this is what i have been doing, but with ubuntu and a configuration manager(salt), the one bit i have not yet automated is the creation and acceptance of keys, as that seems to require manual input on both agent and server, but have not dug enough into it to see if it can be fully automated, since i is a one time issue and i don't spin up new boxes every day, its been a pretty low pain point. If you find something to automate the key exchange, even in windows, i'd love to hear it, and i will do the same. I do have the benefit of automating the install and other configuration, which is what i enjoy over image installs.
Happy Hunting! On Mon, Sep 18, 2017 at 9:09 AM, <krauswerner...@gmail.com> wrote: > Maybe it helps to use a script while the start. Something like: start > "C:\Program Files (x86)\ossec-agent\manage_agents.exe" .... ? > Has anyone an idea? > > > Am Freitag, 15. September 2017 14:26:57 UTC+2 schrieb krauswe...@gmail.com > : >> >> Hi. Sorry for the bad explantation. >> It's a provisioning concept. I have an image on a storage, servers take >> this image. That's why all have the same installation - all have the same >> ossec keys. That's my problem. >> >> Best Regards >> >> >> >> Am Freitag, 15. September 2017 14:09:08 UTC+2 schrieb dan (ddpbsd): >>> >>> On Fri, Sep 15, 2017 at 3:03 AM, <krauswe...@gmail.com> wrote: >>> > Hi, >>> > I have 5 windows server 2008 and they booting the same image. How can >>> I use >>> > OSSEC for them? Installing it one the image makes no sense in my view. >>> I >>> > know there is an option to use remote monitoring with ossec. Where can >>> I >>> > find the needed keys in the windows system? >>> > >>> >>> I don't know what you mean by "booting the same image." Were they >>> installed from the same image, or do they share a common "C:" drive >>> (which would be really neat)? >>> >>> Either way, each system would need to have the OSSEC agent installed >>> on it, and be given different OSSEC keys. The keys are obtained by >>> running manage_agents on the OSSEC server, and copying them to the >>> system (the windows agent has a gui for this). >>> >>> > Best Regards >>> > Werner >>> > >>> > -- >>> > >>> > --- >>> > You received this message because you are subscribed to the Google >>> Groups >>> > "ossec-list" group. >>> > To unsubscribe from this group and stop receiving emails from it, send >>> an >>> > email to ossec-list+...@googlegroups.com. >>> > For more options, visit https://groups.google.com/d/optout. >>> >> -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
