Systemd control by ddpbsd · Pull Request #895 · ossec/ossec-hids

ddpbsd · 2016-07-12T13:45:48Z

Requires/includes PR #894

This should allow ossec-control to utilize systemd to manage the ossec processes. Also untested, and kind of unsure if I finished it.

This change is

execution order. dbd, agentless, and csyslog only start after everything else, but I did not concern myself with the execution order of those 3.

I have no doubts the logic can improve, but I want to get a PoC in place.

systemd know when to start these programs.

actually start the daemons

…rvices

…ntrol

jrossi · 2016-08-24T13:37:42Z

src/init/ossec-server.sh

+    ## XXX - system paths and exact execution are probably wrong.
+    if [ X`uname` == "XLinux" ]; then
+        if [ -x /sbin/systemctl ]; then
+            /sbin/ssytemctl start ossec-server.service


ssytemctl
Think this might need to be systemctl

…ntrol

@jrossi

from @jrossi

ddpbsd · 2016-08-24T14:05:53Z

Fixed the ssytemctl typo.

…into systemd_combined

…stemd_combined

…temd_control

…systemd_control

Add the same stuff for ossec-agent

…s/git/github/ddpbsd/ossec-hids into systemd_control

ddpbsd · 2016-09-15T13:16:51Z

I'm lightly testing the agent bits on Ubuntu 16.whatever LTS. Seems to be going well-ish so far.

actually in /bin. Try to make it less location dependent.

ddpbsd · 2017-03-15T17:58:51Z

I think restart isn't working. Will test later and update.

…temd_control

phamvuong · 2018-08-22T15:39:33Z

src/systemd/agent/ossec-execd.service

 [Unit]
 Description=OSSEC Execd
 PartOf=ossec-agent.target
+Before=ossec-ossec-syscheckd.service ossec-agentd.service ossec-logcollector.service


typo here ? should be ossec-syscheckd

Thanks for spotting those mistakes. They should be corrected now.

phamvuong · 2018-08-22T15:41:18Z

src/init/ossec-server.sh

+            ${SYSTEMCTL} stop ossec-server.target
+        fi
+        exit 0
+    if


…ntrol

phamvuong · 2018-08-23T07:10:44Z

@ddpbsd I'm not sure if you want this kind of behavior: if one of the member services (such as execd, syscheckd, etc) is killed/crashed by some reason, the server/agent target should be stopped.
If this is the case then I think you may want to use this option in the target file
https://www.freedesktop.org/software/systemd/man/systemd.unit.html#BindsTo=

[Unit]
Description=OSSEC HIDS agent
After=network.target
BindsTo=ossec-execd.service ossec-syscheckd.service ossec-agentd.service ossec-logcollector.service

Wants=ossec-dbd.service
Wants=ossec-csyslog.service
Wants=ossec-agentless.service

[Install]
WantedBy=multi-user.target

phamvuong · 2018-08-23T07:18:30Z

And also there is one concern in this part of signal handle code:
https://github.com/ossec/ossec-hids/blob/master/src/shared/sig_op.c#L33

If the exit code is always 1, then service's Active state is always failed instead of 'inactive (dead)' if we use 'systemctl stop' to stop the target or any service.

client-syscheckd.service - OSSEC syscheckd
   Loaded: loaded (/usr/lib/systemd/system/client-syscheckd.service; static; vendor preset: disabled)
   Active: failed (Result: exit-code) since Thu 2018-08-23 09:06:30 CEST; 39s ago
  Process: 5235 ExecStart=/usr/bin/env ${DIRECTORY}/bin/ossec-syscheckd -f (code=exited, status=1/FAILURE)
  Process: 5225 ExecStartPre=/usr/bin/env ${DIRECTORY}/bin/ossec-syscheckd -t (code=exited, status=0/SUCCESS)
 Main PID: 5235 (code=exited, status=1/FAILURE)

phamvuong · 2018-08-28T06:50:31Z

For the reload option in ossec-control.sh, you can apply the same thing in systemd using below option https://www.freedesktop.org/software/systemd/man/systemd.unit.html#PropagatesReloadTo=

However, it is applied for systemd version 235 and later only.

phamvuong · 2018-08-29T06:57:32Z

src/systemd/server/ossec-syscheckd.service

 Description=OSSEC syscheckd
 PartOf=ossec-server.target
+After=ossec-maild.service ossec-execd.service ossec-analysisd.service ossec-remoted.service
+Before=ossec-agentless.service ossec-csyslog.service ossec-dbd.service ossec-monitord.service ossec-remoted.service


ossec-remoted has been in "After" section

phamvuong · 2018-08-31T06:59:29Z

src/systemd/server/ossec-remoted.service

 [Unit]
 Description=OSSEC remoted
 PartOf=ossec-server.target
+After=ossec-maild.service ossec-execd.service ossec-analysisd.service ossec-logcollector


ossec-logcollector.service

ddpbsd added 8 commits May 3, 2016 08:36

use Before and After to determine the order these should start in.

63fb433

Adjust the service files for the server install to preserve desired

56d40d3

execution order. dbd, agentless, and csyslog only start after everything else, but I did not concern myself with the execution order of those 3.

Stop the processes too, I guess.

42a7434

I have no doubts the logic can improve, but I want to get a PoC in place.

Add enable files for dbd, agentlessd, and csyslogd. This should help

58bafaa

systemd know when to start these programs.

Require the dot files created when enabling via ossec-control to

b425d0a

actually start the daemons

Enable disable in systemd setups.

358811a

Merge branch 'master' of github.com:ddpbsd/ossec-hids into systemd_se…

da1cfee

…rvices

Merge branch 'master' of github.com:ddpbsd/ossec-hids into systemd_co…

c243cd9

…ntrol

jrossi reviewed Aug 24, 2016
View reviewed changes

ddpbsd added 2 commits August 24, 2016 10:04

Merge branch 'master' of github.com:ddpbsd/ossec-hids into systemd_co…

5900c89

…ntrol

ssytemctl -> systemctl

fccfb6b

from @jrossi

ddp and others added 4 commits September 15, 2016 07:18

Merge branch 'systemd_control' of https://github.com/ddpbsd/ossec-hids …

23662c5

…into systemd_combined

Merge branch 'master' of https://github.com/ddpbsd/ossec-hids into sy…

249ac8d

…stemd_combined

Merge branch 'master' of https://github.com/ossec/ossec-hids into sys…

07e0c4f

…temd_control

Merge branch 'systemd_services' of github.com:ddpbsd/ossec-hids into …

314ed7f

…systemd_control

ddpbsd mentioned this pull request Sep 15, 2016

Systemd services #894

Closed

ddp and others added 6 commits September 15, 2016 07:50

I think ossec-server.service should be ossec-server.target.

2e2dccf

Add the same stuff for ossec-agent

UNTESTED: Try to install the systemd files

3da96bf

Silly typo.

ea84264

ENEEDCOFFEE: Fix the paths.

0c1817f

I forgot /bin/sh is neutered on Ubuntu.

79fd4e1

Merge branch 'systemd_combined' of ssh://buzzell/home/ddp/src/project…

3f2e6dd

…s/git/github/ddpbsd/ossec-hids into systemd_control

ddpbsd added 3 commits September 15, 2016 09:36

Try to appease systems without /etc/systemd/system

2f4d859

X -> x

e387076

I'm not sure why I thought systemctl was installed in /sbin, it's

0a09265

actually in /bin. Try to make it less location dependent.

ddpbsd added enhancement in progress labels Mar 15, 2017

Merge branch 'master' of https://github.com/ossec/ossec-hids into sys…

309d5e2

…temd_control

ddpbsd mentioned this pull request Apr 26, 2017

The ossec-remoted unit file requires the forking config otherwise it … #1116

Merged

phamvuong reviewed Aug 22, 2018

View reviewed changes

src/init/ossec-server.sh Outdated

${SYSTEMCTL} stop ossec-server.target

fi

exit 0

if

Copy link

phamvuong Aug 22, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fi

ddpbsd added 2 commits August 22, 2018 13:03

Merge branch 'master' of github.com:ddpbsd/ossec-hids into systemd_co…

df44614

…ntrol

2 silly mistakes spotted by phamvuong

0bc9ad2

phamvuong reviewed Aug 29, 2018

View reviewed changes

phamvuong reviewed Aug 31, 2018

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Systemd control#895

Systemd control#895
ddpbsd wants to merge 26 commits intoossec:masterfrom
ddpbsd:systemd_control

ddpbsd commented Jul 12, 2016 •

edited by jrossi

Loading

Uh oh!

jrossi Aug 24, 2016

Uh oh!

ddpbsd commented Aug 24, 2016

Uh oh!

ddpbsd commented Sep 15, 2016

Uh oh!

ddpbsd commented Mar 15, 2017

Uh oh!

phamvuong Aug 22, 2018

Uh oh!

ddpbsd Aug 22, 2018

Uh oh!

phamvuong Aug 22, 2018

Uh oh!

phamvuong commented Aug 23, 2018 •

edited

Loading

Uh oh!

phamvuong commented Aug 23, 2018 •

edited

Loading

Uh oh!

phamvuong commented Aug 28, 2018

Uh oh!

phamvuong Aug 29, 2018

Uh oh!

phamvuong Aug 31, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

ddpbsd commented Jul 12, 2016 • edited by jrossi Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jrossi Aug 24, 2016

Choose a reason for hiding this comment

Uh oh!

ddpbsd commented Aug 24, 2016

Uh oh!

ddpbsd commented Sep 15, 2016

Uh oh!

ddpbsd commented Mar 15, 2017

Uh oh!

phamvuong Aug 22, 2018

Choose a reason for hiding this comment

Uh oh!

ddpbsd Aug 22, 2018

Choose a reason for hiding this comment

Uh oh!

phamvuong Aug 22, 2018

Choose a reason for hiding this comment

Uh oh!

phamvuong commented Aug 23, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

phamvuong commented Aug 23, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

phamvuong commented Aug 28, 2018

Uh oh!

phamvuong Aug 29, 2018

Choose a reason for hiding this comment

Uh oh!

phamvuong Aug 31, 2018

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ddpbsd commented Jul 12, 2016 •

edited by jrossi

Loading

phamvuong commented Aug 23, 2018 •

edited

Loading

phamvuong commented Aug 23, 2018 •

edited

Loading