| 1 | #!/bin/sh |
| 2 | |
| 3 | # Do you want to update it? (y/n) [y]: |
| 4 | export USER_UPDATE=y |
| 5 | |
| 6 | # Do you want to update the rules? (y/n) [y]: |
| 7 | export USER_UPDATE_RULES=y |
| 8 | |
| 9 | # User Language: |
| 10 | export USER_LANGUAGE=en |
| 11 | |
| 12 | # Do you want e-mail notification? (y/n) [y]: |
| 13 | export USER_ENABLE_EMAIL=y |
| 14 | # What's your e-mail address? |
| 15 | export [email protected] |
| 16 | # What's your SMTP server ip/host? |
| 17 | export USER_EMAIL_SMTP=localhost |
| 18 | |
| 19 | # Do you want to run the integrity check daemon? (y/n) [y]: |
| 20 | export USER_ENABLE_SYSCHECK=y |
| 21 | |
| 22 | #Do you want to run the rootkit detection engine? (y/n) [y]: |
| 23 | export USER_ENABLE_ROOTCHECK=y |
| 24 | |
| 25 | # Active response allows you to execute a specific |
| 26 | # command based on the events received. For example, |
| 27 | # you can block an IP address or disable access for |
| 28 | # a specific user. |
| 29 | # More information at: |
| 30 | # https://ossec.github.io/docs/manual/ar/ |
| 31 | # |
| 32 | # - Do you want to enable active response? (y/n) [y]: |
| 33 | export USER_ENABLE_ACTIVE_RESPONSE=y |
| 34 | |
| 35 | # - By default, we can enable the host-deny and the |
| 36 | # firewall-drop responses. The first one will add |
| 37 | # a host to the /etc/hosts.deny and the second one |
| 38 | # will block the host on iptables (if linux) or on |
| 39 | # ipfilter (if Solaris, FreeBSD or NetBSD). |
| 40 | # - They can be used to stop SSHD brute force scans, |
| 41 | # portscans and some other forms of attacks. You can |
| 42 | # also add them to block on snort events, for example. |
| 43 | # |
| 44 | # - Do you want to enable the firewall-drop response? (y/n) [y]: |
| 45 | export USER_ENABLE_FIREWALL_RESPONSE=y |
| 46 | |
| 47 | # Do you want to add more IPs to the white list? (y/n)? [n]: |
| 48 | # if set to y, installer will ask you to enter the list of IPs |
| 49 | # if you want to use this feature, you must also export USER_NO_STOP=no |
| 50 | export USER_WHITE_LIST=n |
| 51 | |
| 52 | # Do you want to enable remote syslog (port 514 udp)? (y/n) [y]: |
| 53 | export USER_ENABLE_SYSLOG=y |
| 54 | |
| 55 | # IP address or hostname of the ossec server. Only used on agent installations. |
| 56 | # export USER_AGENT_SERVER_IP="127.0.0.1" |
| 57 | # export USER_AGENT_SERVER_NAME |
| 58 | # Agent's config profile name. This is used to create agent.conf configuration profiles |
| 59 | # for this particular profile name. Only used on agent installations. |
| 60 | # Can be any string. E.g. LinuxDBServer or WindowsDomainController |
| 61 | export USER_AGENT_CONFIG_PROFILE="generic" |
| 62 | |
| 63 | |