[Day 7] 3. LAB 1 Monitoring SSH Logs Using OSSIM

Goal:
Generate and monitor SSH logs on OSSIM when an attacker (Debian 2) attempts to SSH into Debian 1.

---

Setup Requirements

• Machines:

  1. OSSIM (SIEM tool)
  2. Debian 1 (Target machine)
  3. Debian 2 (Attacker machine)

• Resources:

  • VMware Workstation 16.x
  • Hardware:
    • 2 Cores
    • 4 GB RAM (8 GB recommended)
    • 50 GB Disk Space
  • Network: NAT

---

Steps

1. Install OSSIM

1. Create a VM with the OSSIM ISO.
2. Set static IP:
   Copy

   192.168.80.101

   • Subnet Mask:
     Copy

     255.255.255.0

   • Gateway:
     Copy

     192.168.80.2

   • Name Server: Use the automatically assigned nameserver or
     Copy

     8.8.8.8

     (Google DNS)
3. Install OSSIM (Takes ~30 minutes).
4. After installation, log in and complete the initial setup wizard:
   • Skip network scan and CSV import.
   • Finish setup to access the OSSIM dashboard.

---

2. Configure Debian 1 for SSH Logging

1. Enable Logging:

   bashCopy
   sudo apt-get install rsyslog -y
   sudo vim /etc/ssh/sshd_config
   

   • Uncomment the logging lines in
     Copy

     sshd_config

     .

2. Restart SSH:

   bashCopy
   sudo systemctl restart ssh
   

---

3. Install OSSEC Agent on Debian 1

1. Install required packages:

   bashCopy
   sudo apt-get install build-essential libevent-dev libpcre2-dev libz-dev libssl-dev ca-certificates libsystemd-dev -y
   

2. Add the client machine in OSSIM:

   • Go to Environment > Detection > Agent.
   • Add Debian 1 as an asset and copy the generated key (using the
     Copy

     extract key

     option). Keep the key with you. You will need it later.

3. Download and install OSSEC:

   bashCopy
   wget https://192.168.0.52/sw/security_tools/OSSIM/ossec-hids-3.7.0.tar.gz
   tar -zxf ossec-hids-3.7.0.tar.gz
   cd ossec-hids-3.7.0
   sudo ./install.sh
   

   When asked:

   • Choose
     Copy

     English

     .
   • Select
     Copy

     Agent

     .
   • Enter OSSIM IP:
     Copy

     192.168.80.101

     .
   • Enable integrity check and proceed with defaults.

4. Run the following command on the Debian machine to create the logs for OSSEC:

   bashCopy
   sudo touch /var/ossec/queue/rids/sender
   

5. Add OSSEC key:

   bashCopy
   sudo /var/ossec/bin/manage_agents
   

   • Press
     Copy

     I

     to import the key.
   • Paste the key.
   • Confirm and quit (
     Copy

     Q

     ).

6. Start OSSEC:

   bashCopy
   sudo /var/ossec/bin/ossec-control start
   

---

4. Simulate an Attack from Debian 2

1. Attempt an invalid SSH connection to Debian 1 from Debian 2:

   bashCopy
   ssh user@192.168.80.10
   

2. Check OSSIM SIEM in Real-Time Events to confirm the logs are generated.

---

Outcome:
When Debian 2 attempts an invalid SSH connection to Debian 1, OSSIM generates and displays logs in real-time.