Wazuhを利用した大統一サーバ監査基盤

by Kazuhiko Yamashita

Slide 1

Slide 1 text

ʙ৽य़ͷ஍தւͰ͕͋ͬͨ1FSMΛఴ͑ͯʙ !QZBNB(.01FQBCP *OD :"1$5PLZP 8B[VIΛར༻ͨ͠ େ౷Ұαʔό؂ࠪج൫

Slide 2

Slide 2 text

γχΞɾϓϦϯγύϧΤϯδχΞ ࢁԼ࿨඙!QZBNB ϗεςΟϯάࣄۀ෦νʔϑςΫχΧϧϦʔυ IUUQTUFOTOBQPODPN

Slide 3

Slide 3 text

ϗεςΟϯάࣄۀ &$ࢧԉࣄۀ ϋϯυϝΠυɾͦͷଞࣄۀ

Slide 4

Slide 4 text

೥ ϩϦϙοϓʂϨϯλϧαʔόαʔϏεఏڙ։࢝ ೥ ೥ ೥ ϔςϜϧαʔϏεఏڙ։࢝ 1ࢁ͕ϖύϘʹೖࣾʂʂ̍ ೥݄೔ ࣛࣇౡݝग़ਫࢢʹ͓͍ͯ1ࢁര஀ʂʂ̍ ೥ ݱࡏɾ૑ۀ೥໨ ϜʔϜʔυϝΠϯαʔϏεఏڙ։࢝

Slide 5

Slide 5 text

45/4 -JOVY/444FSWFS TUOTKQ

Slide 6

Slide 6 text

45/4

Slide 7

Slide 7 text

ࠓ೔࿩͢͜ͱ w8B[VI֓ཁ wϖύϘͷ8B[VIಋೖܦҢ w8B[VIίϯϙʔωϯτ঺հ w8B[VIӡ༻ͷצॴ w·ͱΊ

Slide 8

Slide 8 text

ࠓ೔࿩͞ͳ͍͜ͱ w$MBN"7ʹ͍ͭͯ wUDQEQΛ༻͍ͨΫΤϦϩάอଘʹ͍ͭͯ w๻ͷ൒ੜͱ࠷ۙͷ࿀Ѫࣄ৘ʹ͍ͭͯ

Slide 9

Slide 9 text

8B[VI 5IF0QFO4PVSDF4FDVSJUZ1MBUGPSN XB[VIDPN

Slide 10

Slide 10 text

8B[VIJTBTFDVSJUZEFUFDUJPO WJTJCJMJUZ BOEDPNQMJBODFPQFOTPVSDFQSPKFDU*U XBTCPSOBTBGPSLPG044&$)*%4 BOEMBUFSXBTJOUFHSBUFEXJUI&MBTUJD4UBDL BOE0QFO4$"1 FWPMWJOHJOUPBNPSFDPNQSFIFOTJWFTPMVUJPO %PDVNFOUBUJPO8B[VI(FUUJOHTUBSUFE GSPNIUUQTEPDVNFOUBUJPOXB[VIDPNDVSSFOUHFUUJOHTUBSUFEJOEFYIUNM

Slide 11

Slide 11 text

8B[VIͰԿ͕Ͱ͖Δ͔ʁ ϑΝΠϧ੔߹ੑ؂ࢹ ϩά؂ࢹʹج͍ͮͨ৵ೖݕ஌ γεςϜઃఆϙϦγʔ؂ࠪ γεςϜ੬ऑੑ؂ࢹ

Slide 12

Slide 12 text

ϖύϘͷ8B[VIಋೖܦҢ

Slide 13

Slide 13 text

ηΩϡϦςΟ Πϯγσϯτͷൃੜ

Slide 14

Slide 14 text

ෆਖ਼ΞΫηεʹΑΔ ෆਖ਼ϓϩάϥϜͷ࣮ߦ

Slide 15

Slide 15 text

Πϯγσϯτ͕ى͖ͨͱ͖ʹௐࠪ͢Δ͜ͱ Կ ෺ Λෆਖ਼ΞΫηε͞Ε͔ͨʁ ෆਖ਼ΞΫηε͞Εͨ৘ใ͸Կ͔ʁ ͍ͭෆਖ਼ΞΫηε͕ߦΘΕͨͷ͔ʁ ͳͥෆਖ਼ΞΫηε͕ൃੜͨ͠ͷ͔ʁ ˞*1"৘ใ࿙͍͑ൃੜ࣌ͷରԠϙΠϯτूΑΓҰ෦ൈਮ

Slide 16

Slide 16 text

ਖ਼֬ͳඃ֐ͷ೺Ѳ͸ϏδωεͰ΋ ௒ॏཁ ෆਖ਼ΞΫηε͞Εͨ৘ใ͸Կ͔ʁ

Slide 17

Slide 17 text

ௐࠪखஈ w֤छγεςϜϩάɾΞϓϦέʔγϣϯϩά w%#ͷΫΤϦʔϩά wΞΫηε͞ΕͨՄೳੑͷ͋Δ৘ใΛ໢ཏతʹௐࠪ͢Δ

Slide 18

Slide 18 text

๲େͳ࣌ؒ ͱ࡞ۀྔ

Slide 19

Slide 19 text

࣍ඃ֐ͷ཈ࢭ ιʔγϟϧϦεΫ ૣٸʹਖ਼֬ͳ ৘ใ։͕ࣔඞཁ

Slide 20

Slide 20 text

8B[VI͕ղܾ͢Δ͜ͱ ؂ࠪ ؅ཧ ηΩϡϦςΟ؂ࠪͷ౷߹ج൫ wγεςϜίʔϧ؂ࢹ wϑΝΠϧ੔߹ੑ؂ࢹ wϙϦγʔ؂ࢹ wύοέʔδ੬ऑੑ؂ࢹ w؂ࠪঢ়گͷऩू wμογϡϘʔυͳͲͷ(6* w4MBDLͳͲͷ௨஌࿈ܞ w3&45GVM"1*

Slide 21

Slide 21 text

ϖύϘͷ8B[VIಋೖͷಈػ wαʔόͷ৵ೖͷݕ஌΍ෆਖ਼ͳৼΔ෣͍Λ௨஌ΛࣗಈԽɺͰ͖Ε͹ରԠ ·ͰࣗಈԽ͍ͨ͠ w$7&ొ࿥࣌ͳͲͷӨڹௐࠪΛϫϯετοϓͰߦ͍͍ͨ wҰͭͷ੬ऑੑΛશࣄۀ෦ԣ۲Ͱ؅ཧ͍ͨ͠

Slide 22

Slide 22 text

ϖύϘͷ8B[VIಋೖ wαʔόͷߏங͸!UONUͱͰҰ൩Ͱ࡞ͬͨ wΫϥΠΞϯτ΁ͷಋೖ͸ظ೔͸શࣾ౷Ұɺ༏ઌ౓Λ͚ͭͯಋೖΛਐΊ ͍ͯͬͨ wࣄۀ෦͝ͱʹ؅ཧ͢ΔΫϥΠΞϯτͷϩʔϧ͕ҟͳΔͨΊɺڞ௨෦෼ ͸$PPLCPPL΍ϚχϑΣετΛ044ͱͯ͠։ൃ͠ɺͦͷଞ͸֤ࣄۀ෦ Ͱνϡʔχϯά͠ɺͦͷϊ΢ϋ΢Λਵ࣌ࣾ಺ల։

Slide 23

Slide 23 text

ϖύϘͷ8B[VIಋೖޙ ৵ೖݕ஌ ֤αʔόʹಋೖͨ͠8B[VIΤʔδΣϯτ͕BVEJUMPHΛ࢝ΊɺγεςϜͷ;Δ·͍͔Βɺ ৵ೖΛݕ஌ࣗ͠ಈͰ௨஌ ॳಈରԠ ֤ࣄۀ෦͝ͱʹ8B[VI௨஌ޙͷΞΫγϣϯΛऔΓܾΊɺηΩϡϦςΟରࡦνʔϜͱ  ࿈ܞ ࣄޙରԠ μογϡϘʔυ΍"1*͔Β৘ใΛऩू ౷߹؅ཧ ύοέʔδͷ৘ใΛ࢝Ίɺ֤αʔόͷঢ়ଶΛऩूͰ͖ΔΑ͏ʹͳͬͨ͜ͱ͔Βɺશࣾԣ ۲Ͱͷαʔό؅ཧ͕Մೳʹͳͬͨ

Slide 24

Slide 24 text

8B[VIΞʔΩςΫνϟ

Slide 25

Slide 25 text

8B[VI

Slide 26

Slide 26 text

BHFOU 4ZTDIFDL -PHDPMMFDUPS 3PPUDIFDL .PEVMFT.BOBHFS

Slide 27

Slide 27 text

TFSWFS "OBMZTJT%BFNPO 3FNPUF%BFNPO 3&45GVM"1*

Slide 28

Slide 28 text

&MBTUJD4UBDL &MBTUJDTFBSDI ,JCBOB

Slide 29

Slide 29 text

8B[VI$MVTUFS ඪ४ػೳͰΫϥελϦϯά͕Ͱ͖Δ ৑௕ߏ੒͔ͭෛՙ෼ࢄ͕Մೳ TFSWFSXPSLFS TFSWFSXPSLFS TFSWFSXPSLFS -# DMJFOU DMVTUFS

Slide 30

Slide 30 text

ϖύϘେ౷Ұ8B[VI 0QFO4UBDL EPDLFSDPNQPTF XB[VI &MBTUJDTFBSDI EPDLFSDPNQPTF XB[VI &MBTUJDTFBSDI EPDLFSDPNQPTF XB[VI &MBTUJDTFBSDI EPDLFSDPNQPTF XB[VI &MBTUJDTFBSDI 0QFO4UBDL্ͷ7.Ͱ࣮ߦ ೝূ͸(4VJUFʹ౷߹ IUUQTHJUIVCDPNXB[VIXB[VIEPDLFS EPDLFSDPNQPTFͰΫϥελʔߏங

Slide 31

Slide 31 text

౷Ұج൫Ͱ΋ࡉ෼Խͯ͠؅ཧՄೳ άϧʔϓɾϥϕϧʹΑΔάϧʔϐϯά $ /var/ossec/bin/agent-auth -m MANAGER_IP -G lolipop lolipop ΫϥΠΞϯτొ࿥࣌ʹάϧʔϓࢦఆ ΫϥΠΞϯτͷઃఆϑΝΠϧʹ೚ҙͷ߲໨ΛMBCFMͰఆٛՄೳ

Slide 32

Slide 32 text

ϥϕϧͷఆٛʹج͍ͮͯ ௨஌εΫϦϓτ࣮ߦ

Slide 33

Slide 33 text

ӡ༻ͷצॴͱ࣮ྫ

Slide 34

Slide 34 text

ϊΠζΞϥʔτ

Slide 35

Slide 35 text

σϑΥϧτϧʔϧΛͦͷ··௨஌͢Δͱա৒௨஌ʹͳΔ ྫϗεςΟϯάʹ͓͚ΔϝʔϧೝূΤϥʔ ˠϊΠζ͕͋Δͱ͍ͣΕਓ͕ݟͳ͘ͳΔ ΞϥʔτʹଈରԠ͕ ඞཁͱ͍͏ӡ༻Λ໨ࢦ͢

Slide 36

Slide 36 text

ϊΠζΛݮΒ͢ख๏ ௨஌ϧʔϧϨϕϧΛมߋ͢Δ σϑΥϧτϧʔϧΛ্ॻ͖͢Δ ᶃ ϧʔϧϨϕϧΛม͑Δ ᶄ ϗετɾϩʔϧΛߜΔ

Slide 37

Slide 37 text

8B[VIͷΞϥʔτॲཧ /PWGUQVTFSBEE<>OFXHSPVQOBNF1" (*% UJNFTUBNQ/PW IPTUOBNFGUQ QSPHSBN@OBNFVTFSBEE SVMFJEMFWFM IPTUOBNFGUQIPTUOBNF JG@HSPVQTZTMPH BEEVTFS JG@HSPVQ EFTDSJQUJPO*HOPSFGPSDPMPSNFBEEPSEFMFUFVTFSHSPVQEFTDSJQUJPO HSPVQQDJ@ETT@ QDJ@ETT@ QDJ@ETT@ HQH@ HEQS@*7@E HEQS@*7@ HSPVQ SVMF %FDPEF .BUDI

Slide 38

Slide 38 text

1VMMSFRVFTU 3FWJFX.FSHF $* %FQMPZ ֤ࣄۀ෦ͷϝϯόʔ͕ɺϩʔΧϧϧʔϧΛ௥ه͠ɺ13 3VCZͷNJOJUFTUͰ࣮૷͞ΕͨɺࣗಈςετΛ࣮ߦ ҙਤ͞ΕͨϧʔϧͷΈ͕ਖ਼͘͠มߋ͞Ε͍ͯΔ͔ɺ ௥Ճ͞Ε͍ͯΔ͔Λςετ ϨϏϡΞʔʹࢦ໊͞Εͨϝϯόʔ͕ϨϏϡʔ͠ɺϚʔδ .BTUFS$*࣮ߦޙɺࣗಈͰ8B[VIج൫ʹσϓϩΠ ϩʔΧϧϧʔϧӡ༻

Slide 39

Slide 39 text

σϓϩΠര஄

Slide 40

Slide 40 text

γϯϘϦοΫϦϯΫΛར༻ͨ͠ σϓϩΠ͸'*.͔ΒݟΔͱશվ᜵ QBUITZN@BBUYU QBUITZN@CBUYU ɹσϓϩΠ ՔಇதͷαʔϏεʹ ṖͷϑΝΠϧ͕ஔ͔Εͨͱೝࣝ͞ΕΔ

Slide 41

Slide 41 text

pOEOPEF@NPEVMFTcXDM

Slide 42

Slide 42 text

8B[VIͷֶशσʔλΛ ύʔδ͢Δඞཁ͕͋Δ QBUITZN@BBUYU QBUITZN@CBUYU ɹσϓϩΠ 8B[VI%# νΣοΫαϜύεΛֶश ֶश͍ͯ͠ͳ͍ϑΝΠϧ͕௥Ճ͞Εͨ ˠΞϥʔτ $ curl -X DELETE "https://api.url/syscheck/ \ $(sudo sed -n 3p /var/ossec/queue/ossec/.agent_info)?pretty"

Slide 43

Slide 43 text

"1*Λ࢖͍౗͢ ͜Ε͔Β

Slide 44

Slide 44 text

ύοέʔδͷΠϯετʔϧঢ়گ΍ ੬ऑੑͷ༗ແΛऔಘ

Slide 45

Slide 45 text

ͲΜͳϓϩηε͕ಈ͍͍ͯΔ͔ʁ

Slide 46

Slide 46 text

IUUQTHJUIVCDPNNSUDXB[VI

Slide 47

Slide 47 text

·ͱΊ wηΩϡϦςΟɾΠϯγσϯτ͸ൃੜ͢ΔͱܦӦΛ༳Δ͕͢΄Ͳͷ  ΠϯύΫτ͕ى͜ΓಘΔ wى͖͔ͯΒͰ͸஗͍͠ɺى͖ͨ͋ͱ΋଎͕ඞཁ wະવʹ๷͙͜ͱɺൃੜΛݕ஌͢Δ͜ͱɺૣٸͳࣄޙऩଋΛ  ఏڙ͢Δ8B[VI͸ಋೖ΋؆୯ͩ͠ɺӡ༻΋ָ

Slide 48

Slide 48 text

5IBOLZPV ࠷৽ͷ࠾༻৘ใΛνΣοΫˠ !QC@SFDSVJU