4
4
OSSEC Architecture
5
5
==================
6
6
7
- Linux and unix-like systems:
8
- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
7
+ Linux and unix-like systems
8
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^
9
9
10
10
OSSEC runs as multiple processes, the exact number differing between agent, server, and local installations.
11
11
Most processes communicates through unix sockets under the `queue ` directory inside of the OSSEC installation location.
12
12
When possible the OSSEC processes run with limited privileges and chroot to the install location.
13
13
This is modeled after the `Privilege Separation tehniques <https://www.openbsd.org/papers/auug04/mgp00030.html >`_ used in OpenBSD.
14
14
15
- Windows:
16
- ^^^^^^^^
15
+ Windows
16
+ ^^^^^^^
17
17
18
18
OSSEC runs as a single service.
19
19
20
- Agent/Server Communication:
21
- ^^^^^^^^^^^^^^^^^^^^^^^^^^^
20
+ Agent/Server Communication
21
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^
22
22
23
23
The OSSEC server listens on 1514/udp via `ossec-remoted `.
24
24
Agents send messages to the server via `ossec-agentd `.
25
25
The communication is two-way, but initiated by the agent.
26
26
27
- Agentless and Network Devices:
28
- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
27
+ Agentless and Network Devices
28
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
29
29
30
30
OSSEC has the ability to communicate with systems that cannot have the agent software installed.
31
31
This is typically done through SSH, and a few pre-made `Expect <https://core.tcl.tk/expect/index >`_
@@ -34,8 +34,8 @@ scripts are provided for a number of systems.
34
34
In addition to the agentless support, OSSEC can receive syslog messages from any number of devices and process them as if the
35
35
messages were delivered via an agent.
36
36
37
- User List:
38
- ^^^^^^^^^^
37
+ User List
38
+ ^^^^^^^^^
39
39
40
40
+--------+---------------------------------------------------+
41
41
| User | Process |
@@ -49,8 +49,8 @@ User List:
49
49
| ossecm | ossec-maild, ossec-csyslogd |
50
50
+--------+---------------------------------------------------+
51
51
52
- Process List:
53
- ^^^^^^^^^^^^^
52
+ Process List
53
+ ^^^^^^^^^^^^
54
54
55
55
+--------------------+--------------------------------------------------------------------------------+---------------------+
56
56
| Process | Description | Install Type |
0 commit comments