1.1. Foreword

This document aims to show step by step and in detail the installation of OSSIM on a Debian Sarge GNU/Linux system.

Almost everything exposed in this document can be applied to any other Linux distribution. Hopefully it will be useful to you.

If you have any problems related to the installation in Debian or want to add or correct something in this document, please, feel free to contact us at <dgil at ossim.net> and <gingurz at ossim.net>

You can also contact all the OSSIM developers at <devel at ossim.net>

1.2. Structure considerations

Ossim structure can be divided into 4 components, each can be installed on different hosts :

Generally you will have the databases, the server and the framework on the same host, and you can eventualy add some sensors, depends on the processor and memory load.

1.3. Lazy install

To make installation easier we already built the debian packages of the tools we need to patch (snort, ntop, rrdtool etc.). To use them, simply edit /etc/apt/sources.list and add the following line at the beginning of the file :

  deb http://www.ossim.net/download/ debian/

You can now use apt to download and install the packages.

• dpkg-dev : Package building tools for Debian  (>= 1.10.22)
  

• fakeroot : Gives a fake root environment      (>= 1.0.7)
  

Also, you will need a deb-src line into your /etc/apt/sources.list file in order to download source packages.

  # apt-get install dpkg-dev fakeroot
  # echo "deb-src http://http.us.debian.org/debian sarge main contrib non-free" >> /etc/apt/sources.list

1.4. Necessary software installation

Download the latest stable version of OSSIM from the http://www.ossim.net/download.phpdownload section.

Unpack it to '/opt/ossim' (or wherever you want). This directory will be called $OSSIM_PATH in the rest of the document.

Eventually, you can delete the unused directories. For example, if you install a host with no agent, you can remove $OSSIM_PATH\agent

2.1. Ossim database

Now we're going to create the OSSIM database structure.

The first thing you have to do is to edit the database configuration at '/etc/ossim/framework/ossim.conf'.

  # mkdir /etc/ossim/
  # cp -r $OSSIM_PATH/contrib/debian/framework /etc/ossim/

Then adjust these values according to your configuration :

  ossim_base=ossim
  ossim_user=root
  ossim_pass=your_password
  ossim_host=localhost
  ossim_port=3306

Create a new database for OSSIM:

  # mysql -u root -p
  mysql> create database ossim;
  mysql> exit
  # cd $OSSIM_PATH/db
  # cat create_mysql.sql | mysql -u root ossim -p
  # cat ossim_data.sql snort_nessus.sql realsecure.sql | mysql -u root ossim -p

For complete description of Ossim database structure check : $OSSIM_PATH/doc/ossim_db_structure.txt

2.2. Snort/Acid database

Then we have to create the database needed by Snort and Acid. Note than even you don't use snort in your sensors, you have to create this database as Ossim uses it to store alerts from others plugin.

First you have to get create_mysql.gz from snort-mysql install and create_acid_tbls_mysql.sql from Acid patched for ossim.

You can get these .sql files via apt-get source:

  # apt-get source snort-mysql acidlab
  # cd acidlab-0.9.6b20/
  # patch -p1 < $OSSIM_PATH/contrib/acid.patch

Then, you need to create the snort database :

  # mysql -u root -p
  mysql> create database snort;
  mysql> exit;

Snort tables:

  # cat $SNORT_SOURCE/contrib/create_mysql | mysql -u root -p snort

Acid tables:

  # cat $ACID_SOURCE/create_acid_tbls_mysql.sql | mysql -u root snort -p

If you are going to install snort and acid on the same host, just type (after installing snort/acid, see sections 5.1 and 4.5):

  # zcat /usr/share/doc/snort-mysql/contrib/create_mysql.gz | mysql -u root -p snort
  # cat /usr/share/acidlab/create_acid_tbls_mysql.sql | mysql -u root snort -p

2.3. Updating from Ossim 0.9.6

If you already installed Ossim 0.9.6, you can get lazy ;) just by running the script :

  # cat $OSSIM_PATH/db/096-to-097.sql | mysql -u root ossim -p

4.1. Apache + PHP + ADOdb

It is necessary to install the Apache Web server with PHP support. It is also strongly recommended to use SSL with Apache.

ADOdb is a PHP database abstraction layer that is being used by Acid and by the OSSIM PHP code.

Install the following packages and their respective dependencies:

• apache-ssl   : Versatile, high-performance HTTP server with SSL support (>= 1.3.31)
      

• php4         : Server-side, HTML-embedded scripting language            (>= 4.3.9)
      

• php4-cgi     : Server-side, HTML-embedded scripting language            (>= 4.3.9)
      

• libphp-adodb : The 'adodb' database abstraction layer for php           (>= 4.52)
      

  # apt-get install apache-ssl php4 php4-cgi libphp-adodb

• php4-mysql       : MySQL module for php4                                (>= 4.3.9) 
      

• php4-pgsql       : PostgreSQL module for php4                           (>= 4.3.8)
      

• php4-gd2         : GD module (with GD2) for php4                        (>= 4.3.2+rc3)
      

• libphp-phplot    : The graphic library for php                          (>= 4.4.6)
      

• libphp-jpgraph   : Object oriented graph library for php4               (>= 1.5.2)
      

• wwwconfig-common : Debian web auto configuration                        (>= 0.0.34)
      

  # apt-get install php4-mysql php4-pgsql php4-gd2 libphp-phplot \
    libphp-jpgraph wwwconfig-common

And for the directive viewer :

  # apt-get install php4-domxml php4-xslt

Edit the Apache configuration file at '/etc/apache-ssl/modules.conf' and make sure that the php module is loaded. Also, you can use 'dpkg-reconfigure apache' and mark the module 'mod_php4' from the configuration list.

Copy the configuration file of ossim for Apache :

  # cp $OSSIM_PATH/contrib/debian/httpd/ossim.conf /etc/apache-ssl/conf.d/

Also check in '/etc/php4/apache/php.ini' and '/etc/php4/cgi/php.ini' files that the following lines are in:

  extension=gd.so
  extension=mysql.so
  extension=pgsql.so
  extension=domxml.so
  extension=xslt.so

Re-run Apache-ssl.

You must edit these framework/ossim.conf variables:

• adodb_path=/usr/share/adodb/
      

• jpgraph_path=/usr/share/jpgraph/
      

4.2. phpGACL

phpGACL is used to manage user profiles.

There's a complete installation manual of phpGACL at http://phpgacl.sourceforge.net/demo/phpgacl/docs/manual.html

Here is a short summary:

Download phpgacl from https://sourceforge.net/project/showfiles.php?group_id=57103.

Uncompress and place it into /var/www/phpgacl directory.

Edit phpgacl/gacl.class.php and set "db_type", "db_host", "db_user", "db_password", and "db_name" with the same values that the OSSIM database has (we are going to insert gacl tables into ossim database). Set "db_table_prefix" to ''.

Edit phpgacl/admin/gacl_admin.inc.php with the same db settings.

Go to http://yourhost/phpgacl/setup.php

Create phpgacl/admin/templates_c directory (IMPORTANT: this directory must be writable by the user the webserver runs as).

phpGACL now is installed. Take a look at http://yourhost/phpgacl/admin/acl_admin.php

Remember to setup an ossim user for apache:

    # htpasswd -c /var/www/ossim-users ossim

Now that phpgacl is installed you must run 'http://yourhost/ossim/setup/ossim_acl.php' script to fill database with default acls.

And you should force to use Ossim pages instead of phpGACL ones with an apache auth directory.

Reade README.phpgacl for more details.

NOTE: Since you have phpgacl configured, you should can enter to ossim framework login as admin-admin. It's fully recommended that you reset to default values at configuration->main.

4.3. RRDtool

In OSSIM, we use the developpement version of rrdtool (1.1.X) in order to get the aberrant behaviour support.

If you use ossim.net as a source for Debian Package (cf Intro) :

  # apt-get install rrdtool librrd0 librrd0-dev librrdp-perl librrds-perl

If you prefer to compile everything, let's go.

Your system must have installed the following packages in order to compile the libraries:

• dpkg-dev         : Package building tools for Debian                       (>= 1.10.23)
      

• fakeroot         : Gives a fake root environment                           (>= 1.0.7)
      

• gcc              : The GNU C compiler                                      (>= 3.3.4)
      

• g++              : The GNU C++ compiler                                    (>= 3.3.4)
      

• make             : The GNU version of the "make" utility                   (>= 3.80)
      

• libtool          : Generic library support script                          (>= 1.5.6)
      

• automake         : A tool for generating GNU Standards-compliant Makefiles (>= 1.6.3)
      

• autoconf         : automatic configure script builder                      (>= 2.59)
      

• cgilib           : Simple CGI Library                                      (>= 0.5)
      

• libart-2.0-dev   : Library of functions for 2D graphics - devel            (>= 2.3.16)
      

• libfreetype6-dev : FreeType 2 font engine, development files               (>= 2.1.7)
      

Then, follow these steps:

  # cd /tmp
  # wget http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/pub/beta/rrdtool-cvs-snap.tar.gz
  # tar -xvzf rrdtool-cvs-snap.tar.gz
  # cd rrdtool-XXXX-XX-XX
  # dpkg-buildpackage -rfakeroot -uc -b
  # cd ..
  # dpkg -i librrd0-dev_1.1.0-1_i386.deb librrd0_1.1.0-1_i386.deb \
    librrdp-perl_1.1.0-1_all.deb librrds-perl_1.1.0-1_i386.deb \
    rrdtool_1.1.0-1_i386.deb

You must edit these ossim configuration variables:

  rrdtool_path=/usr/bin/
  rrdtool_lib_path=/usr/lib/perl5/

4.4. MRTG

Once again, you can easily install the patched package if you add OSSIM source of packages in sources.list :

  # apt-get install mrtg libsnmp-session-perl

Otherwise you have to install Mrtg from sources:

• mrtg : Multi Router Traffic Grapher (>= 2.10.13)
      

  # apt-get source mrtg

You have to patch mrtg in order to use the new rrdtool improvements. You will find this patch at '$OSSIM_PATH/contrib/mrtg/mrtg.diff'.

  # cd mrtg-XXX/bin
  # patch -p0 < $OSSIM_PATH/contrib/mrtg/mrtg.diff

Compile and install mrtg:

  # cd ..
  # dpkg-buildpackage -rfakeroot -uc -b
  # cd ..
  # apt-get install libsnmp-session-perl
  # dpkg -i mrtg_XXX.deb mrtg-contrib_XXX.deb

4.5. Graphing

Make the following directories (if they don't exist)

  $ mkdir $OSSIM_PATH/www/mrtg
  $ cd $OSSIM_PATH/www/mrtg
  $ mkdir host_qualification net_qualification global_qualification level_qualification

Edit /etc/ossim/framework/mrtg-rrd.cfg:

  WorkDir: $OSSIM_PATH/www/mrtg
  Include: $OSSIM_PATH/mrtg/hosts/host_qualification.cfg
  Include: $OSSIM_PATH/mrtg/nets/net_qualification.cfg
  Include: $OSSIM_PATH/mrtg/global/global_qualification.cfg

Important paths in order to draw graphs are:

  mrtg_rrd_files_path=$OSSIM_PATH/www/mrtg
  rrdpath_host=$OSSIM_PATH/www/mrtg/host_qualification/
  rrdpath_net=$OSSIM_PATH/www/mrtg/net_qualification/
  rrdpath_global=$OSSIM_PATH/www/mrtg/global_qualification/

Copy $OSSIM_PATH/include/ossim_conf.pm in any place where Perl can find it. For example:

  #ln -s $OSSIM_PATH/include/ossim_conf.pm /usr/lib/perl5/

Run the script named 'launch-mrtg':

  # cd $OSSIM_PATH/mrtg
  # ./launch-mrtg

If you see any error, you must tune these config files. To execute this script periodically, the best option is to add an entry to your crontab.

  # cp $OSSIM_PATH/etc/cron.d/ossim /etc/cron.d/

or

  $ crontab -e
  0-59/5 * * * * $OSSIM_PATH/mrtg/launch-mrtg

Finally, copy the script 'draw_graph.pl' to your cgi-bin directory.

  $ cp $OSSIM_PATH/scripts/draw_graph.pl /usr/lib/cgi-bin/

NOTE: there are three versions of draw_graph (normal, combined and fournier). Choose the one you prefer.

Take a look at the section links of '/etc/ossim/framework/ossim.conf' again ;).

Ah, obtain a .ttf font and put it somewhere visible to ossim. Adjust /etc/ossim/framework/ossim.conf and make sure rrdtool can find its default font. (Look for fonts at $OSSIM_PATH/contrib/fonts)

4.6. ACID

You can use lazy way if you have modified your sources.list :

  # apt-get install acidlab acidlab-mysql acidlab-doc

Or compile from the source as follow :

Download the latest version of Acid and patch it with the patch that you will find in the OSSIM contrib directory.

  # apt-get source acidlab
  # cd acidlab-XXX
  # patch -p1 < $OSSIM_PATH/contrib/acid.patch
  # dpkg-buildpackage -rfakeroot -uc -b
  # dpkg -i acidlab_XXX.deb acidlab-mysql_XXX.deb acidlab-doc_XXX.deb

NOTE: An error ocurres when apply the patch. Don't worry about it if you are using MySQL database, since it only affects pgsql database.

You may notice that with official acid sources you'll not see that error.

Check the DB abstraction library variable $DBlib_path in /etc/acidlab/acid_conf.php and set it to "/usr/share/adodb/" and complete the database configuration.

Edit apache configuration file (/etc/acidlab/apache.conf) and change this line:

  php_value include_path .

to:

  php_value include_path .:$OSSIM_PATH/include/

Make sure you have created the snort database with Acid tables as described in section 2.2.

  # cp $OSIM_PATH/contrib/acid_update_db.php /usr/share/acidlab/

  acid_link=http://localhost/acidlab/   # must be in http:// format
                                        # (needed by wget)
  acid_path=/usr/share/acidlab/

  # acid dir with password (htpasswd)?
  acid_user=ossim
  acid_pass=ossim

  # $OSSIM_PATH/scripts/acid_cache.pl

  $ crontab -e
  5 0 * * * $OSSIM_PATH/scripts/backupdb.pl

  # apt-get install libcompress-zlib-perl

  backup_dir=/var/lib/ossim/backup/
  backup_day=7

4.7. Control Panel

You need to run the script 'control_panel.py' that you will find at '$OSSIM_PATH/scripts/control_panel.py'. This script updates the metrics database reading the rrds that mrtg generates.

control_panel.py is written in python, so you need to install the following packages:

• python         : An interactive high-level object-oriented language (>= 2.3.4)
      

• python-mysqldb : A Python interface for MySQL                       (>= 1.1.6)
      

  # apt-get install python python-mysqldb

The database configuration is readed from framework/ossim.conf, so make sure that ossim_user, ossim_db, etc. are set up correctly.

Make the script executable:

  # cp $OSSIM_PATH/scripts/control_panel.py /usr/local/bin/
  # chmod +x /usr/local/bin/control_panel.py

Type 'control_panel.py --help' for more help.

4.8. Ntop

It's not necessary to install ntop in the same machine where the framework is; you can install ntop in one sensor and use it.

Let's go to install ntop (lazy way):

  # apt-get install ntop

If you want to compile ntop, follow these steps:

You need the following packages:

• ntop      : display network usage in top-like format (>= 3.0)
      

• libgd-dev : GD Graphics Library                      (>= 1.8.4)
      

  # apt-get install libgd-dev
  # apt-get source ntop

Patch ntop:

  # cd ntop-XXX/
  # patch -p0 < $OSSIM_PATH/contrib/ntop/ntop3-ossim.patch
  # aclocal-1.6
  # autoheader
  # autoconf
  # automake-1.6 --add-missing --gnu

Edit debian/rules file and remove '--enable-i18n' option from the 'configure-stamp-ntop' section.

Build ntop .deb:

  $ dpkg-buildpackage -rfakeroot -uc -b

NOTE: use -d option to solve circular dependency problems (if needed).

Install it:

  $ cd ..
  $ dpkg -i ntop_XXX.deb

You must define the password for the admin user of ntop the first time you start ntop:

  # ntop -u ntop
  >> Please enter the password for the admin user:
  # ^C
  # /etc/init.d/ntop start

Now, the ntop daemon should be listening at port 3000, and 3001 (ssl).

Go to 'http://yourhost:3000/ to see Ntop in action.

Activate the rrdPlugin at Admin->plugins. Click on Host at Data Dump and specify your netmask at Hosts Filter.

Note: The RRD Files Path should be set to /var/lib/ntop/rrd

In order to make ntop to work with ips instead of macs (needed by agent), edit '/etc/default/ntop' file and add "--no-mac" to GETOPT="".

Set ntop variables into framework configuration:

  ntop_link=https://your_ntop_host:3001/
  rrdpath_ntop=/var/lib/ntop/rrd

4.9. Nmap

The framework has an active service detector that uses nmap. It will be replaced with a passive detector using agents, but in the meantime you need to install nmap.

• nmap : The Network Mapper (>= 3.70)
     

  # apt-get install nmap

4.10. Nessus client

For more information about Ossim and Nessus integration please take a look at README.nessus

You can use Nessus in distributed mode with one nessus server on many sensors or you can have only a central nessus to scan all the hosts.

Any way you choose you need to have a nessus client on the framework. See 5.2 to install nessus server first.

So you'll need the following package for the client :

• nessus         : Remote network security auditor, the client (>= 2.0.10)
      

• nessus-plugins : Nessus plugins                              (>= 2.0.12)
      

  # apt-get install nessus nessus-plugins

Update /etc/ossim/framework/ossim.conf with the following lines :

  nessus_user=ossim
  nessus_pass=your_password (see 5.2 for creating users)
  nessus_host=yourhost
  nessus_port=1241
  nessus_path=/usr/bin/nessus
  nessus_rpt_path=$OSSIM_PATH/www/vulnmeter/

We need to approve the nessus server certificate, to do it just run against each nessus server :

  # nessus -s -q xxx.xxx.xxx.xxx 1241 ossim your_nessus_pass

Where xxx.xxx.xxx.xxx.xxx is the adress of nessus server.

Follow the on-screen instructions. Personally I set the paranoïa to 2.

To update nessus plugins (ie nessus attack scripts) and update ossim database with them try :

  # nessus-update-plugins
  # perl $OSSIM_PATH/scripts/update_nessus_ids.pl

It's a good idea to update plugins before each scan. To start a scan run the script :

  # $OSSIM_PATH/scripts/do_nessus.pl

4.11. PDF reports

From fpdf web page:

"FPDF is a PHP class which allows to generate PDF files with pure PHP, that is to say without using the PDFlib library. The advantage is that PDFlib requires a fee for a commercial usage. F from FPDF stands for Free: you may use it for any kind of usage and modify it to suit your needs".

To Install it on debian :

• php-fpdf : PHP class to generate PDF files (>= 1.52)
     

  # apt-get install php-fpdf

More detail on FPDF website in french, english, spanish, italian and dutch.

5.1. Plugins

  # apt-get install snort-mysql

  # apt-get source snort-mysql

  # tar -xvzf Spade-XXXXXX.tgz
  # cd Spade-XXXXXX
  # vi Makefile <-- edit SNORTBASE variable
  # make

  # cd snort-X.X.X
  # patch -p0 < $OSSIM_PATH/contrib/snort-2.1-ossim.patch

  # dpkg-buildpackage -rfakeroot -uc -b

  $ cd ..
  $ dpkg -i snort-mysql_XXX.deb snort-common_XXX.deb
    snort-rules-default_XXX.deb snort-doc_XXX.deb

  hostname = where_your_db_is
  database = snort
  user     = root
  password = yourMySQLpass

  var HOME_NET [192.168.1.0/24]
  var EXTERNAL_NET !$HOME_NET

  "output database: alert, mysql, user=root dbname=snort host=yourdbhost logfile=fast.log"

  # include $RULE_PATH/web-attacks.rules
  # include $RULE_PATH/backdoor.rules
  # include $RULE_PATH/shellcode.rules
  # include $RULE_PATH/policy.rules
  # include $RULE_PATH/porn.rules
  # include $RULE_PATH/info.rules
  # include $RULE_PATH/icmp-info.rules
  # include $RULE_PATH/virus.rules
  # include $RULE_PATH/chat.rules
  # include $RULE_PATH/multimedia.rules
  # include $RULE_PATH/p2p.rules

  $ telnet OSSIM_host 80
  GET /cmd.exe HTTP/1.1

  # cd /etc/snort/rules/
  # wget http://www.bleedingsnort.com/bleeding-all.rules
  # echo "include \$RULE_PATH/bleeding-all.rules" >> /etc/snort/snort.conf

  # apt-get source tcptrack
  # cd tcptrack-x.x.x
  # patch -p1 < $OSSIM_PATH/tcptrack-1.1.3-ossim.patch
  # dpkg-buildpackage -rfakeroot -uc -b
  # cd ..
  # dpkg -i tcptrack_1.1.3-1_i386.deb

  # tcptrack -i $your_interface -P 4003 -D 2> /var/log/tcptrack.log

  # /usr/local/bin/pads -i $your_interface -D -w /var/log/assets.csv

  # apt-get install p0f

  # p0f -i $your_interface -lUNtd -o /var/log/p0f.log

  # apt-get install arpwatch

  # arpwatch -d -i $your_interface -f /var/lib/arpwatch/arp.dat >> \
    /var/log/arpwatch.log &

5.2. Nessus server

So you'll need the following package for the client :

• nessusd : Remote network security auditor, the server (>= 2.0.12)
      

  # apt-get install nessusd

For communication with client Nessus need a certificate to create that is generate during the install process. Then you need to create a user to allow your nessus client to connect :

  # nessus-adduser

You will have something like that :

  Login             : ossim
  Password          : nessus
  DN                :
  Rules             :

5.3. OpenNMS

Installing OpenNMS on Debian Sarge should look tricky at first glance. Here's a small workaround to succeed it.

  # mkdir /usr/local/src/java/1.4.2 && cd /usr/local/src/java/1.4.2

  # chmod u+x j2sdk-1_4_2_05-linux-i586.bin
  # ./j2sdk-1_4_2_05-linux-i586.bin
  # mv j2sdk1.4.2_05/ /usr/local/lib/
  # ln -s /usr/local/lib/j2sdk1.4.2_05/ /usr/local/lib/j2sdk
  # apt-get install java-common equivs
  # mkdir -p /usr/local/source/java/pkg
  # cd /usr/local/source/java/pkg
  # equivs-build java-compiler-dummy.control
  # equivs-build java-virtual-machine-dummy.control
  # equivs-build java1-runtime-dummy.control
  # equivs-build java2-compiler-dummy.control
  # equivs-build java2-runtime-dummy.control
  # dpkg -i java-compiler-dummy_1.0_all.deb \
    java-virtual-machine-dummy_1.0_all.deb \
    java2-compiler-dummy_1.0_all.deb \
    java2-runtime-dummy_1.0_all.deb
  # update-alternatives --verbose --install /usr/bin/java java \
    /usr/local/lib/j2sdk/jre/bin/java 500 --slave /usr/share/man/man1/java.1 \
    java.1 /usr/local/lib/j2sdk/man/man1/java.1

  # java -version

  deb ftp://ftp.debian.org/debian unstable contrib
  deb ftp://ftp.debian.org/debian unstable main

  apt-get update
  apt-get install -t unstable tomcat4

  # apt-get install postgresql rrdtool libdbd-pg-perl

  deb http://debian.opennms.org/ debian/opennms unstable

  # apt-get install opennms

  JAVA_HOME=/usr/local/lib/j2sdk
  TOMCAT4_USER=tomcat4

  host opennms opennms 127.0.0.1 255.0.0.0 password

  host opennms opennms 127.0.0.1 255.0.0.0 trust

  JAVA_HOME=/usr/local/lib/j2sdk

  # /etc/init.d/opennms start
  # /etc/init.d/tomcat4 start