Configure intrusion detection with OSSEC and Wazuh for real-time security monitoring

#!/usr/bin/env bash

set -euo pipefail

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Default values
MANAGER_IP="${1:-127.0.0.1}"

usage() {
    echo "Usage: $0 [MANAGER_IP]"
    echo "  MANAGER_IP: IP address of Wazuh manager (default: 127.0.0.1)"
    exit 1
}

log() {
    echo -e "${GREEN}[$(date '+%Y-%m-%d %H:%M:%S')] $1${NC}"
}

warn() {
    echo -e "${YELLOW}[$(date '+%Y-%m-%d %H:%M:%S')] WARNING: $1${NC}"
}

error() {
    echo -e "${RED}[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: $1${NC}"
}

cleanup() {
    error "Installation failed. Cleaning up..."
    systemctl stop wazuh-manager wazuh-indexer wazuh-dashboard 2>/dev/null || true
    systemctl stop wazuh-agent 2>/dev/null || true
}

trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    error "This script must be run as root"
    exit 1
fi

# Detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            KEYRING_PATH="/usr/share/keyrings/wazuh.gpg"
            REPO_FILE="/etc/apt/sources.list.d/wazuh.list"
            FIREWALL_CMD="ufw allow"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            REPO_FILE="/etc/yum.repos.d/wazuh.repo"
            FIREWALL_CMD="firewall-cmd --permanent --add-port"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            REPO_FILE="/etc/yum.repos.d/wazuh.repo"
            FIREWALL_CMD="firewall-cmd --permanent --add-port"
            ;;
        *)
            error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    error "Cannot detect distribution"
    exit 1
fi

log "[1/8] Updating system packages"
$PKG_UPDATE

log "[2/8] Installing dependencies"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL curl apt-transport-https lsb-release gnupg2
else
    $PKG_INSTALL curl yum-utils
fi

log "[3/8] Adding Wazuh repository"
if [[ "$PKG_MGR" == "apt" ]]; then
    curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:$KEYRING_PATH --import
    chmod 644 $KEYRING_PATH
    echo "deb [signed-by=$KEYRING_PATH] https://packages.wazuh.com/4.x/apt/ stable main" > $REPO_FILE
    apt update
else
    rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
    cat > $REPO_FILE << 'EOF'
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF
fi

log "[4/8] Installing Wazuh components"
$PKG_INSTALL wazuh-manager wazuh-indexer wazuh-dashboard

log "[5/8] Configuring Wazuh"
# Configure indexer
cat > /etc/wazuh-indexer/opensearch.yml << EOF
network.host: 0.0.0.0
node.name: node-1
cluster.initial_master_nodes:
- node-1
cluster.name: wazuh-cluster
discovery.seed_hosts:
- 127.0.0.1
plugins.security.ssl.transport.pemcert_filepath: certs/indexer.pem
plugins.security.ssl.transport.pemkey_filepath: certs/indexer-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: certs/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: certs/indexer.pem
plugins.security.ssl.http.pemkey_filepath: certs/indexer-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: certs/root-ca.pem
EOF

# Generate certificates
/usr/share/wazuh-indexer/bin/indexer-security-admin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -icl -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem

# Configure manager
cat >> /var/ossec/etc/ossec.conf << 'EOF'
  <syscheck>
    <disabled>no</disabled>
    <frequency>79200</frequency>
    <scan_on_start>yes</scan_on_start>
    <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes">/bin,/sbin,/boot</directories>
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/hosts.deny</ignore>
    <ignore>/etc/mail/statistics</ignore>
    <ignore>/etc/random-seed</ignore>
    <ignore>/etc/adjtime</ignore>
    <ignore>/etc/httpd/logs</ignore>
    <ignore>/etc/utmpx</ignore>
    <ignore>/etc/wtmpx</ignore>
    <ignore>/etc/cups/certs</ignore>
    <ignore>/etc/dumpdates</ignore>
    <ignore>/etc/svc/volatile</ignore>
  </syscheck>

  <rootcheck>
    <disabled>no</disabled>
    <check_unixaudit>yes</check_unixaudit>
    <check_files>yes</check_files>
    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
    <check_ports>yes</check_ports>
    <check_if>yes</check_if>
    <frequency>43200</frequency>
  </rootcheck>
EOF

# Add custom rules
cat > /var/ossec/etc/rules/local_rules.xml << 'EOF'
<group name="local,syslog,">
  <rule id="100001" level="10" frequency="5" timeframe="300">
    <if_matched_sid>5720</if_matched_sid>
    <description>Multiple SSH authentication failures</description>
    <group>authentication_failures</group>
  </rule>

  <rule id="100002" level="10" frequency="3" timeframe="120">
    <if_matched_sid>5551</if_matched_sid>
    <description>Multiple failed su attempts - possible privilege escalation</description>
    <group>privilege_escalation</group>
  </rule>

  <rule id="100003" level="12">
    <if_matched_sid>550</if_matched_sid>
    <description>Critical system file modified</description>
    <group>file_integrity</group>
  </rule>
</group>
EOF

chown -R ossec:ossec /var/ossec/etc/rules/
chmod 640 /var/ossec/etc/rules/local_rules.xml

log "[6/8] Configuring firewall"
if command -v ufw &> /dev/null; then
    ufw allow 1514/udp
    ufw allow 1515/tcp
    ufw allow 443/tcp
    ufw allow 5601/tcp
    ufw --force enable
elif command -v firewall-cmd &> /dev/null; then
    firewall-cmd --permanent --add-port=1514/udp
    firewall-cmd --permanent --add-port=1515/tcp
    firewall-cmd --permanent --add-port=443/tcp
    firewall-cmd --permanent --add-port=5601/tcp
    firewall-cmd --reload
fi

log "[7/8] Starting services"
systemctl daemon-reload
systemctl enable wazuh-indexer wazuh-manager wazuh-dashboard
systemctl start wazuh-indexer
sleep 10
systemctl start wazuh-manager
systemctl start wazuh-dashboard

log "[8/8] Verifying installation"
if systemctl is-active --quiet wazuh-manager && systemctl is-active --quiet wazuh-indexer; then
    log "Wazuh installation completed successfully!"
    log "Dashboard: https://$(hostname -I | awk '{print $1}'):443"
    log "Default credentials: admin/admin (change immediately)"
    warn "Change default dashboard password after first login"
else
    error "Some services failed to start"
    exit 1
fi

log "Installation complete. Check /var/ossec/logs/ossec.log for manager logs"