<\/strong><\/h2>\n
- \n
- Linux (Ubuntu or CentOS)<\/li>\n
- Root privileges<\/li>\n
- Completed first osquery guide<\/li>\n<\/ul>\n
What we will do<\/h2>\n
- \n
- Install osquery on Linux Server<\/li>\n
- Enable Syslog Consumption for osquery<\/li>\n
- Basic osquery Configuration<\/li>\n
- Configure File Integrity Monitoring osquery<\/li>\n
- Testing<\/li>\n<\/ol>\n
Step 1 – Install osquery on Linux Server<\/h2>\n
Osquery provides its own repository for all platform installation, and the first step we are going to do is installing the osquery package FROM the official osquery repository.<\/p>\n
On Ubuntu<\/h3>\n
Add the osquery key to the system.<\/p>\n
export OSQUERY_KEY=1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B
sudo apt-key adv –keyserver keyserver.ubuntu.com –recv-keys $OSQUERY_KEY<\/p>\nAdd the osquery repository and install the package.<\/p>\n
sudo add-apt-repository ‘deb [arch=amd64] https:\/\/pkg.osquery.io\/deb deb main’
sudo apt install osquery -y<\/p>\nOn CentOS<\/h3>\n
Add the osquery key to the system.<\/p>\n
curl -L https:\/\/pkg.osquery.io\/rpm\/GPG | sudo tee \/etc\/pki\/rpm-gpg\/RPM-GPG-KEY-osquery<\/p>\n
Add and enable the osquery repository, and install the package.<\/p>\n
sudo yum-config-manager –add-repo https:\/\/pkg.osquery.io\/rpm\/osquery-s3-rpm.repo
sudo yum-config-manager –enable osquery-s3-rpm
sudo yum install osquery -y<\/p>\nWait for all packages to be installed.<\/p>\n
![\"Install](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux.png\" "\\"\\"")
<\/a><\/p>\nNote:<\/strong><\/p>\n
If you get the error about the yum-config-manager command.<\/p>\n
sudo: yum-config-manager: command not found<\/p>\n
Install the ‘yum-utils’ package.<\/p>\n
yum -y install yum-utils<\/p>\n
Step 2 – Enable Syslog Consumption in osquery<\/h2>\n
Osquery provides features to read or consume system logs on the Apple MacOS using the Apple System Log (ASL), and for Linux is using the syslog.<\/p>\n
In this step, we will enable the syslog consumption for osquery through the rsyslog.<\/p>\n
On Ubuntu<\/h3>\n
Install the rsyslog package using the apt command below.<\/p>\n
sudo apt install rsyslog -y<\/p>\n
On CentOS<\/h3>\n
Install the rsyslog package using the yum command below.<\/p>\n
sudo yum install rsyslog -y<\/p>\n
After the installation is complete, go to the ‘\/etc\/rsyslog.d’ directory and create a new configuration file osquery.conf.<\/p>\n
cd \/etc\/rsyslog.d\/
vim osquery.conf<\/p>\nPaste the following configuration there.<\/p>\n
template( name=\"OsqueryCsvFormat\" type=\"string\" string=\"%timestamp:::date-rfc3339,csv%,%hostname:::csv%,%syslogseverity:::csv%,%syslogfacility-text:::csv%,%syslogtag:::csv%,%msg:::csv%\\n\" \n) \n*.* action(type=\"ompipe\" Pipe=\"\/var\/osquery\/syslog_pipe\" template=\"OsqueryCsvFormat\") \n<\/pre>\n
Save and exit.<\/p>\n
![\"Configure](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux-1.png\" "\\"\\"")
<\/a><\/p>\nStep 3 – Basic Configuration osquery<\/h2>\n
osquery default configuration is ‘osquery.conf’, usually located in the ‘\/etc\/osquery’ directory. There are samples of the osquery configuration ‘\/usr\/share\/osquery\/osquery.conf’ and sample of osquery packs configuration.<\/p>\n
In this step, we will learn about the osquery configuration components, create the custom osquery configuration, and then deploy the osqueryd as a service.<\/p>\n
osquery configuration formatted as a JSON file contains osquery configuration specifications described below.<\/p>\n
- \n
- Options: part of the osqueryd CLI command and it determines the apps start and initialization.<\/li>\n
- Schedule: Define flow of the scheduled query names to the query details.<\/li>\n
- Decorators: Used to add additional “decorations” to results and snapshot logs.<\/li>\n
- Packs: a group of the schedule queries.<\/li>\n
- More: File Path, YARA, Prometheus, Views, EC2, Chef Configuration.<\/li>\n<\/ul>\n
Go to the ‘\/etc\/osquery’ directory and create a new custom configuration ‘osquery.conf’.<\/p>\n
cd \/etc\/osquery\/
vim osquery.conf<\/p>\nPaste the following configurations there.<\/p>\n
{ \"options\": { \"config_plugin\": \"filesystem\", \"logger_plugin\": \"filesystem\", \"logger_path\": \"\/var\/log\/osquery\", \"disable_logging\": \"false\", \"log_result_events\": \"true\", \"schedule_splay_percent\": \"10\", \"pidfile\": \"\/var\/osquery\/osquery.pidfile\", \"events_expiry\": \"3600\", \"database_path\": \"\/var\/osquery\/osquery.db\", \"verbose\": \"false\", \"worker_threads\": \"2\", \"enable_monitor\": \"true\", \"disable_events\": \"false\", \"disable_audit\": \"false\", \"audit_allow_config\": \"true\", \"host_identifier\": \"hakase-labs\", \"enable_syslog\": \"true\", \"syslog_pipe_path\": \"\/var\/osquery\/syslog_pipe\", \"force\": \"true\", \"audit_allow_sockets\": \"true\", \"schedule_default_interval\": \"3600\" }, \n \n \"schedule\": { \"crontab\": { \"query\": \"SELECT * FROM crontab;\", \"interval\": 300 }, \"system_info\": { \"query\": \"SELECT hostname, cpu_brand, physical_memory FROM system_info;\", \"interval\": 3600 }, \"ssh_login\": { \"query\": \"SELECT username, time, host FROM last WHERE type=7\", \"interval\": 360 } }, \n \"decorators\": { \"load\": [ \"SELECT uuid AS host_uuid FROM system_info;\", \"SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;\" ] }, \n \"packs\": { \"osquery-monitoring\": \"\/usr\/share\/osquery\/packs\/osquery-monitoring.conf\" } \n}<\/pre>\nSave and exit.<\/p>\n
Note: <\/strong><\/p>\n
- \n
- We’re using the ‘filesystem’ as a config and logger plugins.<\/li>\n
- Define the logger path to the ‘\/var\/log\/osquery’ directory.<\/li>\n
- Enable the syslog pip to the ‘\/var\/syslog\/syslog_pipe’ file.<\/li>\n
- On the scheduler, we define three queries for checking the crontab, system info, and ssh login.<\/li>\n
- Enable the osquery packs named ‘osquery-monitoring’, and packs files located at the ‘\/usr\/share\/osquery\/packs’ directory.<\/li>\n<\/ul>\n
Now start the osqueryd daemon service and enable it to launch every time at system boot.<\/p>\n
systemctl start osqueryd
systemctl enable osqueryd<\/p>\nAnd restart the rsyslog service.<\/p>\n
systemctl restart rsyslog<\/p>\n
Basic configuration osquery has been completed.<\/p>\n
![\"\"](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux-2.png\" "\\"\\"")
<\/a><\/p>\nStep 4 – Configure File Integrity Monitoring (FIM) Using osquery<\/h2>\n
Osquery provides File Integrity Monitoring on Linux and MacOS Darwin using the inotify and FSEvents. Simply, it monitors and detects any changes of files on the defined directory using the ‘file_path’and then store all activity to the file_events table.<\/p>\n
In this step, we will configure osquery to monitor important directories such as home, ssh directory, etc, tmp, and the www web root directory using custom FIM packs.<\/p>\n
Go to the ‘\/usr\/share\/osquery\/packs’ directory and create a new packs configuration file ‘fim.conf’.<\/p>\n
cd \/usr\/share\/osquery\/packs
vim fim.conf<\/p>\nPaste configurations below.<\/p>\n
{ \"queries\": { \"file_events\": { \"query\": \"SELECT * FROM file_events;\", \"removed\": false, \"interval\": 300 } }, \"file_paths\": { \"homes\": [ \"\/root\/.ssh\/%%\", \"\/home\/%\/.ssh\/%%\" ], \"etc\": [ \"\/etc\/%%\" ], \"home\": [ \"\/home\/%%\" ], \"tmp\": [ \"\/tmp\/%%\" ], \"www\": [ \"\/var\/www\/%%\" ] } \n}<\/pre>\nSave and exit.<\/p>\n
Now back to the ‘\/etc\/osquery’ configuration directory and edit the osquery.conf file.<\/p>\n
cd \/etc\/osquery\/
vim osquery.conf<\/p>\nAdd the File Integrity Monitoring packs configuration inside the ‘packs’ section.<\/p>\n
\"packs\": { \"osquery-monitoring\": \"\/usr\/share\/osquery\/packs\/osquery-monitoring.conf\", \"fim\": \"\/usr\/share\/osquery\/packs\/fim.conf\" }<\/pre>\n![\"osquery](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux-3.png\" "\\"\\"")
<\/a><\/p>\nSave and exit, then restart the osqueryd service.<\/p>\n
systemctl restart osqueryd<\/p>\n
![\"Restart](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux-4.png\" "\\"\\"")
<\/a>
<\/strong><\/p>\nNote:<\/strong><\/p>\n
Keep checking the JSON configuration file using the JSON linter ‘http:\/\/jsonlint.com\/<\/a>‘ and make sure there is no error.<\/p>\n
Step 5 – Testing<\/h2>\n
We will test the File Integrity Monitoring packs by creating a new file on the defined directory ‘home’ and ‘www’.<\/p>\n
Go to the ‘\/var\/www\/’ directory and create a new file named ‘howtoforge.md’.<\/p>\n
cd \/var\/www\/
touch howtoforge.md<\/p>\nGo to the ‘\/home\/youruser\/’ directory and create a new file named ‘hakase-labs.md’.<\/p>\n
cd \/home\/vagrant\/
touch hakase-labs.md<\/p>\nNow we will check all logs monitoring using the real-time interactive mode osqueryi and the logs of the osquery results.<\/p>\n
![\"Testing](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux-5.png\" "\\"\\"")
<\/a><\/p>\nosqueryi<\/h3>\n
Run the osqueryi command below.<\/p>\n
osqueryi –config-path \/etc\/osquery\/osquery.conf<\/p>\n
Now check all logs about file changes in the ‘file_events’ table.<\/p>\n
For global changes.<\/p>\n
select * from file_events;<\/p>\n
For ‘home’ directory.<\/p>\n
select target_path, category, action, atime, ctime, mtime from file_events WHERE category=”home”;<\/p>\n
For the ‘www’ web root directory.<\/p>\n
select target_path, category, action, atime, ctime, mtime from file_events WHERE category=”www”;<\/p>\n
![\"Using](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux-6.png\" "\\"\\"")
<\/a><\/p>\nosqueryd results log<\/h3>\n
Go to the ‘\/var\/log\/osquery’ directory and you will get the ‘osqueryd.results.log’ file.<\/p>\n
cd \/var\/log\/osquery\/
ls -lah osqueryd.results.log<\/p>\nFilter the osquery logs using the ‘grep’ command.<\/p>\n
grep -rin howtoforge.md osqueryd.results.log
grep -rin hakase-labs.md osqueryd.results.log<\/p>\nYou will see info about those file has been created.<\/p>\n
![\"osqueryd](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux-7.png\" "\\"\\"")
<\/a><\/p>\nThe installation and configuration of the File Integrity Monitoring (FIM) on Linux Server Ubuntu and CentOS using osquery has been completed successfully.<\/p>\n
Reference<\/h2>\n
\nAbout Muhammad Arul<\/strong><\/p>\n
Muhammad Arul is a freelance system administrator and technical writer. He is working with Linux Environments for more than 5 years, an Open Source enthusiast and highly motivated on Linux installation and troubleshooting. Mostly working with RedHat\/CentOS Linux and Ubuntu\/Debian, Nginx and Apache web server, Proxmox, Zimbra Administration, and Website Optimization. Currently learning about OpenStack and Container Technology.<\/p>\n<\/div>\n
\nShare this page:<\/b><\/p>\n
\n
![\"\"](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux-8.png\" "\\"\\"")
<\/a>
\n![\"\"](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux-9.png\" "\\"\\"")
<\/a>
\n![\"\"](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux-10.png\" "\\"\\"")
<\/a>
\n![\"\"](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/09\/how-to-setup-file-integrity-monitoring-fim-using-osquery-on-linux-11.png\" "\\"\\"")
<\/a>\n<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"Osquery is an open source operating system instrumentation, monitoring, and analytics. Created by Facebook, it exposes an operating system as a high-performance relational database that can be queried using SQL-based queries. Osquery is a multi-platform software, can be installed on Linux, Windows, MacOS, and FreeBSD. It allows us to explore all of those operating systems’ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[],"class_list":["post-6593","post","type-post","status-publish","format-standard","hentry","category-36"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/6593","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=6593"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/6593\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=6593"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=6593"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=6593"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Install](\"https:\/\/www.howtoforge.com\/images\/how_to_setup_file_integrity_monitoring_fim_using_osquery_on_linux_server\/big\/1.png\" "\\"\\"")
<\/a><\/p>\n