How do I connect OSSEC Server and Client together in Virtualbox?

Support/Development for OSSEC
Westwood
New Forum User
New Forum User
Posts: 2
Joined: Sat Jun 05, 2021 11:25 am

How do I connect OSSEC Server and Client together in Virtualbox?

Unread post by Westwood »

So, I've followed OSSEC's installation instruction. Basically the Automated installation part. Now, I want to connect both the Server and Client together. How do I do that? Is there any other steps I should do first before connecting them together?

I kind of extracted the Agent's key and added the OSSEC Agent but the Server didn't detect it at all.

Do you think there's something wrong with my network settings for these Virtualboxes? I installed both on Ubuntu 20.04. All updated by 3 June, 2021

Server
IP Address is 192.168.162.4
IP Address is 192.168.162.4
Ubuntu OSSEC Network.png (31.16 KiB) Viewed 7720 times
Agent
IP Address is 192.168.162.3
IP Address is 192.168.162.3
Ubuntu OSSEC Network 2.png (30.51 KiB) Viewed 7720 times
User avatar
cponton
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 61
Joined: Fri Oct 09, 2020 9:41 am

Re: How do I connect OSSEC Server and Client together in Virtualbox?

Unread post by cponton »

Verify that you can ping the server box from the agent. A lot of times, when the HUB cannot detect the agent, it is because of either a firewall or a closed port.

Here are the documents for connecting agents to the HUB. https://www.ossec.net/docs/docs/manual/agent/index.html
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: How do I connect OSSEC Server and Client together in Virtualbox?

Unread post by scott »

Yeah I think by default virtualbox doesn't let you communicate with the guest VM from the host system
Westwood
New Forum User
New Forum User
Posts: 2
Joined: Sat Jun 05, 2021 11:25 am

Re: How do I connect OSSEC Server and Client together in Virtualbox?

Unread post by Westwood »

cponton wrote: Tue Jun 08, 2021 8:40 am Verify that you can ping the server box from the agent. A lot of times, when the HUB cannot detect the agent, it is because of either a firewall or a closed port.

Here are the documents for connecting agents to the HUB. https://www.ossec.net/docs/docs/manual/agent/index.html
I can definitely ping them between each other
Attachments
Agent pinging Server
Agent pinging Server
Ping 2.png (206.71 KiB) Viewed 7705 times
Server pinging Agent
Server pinging Agent
Ping 1.png (210.35 KiB) Viewed 7705 times
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: How do I connect OSSEC Server and Client together in Virtualbox?

Unread post by scott »

Ok thats good, it could be the key. A good way to provision those is to use the ossec-authd service on the server, and the agent-auth client from the agent. Otherwise you could manually do it using manage_agents
Post Reply