Root User Access Monitoring with OSSEC/Wazuh#

1
<rule id="516" level="3">
2
  <if_sid>510</if_sid>
3
  <match>^System Audit</match>
4
  <description>System Audit event.</description>
5
  <group>rootcheck</group>
6
</rule>

1
<rule id="100002" level="9">
2
  <if_sid>516</if_sid>
3
  <match>Root can log in</match>
4
  <description>Critical: SSH allows root login</description>
5
  <group>rootcheck,ssh_security,</group>
6
</rule>

1
<group name="ssh_policy,">
2
  <!-- Critical: Root access misconfiguration -->
3
  <rule id="100010" level="10">
4
    <if_sid>516</if_sid>
5
    <match>Root can log in</match>
6
    <description>SSH configuration allows root login - Critical security risk</description>
7
    <options>alert_by_email</options>
8
    <group>pci_dss_2.2.4,cis_5.2.8,</group>
9
  </rule>
10

11
  <!-- High: Weak authentication methods -->
12
  <rule id="100011" level="8">
13
    <if_sid>516</if_sid>
14
    <match>Empty passwords permitted|Password authentication enabled</match>
15
    <description>Weak SSH authentication method detected</description>
16
    <group>authentication_failed,pci_dss_2.2.4,</group>
17
  </rule>
18

19
  <!-- Medium: Missing security controls -->
20
  <rule id="100012" level="6">
21
    <if_sid>516</if_sid>
22
    <match>AllowUsers not configured|DenyUsers not configured</match>
23
    <description>SSH access controls not properly configured</description>
24
    <group>access_control,</group>
25
  </rule>
26

27
  <!-- Correlation: Multiple SSH misconfigurations -->
28
  <rule id="100013" level="12" frequency="3" timeframe="120">
29
    <if_matched_sid>100010,100011,100012</if_matched_sid>
30
    <description>Multiple SSH security misconfigurations detected</description>
31
    <options>alert_by_email</options>
32
  </rule>
33
</group>

1
{
2
  "visualization": {
3
    "title": "SSH Configuration Compliance",
4
    "visState": {
5
      "type": "pie",
6
      "params": {
7
        "addTooltip": true,
8
        "addLegend": true,
9
        "legendPosition": "right",
10
        "isDonut": true
11
      },
12
      "aggs": [
13
        {
14
          "id": "1",
15
          "enabled": true,
16
          "type": "count",
17
          "schema": "metric",
18
          "params": {}
19
        },
20
        {
21
          "id": "2",
22
          "enabled": true,
23
          "type": "terms",
24
          "schema": "segment",
25
          "params": {
26
            "field": "rule.pci_dss",
27
            "size": 10,
28
            "order": "desc",
29
            "orderBy": "1"
30
          }
31
        }
32
      ]
33
    }
34
  }
35
}

1
#!/bin/bash
2
# ssh_remediation.sh - Automatically fix SSH misconfigurations
3

4
SSHD_CONFIG="/etc/ssh/sshd_config"
5
BACKUP_DIR="/etc/ssh/backups"
6
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
7

8
# Create backup
9
mkdir -p "$BACKUP_DIR"
10
cp "$SSHD_CONFIG" "$BACKUP_DIR/sshd_config.$TIMESTAMP"
11

12
# Function to update SSH setting
13
update_ssh_setting() {
14
    local setting=$1
15
    local value=$2
16

17
    if grep -q "^#*${setting}" "$SSHD_CONFIG"; then
18
        sed -i "s/^#*${setting}.*/${setting} ${value}/" "$SSHD_CONFIG"
19
    else
20
        echo "${setting} ${value}" >> "$SSHD_CONFIG"
21
    fi
22
}
23

24
# Apply security settings
25
update_ssh_setting "PermitRootLogin" "no"
26
update_ssh_setting "PasswordAuthentication" "no"
27
update_ssh_setting "PermitEmptyPasswords" "no"
28
update_ssh_setting "Protocol" "2"
29
update_ssh_setting "X11Forwarding" "no"
30
update_ssh_setting "MaxAuthTries" "3"
31
update_ssh_setting "ClientAliveInterval" "300"
32
update_ssh_setting "ClientAliveCountMax" "0"
33

34
# Validate configuration
35
if sshd -t; then
36
    echo "SSH configuration valid, restarting service..."
37
    systemctl restart sshd
38
    echo "SSH hardening completed successfully"
39
else
40
    echo "ERROR: Invalid SSH configuration, restoring backup..."
41
    cp "$BACKUP_DIR/sshd_config.$TIMESTAMP" "$SSHD_CONFIG"
42
    exit 1
43
fi

1
<ossec_config>
2
  <command>
3
    <name>ssh-hardening</name>
4
    <executable>ssh_remediation.sh</executable>
5
    <expect></expect>
6
    <timeout_allowed>yes</timeout_allowed>
7
  </command>
8

9
  <active-response>
10
    <command>ssh-hardening</command>
11
    <location>local</location>
12
    <rules_id>100010</rules_id>
13
    <timeout>300</timeout>
14
  </active-response>
15
</ossec_config>

1
SSH Security Policy:
2
  Mandatory Settings:
3
    - PermitRootLogin: no
4
    - Protocol: 2
5
    - PasswordAuthentication: no
6
    - PermitEmptyPasswords: no
7

8
  Recommended Settings:
9
    - MaxAuthTries: 3
10
    - ClientAliveInterval: 300
11
    - X11Forwarding: no
12
    - AllowUsers: [specific users]
13

14
  Monitoring:
15
    - Daily compliance checks
16
    - Real-time alerts for changes
17
    - Monthly compliance reports

1
Rollout Phases:
2
  Phase 1 - Assessment:
3
    - Deploy monitoring only
4
    - Identify non-compliant systems
5
    - Document exceptions
6

7
  Phase 2 - Remediation:
8
    - Fix non-critical systems
9
    - Test automated responses
10
    - Update documentation
11

12
  Phase 3 - Enforcement:
13
    - Enable auto-remediation
14
    - Monitor compliance metrics
15
    - Regular audits

1
#!/usr/bin/env python3
2
import requests
3
import json
4
from datetime import datetime
5

6
def generate_ssh_compliance_report():
7
    """Generate SSH compliance report from Wazuh API"""
8

9
    # API configuration
10
    api_url = "https://localhost:55000"
11
    api_user = "wazuh"
12
    api_pass = "wazuh"
13

14
    # Get rootcheck findings
15
    response = requests.get(
16
        f"{api_url}/rootcheck/000",
17
        auth=(api_user, api_pass),
18
        verify=False
19
    )
20

21
    findings = response.json()['data']['items']
22

23
    # Generate report
24
    report = {
25
        'timestamp': datetime.now().isoformat(),
26
        'total_checks': len(findings),
27
        'failed_checks': sum(1 for f in findings if 'SSH' in f['event']),
28
        'compliance_rate': 0,
29
        'critical_findings': []
30
    }
31

32
    # Calculate compliance rate
33
    if report['total_checks'] > 0:
34
        report['compliance_rate'] = (
35
            (report['total_checks'] - report['failed_checks']) /
36
            report['total_checks'] * 100
37
        )
38

39
    # Identify critical findings
40
    for finding in findings:
41
        if 'Root can log in' in finding['event']:
42
            report['critical_findings'].append({
43
                'host': finding['agent_id'],
44
                'issue': finding['event'],
45
                'file': finding.get('file', 'Unknown')
46
            })
47

48
    return report
49

50
if __name__ == "__main__":
51
    report = generate_ssh_compliance_report()
52
    print(json.dumps(report, indent=2))

1
#!/usr/bin/env python3
2
import json
3
import sys
4
import requests
5

6
def send_slack_alert(alert_file):
7
    """Send SSH compliance alerts to Slack"""
8

9
    webhook_url = "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
10

11
    with open(alert_file) as f:
12
        alert = json.load(f)
13

14
    if 'SSH' in alert.get('rule', {}).get('description', ''):
15
        message = {
16
            "attachments": [{
17
                "color": "danger",
18
                "title": "SSH Security Alert",
19
                "fields": [
20
                    {
21
                        "title": "Host",
22
                        "value": alert['agent']['name'],
23
                        "short": True
24
                    },
25
                    {
26
                        "title": "Issue",
27
                        "value": alert['rule']['description'],
28
                        "short": True
29
                    },
30
                    {
31
                        "title": "Details",
32
                        "value": alert.get('full_log', 'No details'),
33
                        "short": False
34
                    }
35
                ],
36
                "footer": "Wazuh Security",
37
                "ts": alert['timestamp']
38
            }]
39
        }
40

41
        requests.post(webhook_url, json=message)
42

43
if __name__ == "__main__":
44
    send_slack_alert(sys.argv[1])