Linux Server

• What is Discovered and Monitored
• Event Types
• Rules
• Reports
• Configuration
• Settings for Access Credentials

What is Discovered and Monitored

Protocol	Information Discovered	Metrics collected	Used for
SNMP	Host name, generic hardware (cpu, memory, network interface, disk), software (operating system version, installed software, running processes, open TCP/UDP ports)	Uptime, CPU/Memory/Network Interface/Disk space utilization, Swap space utilization, Network Interface Errors, Running Process Count, Installed Software change, Running process CPU/memory utilization, Running process start/stop, TCP/UDP port up/down	Performance Monitoring
SSH	OS type, Hardware (cpu details, memory)	Memory paging rate, Disk I/O utilization	Performance Monitoring
Syslog	Vendor, Model	General logs including Authentication Success/Failure, Privileged logons, User/Group Modification	Security Monitoring and Compliance
Syslog (via FortiSIEM Linux Agent)		File or directory change: User, Type of change, directory or file name	Security Monitoring and Compliance

Event Types

In ADMIN > Device Support > Event Types, search for "linux" to see the event types associated with this device.

Rules

In RESOURCES > Rules, search for "linux" in the main content panel Search... field to see the rules associated with this device.

Reports

In RESOURCES > Reports , search for "linux" in the main content panel Search... field to see the reports associated with this device.

Configuration

• SNMP v1 and v2c
• SNMP v3
• SSH
• Syslog Logging
• Basic Linux File Monitoring over Syslog

SNMP v1 and v2c

1. Make sure that snmp libraries are installed. FortiSIEM has been tested to work with net-snmp libraries.
2. Log in to your server with administrative access.
3. Make these modifications to the /etc/snmp/snmpd.conf file:
   1. Define the community string for FortiSIEM usage and permit snmp access from FortiSIEM IP.
   2. Allow FortiSIEM read-only access to the mib-2 tree.
   3. Allow Accelops read-only access to the enterprise MIB: UCD-SNMP-MIB.
   4. Open up the entire tree for read-only view.
4. Reduce the logging level to avoid per connection logging which may cause resource issues (see here for more details):
   
   1. Edit /etc/sysconfig/snmpd (on RedHat/CentOS) or /etc/defaults/snmpd (on Debian/Ubuntu)
   2. Look for the line that passes the command line options to snmpd. On RedHat Enterprise 6 this looks like:
      

      # snmpd command line options
      OPTIONS="-LS0-6d -Lf /dev/null -p /var/run/snmpd.pid"

   3. Change the range from 0-6 to 0-5:
      

      # snmpd command line options
      OPTIONS="-LS0-5d -Lf /dev/null -p /var/run/snmpd.pid"

5. Restart the snmpd deamon by issuing /etc/init.d/snmpd restart.
6. Add the snmpd daemon to start from boot by issuing chkconfig snmpd on.
7. Make sure that snmpd is running.

SNMP v3

Configuring rwcommunity/rocommunity or com2sec

1. Log in to your Linux server.
2. Stop SNMP.

   service snmpd stop

3. Use vi to edit the /etc/snmp/snmpd.conf file.
   Before you edit this file, make sure you have created a backup, as it is very important to have a valid version of this file so the snap daemon has correct credentials.

   vi /etc/snmp/snmpd.conf

4. At the end of the file, add this line, substituting your username for snmpv3user and removing the <> tags: rouser <snmpv3user>.
5. Save the file.
6. Use vi to edit the /var/lib/snmp/snmpd.conf file.
   Before you edit this file, make sure you have created a backup, as it is very important to have a valid version of this file for the SNMP daemon to function correctly.

   vi /var/lib/snmp/snmpd.conf

7. At the end of the file, add this line, entering the username you entered in step 4, and then passwords for that user for MD5 and DES.
   If you want to use SHA or AES, then add those credentials as well.

   createUser <snmpv3user>        MD5 <snmpv3md5password> DES <snmpv3despassword>

8. Save the file.
9. Reduce the logging level to avoid per connection logging which may cause resource issues (see here for more details)
   
   1. Edit /etc/sysconfig/snmpd (on RedHat/CentOS) or /etc/defaults/snmpd (on Debian/Ubuntu)
   2. Look for the line that passes the command line options to snmpd. On RedHat Enterprise 6 this looks like:
      

      # snmpd command line options
      OPTIONS="-LS0-6d -Lf /dev/null -p /var/run/snmpd.pid"

      
      

   3. Change the range from 0-6 to 0-5:
      

      # snmpd command line options
      OPTIONS="-LS0-5d -Lf /dev/null -p /var/run/snmpd.pid"

10. Restart SNMP.

    service snmpd start
    chkconfig auditd on

11. View the contents of the /var/lib/snmp/snmpd.conf file.
    

    If this works, restarting snmpd will have no errors, also the entry that you created under /var/lib/snmp/snmpd.conf will be removed:

    cat /var/lib/snmp/snmpd.conf

12. Run snmpwalk -v 3 -u <snmpv3user> -l authpriv <IP> -a MD5 -A <snmpv3md5password> -x DES -X <snmpv3despassword>
    You will see your snmpwalk if this works. If there are any errors, see net-snmp for further instructions.

Configuring net-smnp-devel

If you have net-snmp-devel on your Linux server/client, follow these steps to configure SNMP v3.

1. Stop SNMP.

   service snmpd stop

2. Run net-snmp-config --create-snmpv3-user -ro -A <MD5passwordhere> -X <DESpasswordhere> -x DES -a MD5 <SNMPUSERNAME>.
3. Restart SNMP.

   service snmpd start

4. Test by following step 10 from above.

SSH

1. Make sure that the vmstat and iostat commands are available. If not, install these libraries.
2. Create a user account that can issue vmstat and iostat commands. FortiSIEM will use that user account to log in to the server.

Syslog Logging

Syslog forwarding can be configured on Linux servers to send the logs to FortiSIEM. There are different options regarding syslog configuration, including Syslog over TLS.

There are typically two commonly-used Syslog demons:

• Syslog-ng
• Rsyslog

Basic Syslog-ng Configuration

Follow these steps to enable basic syslog-ng:

1. Add the following line to your syslog-ng configuration:

   { udp("Collector IP" port(514));};

2. Restart the syslog-ng service or reload the configuration.

Additional Syslog-ng Configuration Information and Example

Source options are:

internal() means syslog-ng internal log messages.

system() means depending on your platform, syslog-ng will automatically collect the common log sources.

Filter functions:

facility(xx,xx,xx) allows filtering only the defined log facilities

Here is an example of configuring just authpriv and auth log facilities.
Note: Remember to replace italicized text with your content.

1. Open the /etc/syslog-ng/syslog-ng.conf file.
   

2. Add the following configuration.
   

   source fsiem_source {
                   internal();
                   system();
   };
   filter fsiem_filter {
       facility(auth, authpriv);
   };
   destination fsiem_destination {
       udp("<collector_ip>" port(514));
   };
   log{
       source(fsiem_source);
       filter(fsiem_filter);
       destination(fsiem_destination);
   };
   

3. Save the file and restart syslog-ng by running the command:
   

   service syslog-ng restart
   

   or
   

   systemctl restart syslog-ng
   

Here is an example of verbose logging, where all log facilities are sent.
Note: Remember to replace italicized text with your content.

1. Open the /etc/syslog-ng/syslog-ng.conf file.

2. Add the following configuration.

   source fsiem_source {
                   internal();
                   system();
   };
   destination fsiem_destination {
       udp("<collector_ip>" port(514));
   };
   log{
       source(fsiem_source);
       destination(fsiem_destination);
   };
   

3. Save the file and restart syslog-ng by running the command:
   

   service syslog-ng restart
   

   or
   

   systemctl restart syslog-ng

Basic Rsyslog Configuration

Follow these steps to enable rsyslog:

1. Add the following lines to your rsyslog configuration:

   # Send logs to the FortiSIEM Collector

   *.* @Collector IP:514

2. Restart the rsyslog service or reload the configuration.

Additional Rsyslog Configuration Information and Example

Rsyslog has a list of supported facilities, or app subsystems shown here.

Supported Facility/App Subsystem	Description
auth, authpriv	authentication and authorization logs
cron	cron scheduling
daemon	affects a daemon without any special classification (DNS, NTP, etc)
ftp	ftp server events
kern	kernel messages
lpr	printing subsystem
mail	email subsystem
news	Usenet subsystem messages, NNTP, etc...
syslog	internal syslogd server messages
user	user messages (generic)
uucp	UUCP server messages
local0 - local7	local user

Each message has a priority level, listed here from the most important to least important priority.

emerg, alert, crit, error, warn, notice, info, debug

In the rsyslog conf file, you can reference to log a facility in the format shown here.

<facility>.<priority> @<server ip or name>:<server_port>

where @ implies UDP and @@ implies TCP, and the italicized text should be replaced with your information.

A wildcard for any facility can be specified with an asterisk (*). For example:

auth.* means any priority of auth messages are sent to target.

Here is a walk through example to just log authentication messages to FortiSIEM from modifying the rsyslog.conf file (vi /etc/rsyslog.conf)
Note: Remember to replace italicized text with your content.

1. Add the following lines to only add audit trails to be sent to the FortiSIEM collector.
   

   authpriv.* @<Your_FortiSIEM_Collectors_IP_or_Hostname>:514
   

   auth.* @<Your_FortiSIEM_Collectors_IP_or_Hostname>:514
   

2. Save the file and restart rsyslog using the following command.
   

   service rsyslogd restart

   or

   systemctl restart rsyslog.service
   

3. log into this server or run a sudo command to confirm that logs appear in FortiSIEM, and that a CMDB entry is created if it does not already exist.

   For verbose logging for all facilities and priorities, use the following.

   *.* @<server ip or hostname>:514

Linux File Monitoring

FortiSIEM has licensed Linux agents that provide additional capabilities, such as custom log forwarding and central management. See the “Linux Agent Installation Guide” for details on this agent.

Settings for Access Credentials

• SNMP Access Credentials for All Devices
• SSH Access Credentials for All Devices

SNMP Access Credentials for All Devices

Set these Access Method Definition values to allow FortiSIEM to communicate with your device over SNMP. Set the Name and Community String.

Setting	Value
Name	<set name>
Device Type	Generic
Access Protocol	SNMP
Community String	<your own>

SSH Access Credentials for All Devices

These are the generic settings for providing SSH access to your device from FortiSIEM.

Setting	Value
Name	ssh-generic
Device Type	Generic
Access Protocol	SSH
Port	22
User Name	A user who has access credentials for your device over SSH
Password	The password for the user