to create the certificate / private key for SSL

# openssl genrsa -out /var/ossec/etc/sslmanager.key 2048
# openssl req -new -x509 -key /var/ossec/etc/sslmanager.key -out /var/ossec/etc/sslmanager.cert -days 365

Once the keys are created, you can start the ossec-authd:

# /var/ossec/bin/ossec-authd -p 1515 >/dev/null 2>&1 &

Setting up the agents

All you have to do is to run the following command:

# /var/ossec/bin/agent-auth -m 192.168.1.1 -p 1515

INFO: Connected to 192.168.1.1:1515
INFO: Using agent name as: melancia
INFO: Send request to manager. Waiting for reply.
INFO: Received response with agent key
INFO: Valid key created. Finished.
INFO: Connection closed.

Where 192.168.1.1 is your manager IP address. Inside the manager, you will also see the logs:

2011/01/19 15:04:40 ossec-authd: INFO: New connection from 192.168.10.5
2011/01/19 15:04:41 ossec-authd: INFO: Received request for a new agent (melancia) from: 192.168.10.5
2011/01/19 15:04:41 ossec-authd: INFO: Agent key generated for melancia (requested by 192.168.10.5)
2011/01/19 15:04:41 ossec-authd: INFO: Agent key created for melancia (requested by 192.168.10.5)

Finally, the keys are now exchanged and you can start your agent.

[Need a solution to another query? We are just a click away.]

Conclusion

Today, we saw steps followed by our Support Engineers to setup OSSEC authentication key.