ossec/ossec-hids — pull request #205 by mweigel (2014-05-10 23:15:23+00:00)
Title: Certificate verification for ossec-authd and agent-auth

Hi guys,

This has been worked on and discussed for a while. The main goal of this code is to increase the security around the ossec-authd and agent-auth components for users that want it while leaving existing users unaffected.

ossec-authd:

1. Added -x and -k options to allow users to load a certificate and private key from locations of their choice. If either option is not specified then the usual defaults will be used.

2. Added -v option to allow users to load a CA certificate to authenticate connecting agents. ossec-authd with perform the following checks on the certificate received from the agent:

- Verify it's signed by the appropriate CA and that it's within the validity period.

agent-auth:

1. Added -x and -k options to allow users to load a certificate and private key. If ossec-authd is run with the -v option then agents must present a valid certificate in order for a key to be generated.

2. Added -v option to allow users to load a CA certificate to authenticate the manager. agent-auth with perform the following checks on the certificate received from the manager:

- Verify it's signed by the appropriate CA and that it's within the validity period.

- Verify that the hostname or IP address of the manager given with the -m option on the command line is present in a subject alternative name field the common name field.

- Check that hostnames are well formed.

other:

1. agent-auth is building and running on Windows again. I've not committed any changes to the build files here as agent-auth is not being built by default for Windows currently and there is some debate over which direction to take with regards to the Windows client. I got the original client building for Windows again purely to see how much work would be involved in it.

To build agent-auth for Windows add the folling to "src/win32/make.sh"

-${MING_BASE}-gcc -o agent-auth.exe -Wall -UDARGV0 -DARGV0=\"agent-auth\" -D_WIN32_WINNT=0x0600 -DUSE_OPENSSL -DCLIENT -DWIN32 os_auth/main-client.c os_auth/ssl.c os_auth/check_cert.c addagent/validate.c shared/*.c os_net/*.c os_regex/*.c os_crypto/md5/*.c win_service.c -Iheaders/ -I./ -lwsock32 -lws2_32 -lssl -lcrypto

and the folling to "src/win32/win-files.txt"

-os_auth os_auth