Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to deploy some file integrity monitoring and intrusion detections software on AWS instances.

I really wanted to use OSSEC, however it does not work well in an environment where servers can auto deploy and shut down based on load, because it requires server managed keys to be generated. Including the agent in the AMI will not allow monitoring as soon as it comes up because of that.

There are many options out there, and several are listed in other posts on this site, however none that I've seen so far deal with the unique problems inherent in AWS or cloud based deployments in general.

Can anyone point me at some products, preferably open source, that we might use to cover those portions of PCI DSS that require this software?

Has anyone else achieved this on AWS?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

I think you can still use OSSEC. A while back i found a blog that seems to indicate that you can at least automate it with puppet, which would mean you could probably create a lot of excess keys, then just assign them as needed possibly.

http://myrondavis.org/2010/12/how-to-completely-automate-ossec.html

share|improve this answer
add comment

There is an option to move to PKI instead of symmetric encryption with the ossec-authd. http://dcid.me/blog/2011/01/automatically-creating-and-setting-up-the-agent-keys/

This would make additions of auto spawned agents (scale out) to the server very easy. But removal of agents upon scale-in is the hard part. https://groups.google.com/forum/#!msg/ossec-list/cpoopmzBf3Q/JZObqvgAFi4J

One idea suggested on the above link is to have a monkey to clean up dead instances from the server periodically by querying AWS. That would work because once an instance dies as a result of scale-in, it will begin to fail the OSSEC server's keep-alive signals. So the monkey could detect inactive agents then check AWS to see if the instance is terminated and remove it from the OSSEC server.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["        <li><a href=\"http://area51.stackexchange.com\" title=\"proposing new sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"http://careers.stackoverflow.com\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a> \r\n                with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.4.18.1558\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Server Fault works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\r\n    </noscr"], "copyright__copyright__copyright": ["S. That would work because once an instance dies as a result of scale-in, it will begin to fail the OSSEC server's keep-alive signals. So the monkey could detect inactive agents then check AWS to see if the instance is terminated and remove it from the OSSEC server.\n\nshare|improve this answer\nadd comment\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}