[ad_1]
在本指南中，我们将学习如何在 Rocky Linux 8 上安装 osquery。 Osquery 是一个开源工具，可以像查询关系数据库一样查询操作系统。 它利用类似 SQL 的查询来收集操作系统信息以进行性能、安全性、合规性审计分析。 它运行在多个平台上，例如 Linux、FreeBSD、MacOS、Windows 系统。
在 Rocky Linux 8 上安装 Osquery
安装 Osquery YUM 存储库
默认的 Rocky Linux 存储库不包含 osquery 包。
但是，osquery 将稳定版本发布到 YUM 存储库。
要将 osquery YUM 存储库添加到 Rocky Linux 8，请运行以下命令；
curl -L https://pkg.osquery.io/rpm/GPG | sudo tee /etc/pki/rpm-gpg/RPM-GPG-KEY-osquery
dnf config-manager --add-repo https://pkg.osquery.io/rpm/osquery-s3-rpm.repo
这将安装 Osquery yum 存储库，您可以通过运行以下命令进行确认；
dnf repolist | grep osquery
样本输出；
osquery-s3-rpm-repo name=osquery RPM repository - x86_64在 Rocky Linux 8 上安装 Osquery
一旦存储库就位，您就可以通过运行以下命令来安装 Osquery。
dnf --enablerepo osquery-s3-rpm-repo install osquery -y
osquery的组成部分
Osquery 包安装了三个基本组件；
osqueryctl– 这是一个 osquery 帮助脚本，用于测试 osquery 配置/部署以及管理 osqueryd 服务。osqueryd– 是一个 osquery 守护进程，用于调度查询和记录操作系统状态的变化。osqueryi– 是一个 osquery 交互式 shell。 在 shell 中，您可以运行各种查询来探索操作系统的状态。
为了学习上述命令的用法，您可以通过 -h/–help 选项。
osqueryctl -h
Usage: /usr/bin/osqueryctl {clean|config-check|start|stop|status|restart}
例如使用 osqueryctl 启动、停止和重启 osqueryd，运行命令；
osqueryctl start osqueryd
osqueryctl stop osqueryd
osqueryctl restart osqueryd
在 Rocky Linux 8 上运行 Osquery
可以运行 Osquery：
- 在独立模式下使用
osqueryi或者 - 作为服务使用
osqueryd
在本指南中，我们将重点介绍如何使用 osquery 交互式 shell 来查询各种系统活动。
在独立模式下运行 osquery
什么时候 osqueryi 不带任何参数运行，它会将您带到交互式 shell 提示符；
osqueryi
Using a virtual database. Need help, type '.help'
osquery>
您可以通过键入获得帮助 .help 在 shell 提示符下。 注意点 (.).
osquery> .help
Welcome to the osquery shell. Please explore your OS!
You are connected to a transient 'in-memory' virtual database.
.all [TABLE] Select all from a table
.bail ON|OFF Stop after hitting an error
.connect PATH Connect to an osquery extension socket
.disconnect Disconnect from a connected extension socket
.echo ON|OFF Turn command echo on or off
.exit Exit this program
.features List osquery's features and their statuses
.headers ON|OFF Turn display of headers on or off
.help Show this message
.mode MODE Set output mode where MODE is one of:
csv Comma-separated values
column Left-aligned columns see .width
line One value per line
list Values delimited by .separator string
pretty Pretty printed SQL results (default)
.nullvalue STR Use STRING in place of NULL values
.print STR... Print literal STRING
.quit Exit this program
.schema [TABLE] Show the CREATE statements
.separator STR Change separator used by output mode
.socket Show the local osquery extensions socket path
.show Show the current values for various settings
.summary Alias for the show meta command
.tables [TABLE] List names of tables
.types [SQL] Show result of getQueryColumns for the given query
.width [NUM1]+ Set column widths for "column" mode
.timer ON|OFF Turn the CPU timer measurement on or off
列出 Osquery 系统信息表
Osquery 将各种操作系统属性转换为类似数据库概念的表格。 因此，要列出存储各种系统信息的表，请运行 .tables 命令内 osqueryi 迅速的。
osqueryiosquery> .tables
样本输出；
=> acpi_tables => apt_sources => arp_cache => augeas => authorized_keys => block_devices => carbon_black_info => carves => chrome_extensions => cpu_time … => time => uptime => usb_devices => user_events => user_groups => user_ssh_keys => users => yara => yara_events => yum_sources osquery>
查询Osquery系统表
例如，让我们看看一些表格中包含的内容；
select * from os_version;
+-------------+------------------------------------------+-------+-------+-------+-------+----------+---------------+----------+--------+ | name | version | major | minor | patch | build | platform | platform_like | codename | arch | +-------------+------------------------------------------+-------+-------+-------+-------+----------+---------------+----------+--------+ | Rocky Linux | Rocky Linux release 8.4 (Green Obsidian) | 8 | 4 | 0 | | rhel | rhel | | x86_64 | +-------------+------------------------------------------+-------+-------+-------+-------+----------+---------------+----------+--------+
查询uid大于1000的系统用户，
select * from users where uid >=1000;
+-------+-------+------------+------------+-----------+----------------------+-----------------+---------------+------+ | uid | gid | uid_signed | gid_signed | username | description | directory | shell | uuid | +-------+-------+------------+------------+-----------+----------------------+-----------------+---------------+------+ | 65534 | 65534 | 65534 | 65534 | nobody | Kernel Overflow User | / | /sbin/nologin | | | 1000 | 1000 | 1000 | 1000 | kifarunix | | /home/kifarunix | /bin/bash | | +-------+-------+------------+------------+-----------+----------------------+-----------------+---------------+------+
列出所有登录的用户；
select user,tty,host,time from logged_in_users where tty not like '~';
+-----------+-------+--------------+------------+ | user | tty | host | time | +-----------+-------+--------------+------------+ | kifarunix | tty1 | | 1628876993 | | root | pts/0 | 192.168.60.1 | 1628875575 | +-----------+-------+--------------+------------+
检查系统正常运行时间；
select * from uptime;
+------+-------+---------+---------+---------------+ | days | hours | minutes | seconds | total_seconds | +------+-------+---------+---------+---------------+ | 0 | 4 | 21 | 49 | 4909 | +------+-------+---------+---------+---------------+
显示网络接口和 IP 地址；
select interface,address,mask from interface_addresses where interface NOT LIKE '%lo%';
+-----------+----------------------------------+-----------------------+ | interface | address | mask | +-----------+----------------------------------+-----------------------+ | enp0s3 | 10.0.2.15 | 255.255.255.0 | | enp0s8 | 192.168.60.19 | 255.255.255.0 | | enp0s3 | fe80::689b:622:1eaf:287a%enp0s3 | ffff:ffff:ffff:ffff:: | | enp0s8 | fe80::301d:abeb:ad8b:6c56%enp0s8 | ffff:ffff:ffff:ffff:: | +-----------+----------------------------------+-----------------------+
请参阅 osquery 架构页面上的 Osquery 表列。
Osquery 命令输出查看模式
osquery 命令输出查看模式可以通过运行命令来改变， .mode MODE 从内部 osqueryi shell 提示符，其中 MODE 可以是 line, csv, pretty （默认）， column, list.
例如将视图设置为线模式；
osquery> .mode line
运行查询时，输出是逐行生成的；
SELECT * FROM system_info;
hostname = rocky8.kifarunix-demo.com
uuid = 85dd4d36-5e88-864a-b6e8-1919f794534a
cpu_type = x86_64
cpu_subtype = 142
cpu_brand = Intel(R) Core(TM) i7-10510U CPU @ 1.80GHz
cpu_physical_cores = 1
cpu_logical_cores = 1
cpu_microcode =
physical_memory = 848629760
hardware_vendor = innotek GmbH
hardware_model = VirtualBox
hardware_version = 1.2
hardware_serial = 0
board_vendor = Oracle Corporation
board_model = VirtualBox
board_version = 1.2
board_serial = 0
computer_name = rocky8.kifarunix-demo.com
local_hostname = rocky8.kifarunix-demo.com
列出已安装的系统包；
select * from rpm_packages top limit 3;
name = NetworkManager
version = 1.30.0
release = 10.el8_4
source = NetworkManager-1.30.0-10.el8_4.src.rpm
size = 7215759
sha1 = f910dc05b56f78fcec2386ac164fcba0316299fa
arch = x86_64
epoch = 1
install_time = 1628844768
vendor = Rocky
package_group = System Environment/Base
name = NetworkManager-libnm
version = 1.30.0
release = 10.el8_4
source = NetworkManager-1.30.0-10.el8_4.src.rpm
size = 9262984
sha1 = 25eb93263187481d1475d2dd5b25d8639808e04a
arch = x86_64
epoch = 1
install_time = 1628844766
vendor = Rocky
package_group = Development/Libraries
name = NetworkManager-team
version = 1.30.0
release = 10.el8_4
source = NetworkManager-1.30.0-10.el8_4.src.rpm
size = 49616
sha1 = f8a8fbd59ba1a1901e27ab2833aa8705902965c6
arch = x86_64
epoch = 1
install_time = 1628844958
vendor = Rocky
package_group = System Environment/Base
Exit Osquery交互式外壳
要退出 osqueri 交互式 shell，osquery>，请使用命令 .exit 或简单地按 Control+d 键盘组合键。
osquery> .exit
将 Osquery 作为服务运行
osqueryd 是一个 osquery 守护进程，用于调度查询和记录操作系统状态的变化。 你可以使用这个守护进程来运行 Osquery 一个服务。
为此，您需要将示例 Osquery 配置复制到 /etc/osquery 目录如下；
cp /usr/share/osquery/osquery.example.conf /etc/osquery/osquery.conf
接下来，服务；
systemctl start osqueryd
检查状态；
systemctl status osqueryd
● osqueryd.service - The osquery Daemon
Loaded: loaded (/usr/lib/systemd/system/osqueryd.service; disabled; vendor preset: disabled)
Active: active (running) since Fri 2021-08-13 21:03:04 EAT; 5s ago
Process: 2244 ExecStartPre=/bin/sh -c if [ -f $LOCAL_PIDFILE ]; then mv $LOCAL_PIDFILE $PIDFILE; fi (code=exited, status=0/SUCCESS)
Process: 2241 ExecStartPre=/bin/sh -c if [ ! -f $FLAG_FILE ]; then touch $FLAG_FILE; fi (code=exited, status=0/SUCCESS)
Main PID: 2245 (osqueryd)
Tasks: 14 (limit: 4938)
Memory: 9.5M
CGroup: /system.slice/osqueryd.service
├─2245 /usr/bin/osqueryd --flagfile /etc/osquery/osquery.flags --config_path /etc/osquery/osquery.conf
└─2248 /usr/bin/osqueryd
Aug 13 21:03:04 rocky8.kifarunix-demo.com systemd[1]: Starting The osquery Daemon...
Aug 13 21:03:04 rocky8.kifarunix-demo.com systemd[1]: Started The osquery Daemon.
Aug 13 21:03:04 rocky8.kifarunix-demo.com osqueryd[2245]: osqueryd started [version=4.9.0]
Aug 13 21:03:07 rocky8.kifarunix-demo.com osqueryd[2245]: I0813 21:03:07.644742 2248 eventfactory.cpp:156] Event
好吧，这就是如何在 Rocky Linux 8 上安装 Osquery。你可以继续探索这个很棒的工具。
进一步阅读
Osquery 文档
在 Ubuntu 20.04 上安装 Redmine
在 Rocky Linux 8 上安装 Redmine
在 Rocky Linux 8 上安装 Webmin
在 Rocky Linux 8 上安装和配置 SNMP
[ad_2]