{"id":1212,"date":"2021-01-28T22:08:52","date_gmt":"2021-01-28T22:08:52","guid":{"rendered":"https:\/\/adavault.com\/?p=1212"},"modified":"2023-01-29T17:42:20","modified_gmt":"2023-01-29T17:42:20","slug":"cardano-node-security-monitoring","status":"publish","type":"post","link":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/","title":{"rendered":"Cardano Node Security Monitoring"},"content":{"rendered":"\n<p>Modern security practices require a balanced focus between prevention, detection and response capabilities.<\/p>\n\n\n\n<p>Implementing Cardano Node on Linux gives a secure base to start, with some basic things that should be in place to lock down access for relays and block producing nodes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set a strong password for user accounts.<\/li>\n\n\n\n<li>Only allow SSH authentication by certificates ( <code>sudo nano \/etc\/ssh\/sshd_config<\/code> and set <code>PasswordAuthentication no<\/code>).<\/li>\n\n\n\n<li>Only run services that you need on the server. Disable anything that is not required.<\/li>\n\n\n\n<li>Segregate services behind host based or network firewalls (preferably both), only allow stateful inbound SSH connections from trusted hosts, inbound connection to relay nodes on the defined port, and only allow inbound connection to BPN from specific relay nodes (outbound is needed from relays).<\/li>\n\n\n\n<li>Set appropriate permissions for files (e.g. <code>\/opt\/cardano\/cnode<\/code> if you are using <a href=\"https:\/\/cardano-community.github.io\/guild-operators\/\">cnTools<\/a>, which will also set the correct permissions for you).<\/li>\n\n\n\n<li>Lastly, keep the base operating systems patched (e.g. <code>sudo apt update<\/code>\/<code>upgrade<\/code>) and scan for vulnerabilities (e.g. Nessus).<\/li>\n<\/ul>\n\n\n\n<p>But even the best security defences can be breached. And this is where detection and response becomes important. While there are a lot of security products that you can buy in the market to help with detection, there are also some good open source options. One of those is <a href=\"https:\/\/github.com\/ossec\/ossec-hids\/releases\">OSSEC<\/a>.<\/p>\n\n\n\n<p>OSSEC provides a Host Based Intrusion Detection (HIDS) solution for Linux, Mac and Windows which is agent based and reports back to a server. It&#8217;s a lightweight solution, with a range of detection rules, and is actively developed.<\/p>\n\n\n\n<p>One of the negatives is that it doesn&#8217;t have a nice GUI, but by adding Prometheus and Grafana we can fix that. We can also tune the detection rules to monitor specific Cardano node directories.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"building-cnhids-in-homage-to-cntools\">Building cnhids (in homage to cntools)<\/h3>\n\n\n\n<p>Installing cnhids is now as simple as running the script after downloading from <a href=\"https:\/\/github.com\/adavault\/cnhids\">GitHub<\/a>:<\/p>\n\n\n\n<p><a href=\"https:\/\/github.com\/adavault\/cnhids\">https:\/\/github.com\/adavault\/cnhids<\/a><\/p>\n\n\n\n<p>We do not recommend using the manual process and it will no longer be maintained (as the install script self documents).<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"manual-build-process\">Manual build process<\/h4>\n\n\n\n<p>There are quite a few steps to this so it&#8217;s worth sumarising what you are going to do:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Setup the OSSEC server on a separate 20.04 LTS instance.<\/li>\n\n\n\n<li>Configure promtail, loki to scrape logs from OSSEC<\/li>\n\n\n\n<li>Setup Prometheus and Grafana to collect the data and display on our cnHids dashboard<\/li>\n\n\n\n<li>Setup a custom metrics service to scrape info on total agents and active agents<\/li>\n\n\n\n<li>Configure the OSSEC agents and connect them to the OSSEC server.<\/li>\n<\/ul>\n\n\n\n<p>Software components:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ubuntu Server 20.04LTS.<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/ossec\/ossec-hids\/releases\">OSSEC<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/grafana\/loki\/releases\">Loki and Promtail<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/prometheus\/prometheus\">Prometheus<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/grafana\/grafana\">Grafana<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/slim-bean\/ossec-metrics\/\">Custom scraper<\/a><\/li>\n<\/ul>\n\n\n\n<p>Improvement areas:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Packages are running from \/var and \/opt which is good, but this installation process could be more scripted, (we figured if there is enough interest we will check with GuildOps to see if they want to include as an install script there). However it&#8217;s perfectly usable and secure as is.<\/li>\n\n\n\n<li>At the moment there is no alerting, but this could be added to prometheus.<\/li>\n<\/ul>\n\n\n\n<p>Allow a couple of hours to build and configure this for your environment.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"pre-requisites\">Pre-requisites<\/h4>\n\n\n\n<p>We recommend running this on a separate server instance (1CPU core, 2GB RAM, 50-100GB disk), ideally in a separate firewall zone (The OSSEC manager listens on UDP port 1514, so you will need to allow UDP 1514 inbound so the agents can connect to the server). This server will also run the Prometheus and Grafana instances and the log collectors\/scrapers. These should all be bound to localhost expect for Grafana (0.0.0.0) as you will want to be able to connect to that remotely on the port configured (3000 by default).<\/p>\n\n\n\n<p>Assuming a fresh install of 20.04 on a server with an FQDN <code>cnhids-server<\/code> we create a user <code>cnhids<\/code> and directory structure as follows:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#Create a user and add them to sudoers\nsudo adduser cnhids\nsudo usermod -aG sudo cnhids\n\n#Log off then log back on as cnhids (while you are at it why not copy over ssh keys)\nexit\nssh-copy-id cnhids@cnhids-server\nssh cnhids@cnhids-server\n\n#Create directory structure (aligned with cnTools)\nsudo mkdir -p \/opt\/cardano\/cnhids\n#Change owner and group to cnhids\nsudo chown cnhids \/opt\/cardano\/cnhids\nsudo chgrp cnhids \/opt\/cardano\/cnhids\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"install-ossec-server\">Install OSSEC Server<\/h4>\n\n\n\n<p>Next we set up the basic OSSEC server install:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd ~\nsudo apt update\nsudo apt upgrade\nsudo apt install gcc make libevent-dev zlib1g-dev libssl-dev libpcre2-dev wget tar unzip -y\nwget https:\/\/github.com\/ossec\/ossec-hids\/archive\/3.6.0.tar.gz\ntar xzf 3.6.0.tar.gz\ncd ossec-hids-3.6.0\/\nsudo .\/install.sh\n#Follow the prompts to install server version of OSSEC\n(en\/br\/cn\/de\/el\/es\/fr\/hu\/it\/jp\/nl\/pl\/ru\/sr\/tr) &#91;en]: \n...<\/code><\/pre>\n\n\n\n<p>Now edit the default ossec.conf to add json output.:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/var\/ossec\/etc\/ossec.conf<\/code><\/pre>\n\n\n\n<p>In this case we have removed the email notification but you could choose to keep that. The &lt;global&gt; section needs to look like this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  &lt;global&gt;\n    &lt;email_notification&gt;no&lt;\/email_notification&gt;\n    &lt;jsonout_output&gt;yes&lt;\/jsonout_output&gt;\n  &lt;\/global&gt;<\/code><\/pre>\n\n\n\n<p>Save and exit, then restart the OSSEC server:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo \/var\/ossec\/bin\/ossec-control restart<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"setup-promtail-and-loki\">Setup Promtail and Loki<\/h4>\n\n\n\n<p>Now you have the basic OSSEC server in place it&#8217;s time to collect data from the logs for Prometheus to store. Let&#8217;s install Promtail first:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/opt\/cardano\/cnhids\nmkdir promtail\ncd promtail\/\nwget https:\/\/github.com\/grafana\/loki\/releases\/download\/v2.1.0\/promtail-linux-amd64.zip\nunzip promtail-linux-amd64.zip\nchmod +x promtail-linux-amd64<\/code><\/pre>\n\n\n\n<p>Create the yaml:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nano promtail.yaml<\/code><\/pre>\n\n\n\n<p>&#8230;paste in this config (change your timezone location as needed) and save:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>server:\n  http_listen_port: 8080\n  grpc_listen_port: 0\n\npositions:\n  filename: \/var\/ossec\/logs\/alerts\/promtail_positions.yaml\n\nclients:\n  - url: http:\/\/localhost:3100\/api\/prom\/push\n\nscrape_configs:\n- job_name: ossec_alerts\n  pipeline_stages:\n  - json:\n      expressions:\n        # Extract the timestamp, level, group, and host from the JSON into the extracted map\n        timestamp: TimeStamp\n        level: rule.level\n        group: rule.group\n        host: hostname\n        application: program_name\n        srcuser: srcuser\n        dstuser: dstuser\n  - regex:\n      # The host is wrapped in parens, extract just the string and essentially strip the parens\n      source: host\n      expression: '^\\((?P&lt;host&gt;\\S+)\\)'\n  - template:\n      # Pad the level with leading zeros so that grafana will sort the levels in increasing order\n      source: level\n      template: '{{ printf \"%02s\" .Value }}'\n  - labels:\n      # Set labels for level, group, and host\n      level: ''\n      group: ''\n      host: ''\n      application: ''\n      srcuser: ''\n      dstuser: ''\n  - timestamp:\n      # Set the timestamp\n      source: timestamp\n      format: UnixMs\n  - metrics:\n      # Export a metric of alerts, it will use the labels set above\n      ossec_alerts_total:\n        type: Counter\n        description: count of alerts\n        source: level\n        config:\n          action: inc\n  static_configs:\n  - targets:\n      - localhost\n    labels:\n      job: ossec\n      type: alert\n      __path__: \/var\/ossec\/logs\/alerts\/alerts.json\n- job_name: ossec_firewall\n  pipeline_stages:\n  - regex:\n      # The firewall log is not JSON, this regex will match all the parts and extract the groups into extracted data\n      expression: '(?P&lt;timestamp&gt;\\d{4} \\w{3} \\d{2} \\d{2}:\\d{2}:\\d{2}) (?P&lt;host&gt;\\S+) {0,1}\\S{0,} (?P&lt;action&gt;\\w+) (?P&lt;protocol&gt;\\w+) (?P&lt;src&gt;&#91;\\d.:]+)-&gt;(?P&lt;dest&gt;&#91;\\d.:]+)'\n  - regex:\n      # This will match host entries that are wrapped in parens and strip the parens\n      source: host\n      expression: '^\\((?P&lt;host&gt;\\S+)\\)'\n  - regex:\n      # Some hosts are in the format `ossec -&gt; ...` this will match those and only return the host name\n      source: host\n      expression: '^(?P&lt;host&gt;\\S+)-&gt;'\n  - template:\n      # Force the action (DROP or ALLOW) to lowercase\n      source: action\n      template: '{{ .Value | ToLower }}'\n  - template:\n      # Force the protocol to lowercase\n      source: protocol\n      template: '{{ .Value | ToLower }}'\n  - labels:\n      # Set labels for action, protocol, and host\n      action: ''\n      protocol: ''\n      host: ''\n  - timestamp:\n      # Set the timestamp, we have to force the timezone because it doesn't exist in the log timestamp, update this for your servers timezone\n      source: timestamp\n      format: '2006 Jan 02 15:04:05'\n      location: 'Europe\/London'\n - metrics:\n      # Export a metric of firewall events, it will use the labels set above\n      ossec_firewall_total:\n        type: Counter\n        description: count of firewall events\n        source: action\n        config:\n          action: inc\n  static_configs:\n  - targets:\n      - localhost\n    labels:\n      job: ossec\n      type: firewall\n      __path__: \/var\/ossec\/logs\/firewall\/firewall.log<\/code><\/pre>\n\n\n\n<p>Next register as a service (create the systemd service definition):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nano promtail.service<\/code><\/pre>\n\n\n\n<p>&#8230;then paste the following into the file and save it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;Unit]\nDescription=Promtail Loki Agent\nAfter=loki.service\n\n&#91;Service]\nType=simple\nUser=root\nExecStart=\/opt\/cardano\/cnhids\/promtail\/promtail-linux-amd64 -config.file promtail.yaml\nWorkingDirectory=\/opt\/cardano\/cnhids\/promtail\/\nRestart=always\nRestartSec=10\n\n&#91;Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\n<p>Now copy it across to systemd:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp promtail.service \/etc\/systemd\/system\/promtail.service<\/code><\/pre>\n\n\n\n<p>The Loki setup follows a similar process:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/opt\/cardano\/cnhids\nmkdir loki\ncd loki\nmkdir chunks\nmkdir index\nwget https:\/\/github.com\/grafana\/loki\/releases\/download\/v2.1.0\/loki-linux-amd64.zip\nunzip loki-linux-amd64.zip\nchmod +x loki-linux-amd64<\/code><\/pre>\n\n\n\n<p>Create the yaml:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nano loki-config.yaml<\/code><\/pre>\n\n\n\n<p>&#8230;and paste this config into it, then save. You can increase the retention period but will need choose certain multiples of the schema period, these are set to give you about a months retention.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auth_enabled: false\n\nserver:\n  http_listen_port: 3100\n\ningester:\n  lifecycler:\n    address: 127.0.0.1\n    ring:\n      kvstore:\n        store: inmemory\n      replication_factor: 1\n    final_sleep: 0s\n  chunk_idle_period: 1m\n  chunk_retain_period: 30s\n\nschema_config:\n  configs:\n  - from: 2018-04-15\n    store: boltdb\n    object_store: filesystem\n    schema: v9\n    index:\n      prefix: index_\n      period: 192h\n\nstorage_config:\n  boltdb:\n    directory: \/opt\/cardano\/cnhids\/loki\/index\n\n  filesystem:\n    directory: \/opt\/cardano\/cnhids\/loki\/chunks\n\nlimits_config:\n  enforce_metric_name: false\n  reject_old_samples: true\n  reject_old_samples_max_age: 192h\n\nchunk_store_config:\n  max_look_back_period: 0\n\ntable_manager:\n  chunk_tables_provisioning:\n    inactive_read_throughput: 0\n    inactive_write_throughput: 0\n    provisioned_read_throughput: 0\n    provisioned_write_throughput: 0\n  index_tables_provisioning:\n    inactive_read_throughput: 0\n    inactive_write_throughput: 0\n    provisioned_read_throughput: 0\n    provisioned_write_throughput: 0\n  retention_deletes_enabled: true\n  retention_period: 768h<\/code><\/pre>\n\n\n\n<p>Next we register as a service, create the service definition:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nano loki.service<\/code><\/pre>\n\n\n\n<p>&#8230;then paste the following into the file and save it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;Unit]\nDescription=Loki Log Aggregator\nAfter=network.target\n\n&#91;Service]\nType=simple\nUser=cnhids\nExecStart=\/opt\/cardano\/cnhids\/loki\/loki-linux-amd64 -config.file loki-config.yaml\nWorkingDirectory=\/opt\/cardano\/cnhids\/loki\/\nRestart=always\nRestartSec=10\n\n&#91;Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\n<p>Lastly copy the service across to systemd:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp loki.service \/etc\/systemd\/system\/loki.service<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"install-prometheus\">Install Prometheus<\/h4>\n\n\n\n<p>The prometheus install is pretty standard, we can use the latest version from the repo:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/opt\/cardano\/cnhids\nwget https:\/\/github.com\/prometheus\/prometheus\/releases\/download\/v2.24.1\/prometheus-2.24.1.linux-amd64.tar.gz\ntar -zxvf prometheus-2.24.1.linux-amd64.tar.gz<\/code><\/pre>\n\n\n\n<p>Edit the .yaml, we just need to add some scrape configs at the end, otherwise it&#8217;s as default<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd prometheus-2.24.1.linux-amd64\/\nnano prometheus.yml<\/code><\/pre>\n\n\n\n<p>And edit so it looks like this (the only bit to change is adding the scrapes at the end):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># my global config\nglobal:\n  scrape_interval:     15s # Set the scrape interval to every 15 seconds. Default is every 1 minute.\n  evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute.\n  # scrape_timeout is set to the global default (10s).\n\n# Alertmanager configuration\nalerting:\n  alertmanagers:\n  - static_configs:\n    - targets:\n      # - alertmanager:9093\n\n# Load rules once and periodically evaluate them according to the global 'evaluation_interval'.\nrule_files:\n  # - \"first_rules.yml\"\n  # - \"second_rules.yml\"\n\n# A scrape configuration containing exactly one endpoint to scrape:\n# Here it's Prometheus itself.\nscrape_configs:\n  # The job name is added as a label `job=&lt;job_name&gt;` to any timeseries scraped from this config.\n  - job_name: 'prometheus'\n\n    # metrics_path defaults to '\/metrics'\n    # scheme defaults to 'http'.\n\n    static_configs:\n    - targets: &#91;'localhost:9090']\n  - job_name: 'ossec'\n    static_configs:\n    - targets: &#91;'localhost:8080']\n  - job_name: 'ossec-metrics'\n    static_configs:\n    - targets: &#91;'localhost:7070']\n  - job_name: 'loki'\n    static_configs:\n    - targets: &#91;'localhost:3100']<\/code><\/pre>\n\n\n\n<p>Create the service definition:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nano prometheus.service<\/code><\/pre>\n\n\n\n<p>&#8230;and paste in this content then save:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;Unit]\nDescription=Prometheus Metrics\nAfter=network.target\n\n&#91;Service]\nType=simple\nUser=cnhids\nExecStart=\/opt\/cardano\/cnhids\/prometheus-2.24.1.linux-amd64\/prometheus --storage.tsdb.retention.time=30d\nWorkingDirectory=\/opt\/cardano\/cnhids\/prometheus-2.24.1.linux-amd64\/\nRestart=always\nRestartSec=10\n\n&#91;Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\n<p>Lastly copy across to systemd:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp prometheus.service \/etc\/systemd\/system\/prometheus.service<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"setup-grafana\">Setup Grafana<\/h4>\n\n\n\n<p>It&#8217;s a vanilla install for Grafana:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/opt\/cardano\/cnhids\nwget https:\/\/dl.grafana.com\/oss\/release\/grafana-7.3.7.linux-amd64.tar.gz\ntar -zxvf grafana-7.3.7.linux-amd64.tar.gz<\/code><\/pre>\n\n\n\n<p>Create the service definition:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd grafana-7.3.7\nnano grafana.service<\/code><\/pre>\n\n\n\n<p>&#8230;and paste this in then save:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;Unit]\nDescription=Grafana UI\nAfter=network.target\n\n&#91;Service]\nType=simple\nUser=cnhids\nExecStart=\/opt\/cardano\/cnhids\/grafana-7.3.7\/bin\/grafana-server\nWorkingDirectory=\/opt\/cardano\/cnhids\/grafana-7.3.7\/\nRestart=always\nRestartSec=10\n\n&#91;Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\n<p>..and copy across to systemd:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp grafana.service \/etc\/systemd\/system\/grafana.service<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"setup-up-the-custom-ossec-metrics-scrapper\">Setup up the custom OSSEC-metrics scrapper<\/h4>\n\n\n\n<p>There&#8217;s no easy way to scrape the agents information by tailing the OSSEC logs but fortunately Ed Welch has built a simple app called&nbsp;<a href=\"https:\/\/github.com\/slim-bean\/ossec-metrics\">ossec-metrics<\/a> to execute some OSSEC commands and parse the output. <\/p>\n\n\n\n<p>The setup is a little more involved as we need to compile it using go-lang.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/opt\/cardano\/cnhids\nsudo apt install golang-go\nmkdir ossec-metrics\ncd ossec-metrics\/\nwget https:\/\/github.com\/slim-bean\/ossec-metrics\/archive\/v0.1.0.tar.gz\ntar -zxvf v0.1.0.tar.gz\ncd ossec-metrics-0.1.0\/\ngo build -o ossec-metrics cmd\/ossec-metrics\/main.go\nmv ossec-metrics ..\/\ncd ..\nchmod +x ossec-metrics<\/code><\/pre>\n\n\n\n<p>Now create the service definition as usual<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nano ossec-metrics.service<\/code><\/pre>\n\n\n\n<p>&#8230;and paste in and save:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;Unit]\nDescription=Ossec Metrics exposes OSSEC info for prometheus to scrape\nAfter=network.target\n\n&#91;Service]\nType=simple\nUser=root\nExecStart=\/opt\/cardano\/cnhids\/ossec-metrics\/ossec-metrics\nWorkingDirectory=\/opt\/cardano\/cnhids\/ossec-metrics\/\nRestart=always\nRestartSec=10\n\n&#91;Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\n<p>Copy across to systemd:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp ossec-metrics.service \/etc\/systemd\/system\/ossec-metrics.service<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"final-configurations\">Final configurations<\/h4>\n\n\n\n<p>Let&#8217;s test the services one by, for each service you should get a clean start and no errors. If you do go back and check that service:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl daemon-reload\nsudo systemctl start prometheus.service\nsudo systemctl status prometheus.service\nsudo systemctl start loki\nsudo systemctl status loki\nsudo systemctl start promtail\nsudo systemctl status promtail.service\nsudo systemctl start ossec-metrics.service\nsudo systemctl status ossec-metrics.service\nsudo systemctl start grafana.service\nsudo systemctl status grafana.service<\/code><\/pre>\n\n\n\n<p>Assuming they all started successfully then set them to start at boot:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl enable prometheus.service\nsudo systemctl enable loki.service\nsudo systemctl enable promtail.service\nsudo systemctl enable ossec-metrics.service\nsudo systemctl enable grafana.service<\/code><\/pre>\n\n\n\n<p>Almost done, time to get a cup of tea and take a break&#8230;.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"dashboards\">Dashboards<\/h4>\n\n\n\n<p>The last step of this section is to log-on to Grafana and add the dashboard. Open your browser and navigate to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;cnhids-server:3000<\/code><\/pre>\n\n\n\n<p>The default user is admin and empty password, Grafana will ask you to set a password. Once you have logged into Grafana add two new datasources. First a&nbsp;Prometheus&nbsp;datasource:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"605\" height=\"1024\" data-src=\"https:\/\/adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.57-605x1024.png\" alt=\"\" class=\"wp-image-1236 lazyload\" data-srcset=\"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.57-605x1024.png 605w, https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.57-177x300.png 177w, https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.57-768x1299.png 768w, https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.57-908x1536.png 908w, https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.57-1211x2048.png 1211w, https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.57-1200x2030.png 1200w, https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.57.png 1310w\" data-sizes=\"(max-width: 605px) 100vw, 605px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 605px; --smush-placeholder-aspect-ratio: 605\/1024;\" \/><\/figure>\n\n\n\n<p>Then a&nbsp;Loki&nbsp;datasource:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"665\" height=\"1024\" data-src=\"https:\/\/adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.34-1-665x1024.png\" alt=\"\" class=\"wp-image-1238 lazyload\" data-srcset=\"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.34-1-665x1024.png 665w, https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.34-1-195x300.png 195w, https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.34-1-768x1183.png 768w, https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.34-1-997x1536.png 997w, https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.34-1-1200x1849.png 1200w, https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.10.34-1.png 1294w\" data-sizes=\"(max-width: 665px) 100vw, 665px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 665px; --smush-placeholder-aspect-ratio: 665\/1024;\" \/><\/figure>\n\n\n\n<p>Now you can import the dashboard by hovering over the + symbol on the left panel and selecting import then pasting in <a href=\"https:\/\/github.com\/cyber-russ\/cnhids\/blob\/main\/grafana-dashboard.json\">this json<\/a><a href=\"https:\/\/github.com\/adavault\/cnhids\/blob\/main\/grafana-dashboard.json\"> <\/a><a href=\"https:\/\/github.com\/cyber-russ\/cnhids\/blob\/main\/grafana-dashboard.json\">file<\/a>.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" width=\"310\" height=\"396\" data-src=\"https:\/\/adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-21.43.48-e1611870318842.png\" alt=\"\" class=\"wp-image-1240 lazyload\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 310px; --smush-placeholder-aspect-ratio: 310\/396;\" \/><\/figure>\n<\/div>\n\n\n<p>And you should have a dashboard with some content populating from the OSSEC server. At the moment you only have one agent reporting which is on the OSSEC server itself. So the last  steps are to add agents on the servers you want to monitor and then connect them to the OSSEC server.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"add-some-agents\">Add some agents<\/h3>\n\n\n\n<p>SSH to the server you want to add the agent to then:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd ~\nsudo apt install gcc make libevent-dev zlib1g-dev libssl-dev libpcre2-dev wget tar -y\nwget https:\/\/github.com\/ossec\/ossec-hids\/archive\/3.6.0.tar.gz\ntar xzf 3.6.0.tar.gz\ncd ossec-hids-3.6.0\/\nsudo .\/install.sh<\/code><\/pre>\n\n\n\n<p>Follow the prompts:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(en\/br\/cn\/de\/el\/es\/fr\/hu\/it\/jp\/nl\/pl\/ru\/sr\/tr) &#91;en]: en\n1- What kind of installation do you want (server, agent, local, hybrid or help)? agent\n2- Choose where to install the OSSEC HIDS &#91;\/var\/ossec]: \/var\/ossec\n3.1- What's the IP Address or hostname of the OSSEC HIDS server?: cnhids-server\n3.2- Do you want to run the integrity check daemon? (y\/n) &#91;y]: y\n3.3- Do you want to run the rootkit detection engine? (y\/n) &#91;y]: y\n3.4 - Do you want to enable active response? (y\/n) &#91;y]: n<\/code><\/pre>\n\n\n\n<p>At this time we don&#8217;t suggest enabling active response as you don&#8217;t want to inadvertently stop your node from producing a block at a critical time if the network host gets blocked. If use becomes more widespread and we get confident this is safe then this may change.<\/p>\n\n\n\n<p>Make a note of the client ip (<code>ip a<\/code>) then SSH to the OSSEC server and register the agent:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo \/var\/ossec\/bin\/manage_agents\n\n****************************************\n* OSSEC HIDS v3.6.0 Agent manager.     *\n* The following options are available: *\n****************************************\n   (A)dd an agent (A).\n   (E)xtract key for an agent (E).\n   (L)ist already added agents (L).\n   (R)emove an agent (R).\n   (Q)uit.\nChoose your action: A,E,L,R or Q: a\n\n- Adding a new agent (use '\\q' to return to the main menu).\n  Please provide the following:\n   * A name for the new agent: agent-name\n   * The IP Address of the new agent: 192.168.1.2\n   * An ID for the new agent&#91;001]:\nAgent information:\n   ID:001\n   Name:agent-name\n   IP Address:192.168.1.2\n\nConfirm adding it?(y\/n): y\nAgent added with ID 001.\n<\/code><\/pre>\n\n\n\n<p>Extract the key with &#8216;e&#8217;, and copy this, run the same process on the agent:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo \/var\/ossec\/bin\/manage_agents\n#And follow the prompts to paste the key in and register the agent<\/code><\/pre>\n\n\n\n<p>If you are monitoring a cardano node then open the ossec.conf files and add cnode dirs (the paths are set assuming you are using using cnTools):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/var\/ossec\/etc\/ossec.conf<\/code><\/pre>\n\n\n\n<p>Add the following lines to the file below the existing directory lines&#8230;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;directories check_all=\"yes\"&gt;\/opt\/cardano\/cnode\/priv,\/opt\/cardano\/cnode\/files,\/opt\/cardano\/cnode\/scripts&lt;\/directories&gt;\n&lt;directories check_all=\"yes\"&gt;\/home\/cardano\/.cabal\/bin&lt;\/directories&gt;<\/code><\/pre>\n\n\n\n<p>Lastly restart the agent (if it&#8217;s the first agent you&#8217;ve added you will need to restart the OSSEC server as well with this command):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo \/var\/ossec\/bin\/ossec-control restart<\/code><\/pre>\n\n\n\n<p>You should see the agent appear on the dashboard within a couple of minutes, it will spend a little while setting scanning the server before it reports in to the OSSEC server. If its not there after 10 minutes check firewall ports aren&#8217;t blocking traffic.<\/p>\n\n\n\n<p>Repeat for each server you want to monitor.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"thanks-go-to\">Thanks go to&#8230;.<\/h4>\n\n\n\n<p>This guide was inspired by:<\/p>\n\n\n\n<p><a href=\"https:\/\/grafana.com\/blog\/2019\/08\/22\/homelab-security-with-ossec-loki-prometheus-and-grafana-on-a-raspberry-pi\/\">https:\/\/grafana.com\/blog\/2019\/08\/22\/homelab-security-with-ossec-loki-prometheus-and-grafana-on-a-raspberry-pi\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Modern security practices require a balanced focus between prevention, detection and response capabilities. Implementing Cardano Node on Linux gives a secure base to start, with some basic things that should be in place to lock down access for relays and block producing nodes: But even the best security defences can be breached. And this is&hellip;<\/p>\n","protected":false},"author":1,"featured_media":1213,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[75],"tags":[61,123,127,125,126,124],"class_list":["post-1212","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cardano-community","tag-cardano-node","tag-cnhids","tag-grafana-dashboard","tag-host-based-intrusion-detection","tag-ossec","tag-security-monitoring"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.6 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Cardano Node Security Monitoring - ADAvault<\/title>\n<meta name=\"description\" content=\"The ADAvault blog\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cardano Node Security Monitoring - ADAvault\" \/>\n<meta property=\"og:description\" content=\"The ADAvault blog\" \/>\n<meta property=\"og:url\" content=\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/\" \/>\n<meta property=\"og:site_name\" content=\"ADAvault\" \/>\n<meta property=\"article:published_time\" content=\"2021-01-28T22:08:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-01-29T17:42:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-08.44.34.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1293\" \/>\n\t<meta property=\"og:image:height\" content=\"718\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"webmaster\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@adavaultops\" \/>\n<meta name=\"twitter:site\" content=\"@adavaultops\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"webmaster\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/\"},\"author\":{\"name\":\"webmaster\",\"@id\":\"https:\/\/dev.adavault.com\/#\/schema\/person\/49b7a35bfadc7aa22c3643a455a1f179\"},\"headline\":\"Cardano Node Security Monitoring\",\"datePublished\":\"2021-01-28T22:08:52+00:00\",\"dateModified\":\"2023-01-29T17:42:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/\"},\"wordCount\":1399,\"publisher\":{\"@id\":\"https:\/\/dev.adavault.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-08.44.34.png\",\"keywords\":[\"Cardano Node\",\"cnhids\",\"grafana dashboard\",\"host based intrusion detection\",\"ossec\",\"security monitoring\"],\"articleSection\":[\"Cardano Community\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/\",\"url\":\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/\",\"name\":\"Cardano Node Security Monitoring - ADAvault\",\"isPartOf\":{\"@id\":\"https:\/\/dev.adavault.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-08.44.34.png\",\"datePublished\":\"2021-01-28T22:08:52+00:00\",\"dateModified\":\"2023-01-29T17:42:20+00:00\",\"description\":\"The ADAvault blog\",\"breadcrumb\":{\"@id\":\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#primaryimage\",\"url\":\"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-08.44.34.png\",\"contentUrl\":\"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-08.44.34.png\",\"width\":1293,\"height\":718},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/dev.adavault.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cardano Node Security Monitoring\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/dev.adavault.com\/#website\",\"url\":\"https:\/\/dev.adavault.com\/\",\"name\":\"ADAvault\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/dev.adavault.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/dev.adavault.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/dev.adavault.com\/#organization\",\"name\":\"ADAvault.com\",\"url\":\"https:\/\/dev.adavault.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/dev.adavault.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/dev.adavault.com\/wp-content\/uploads\/2020\/10\/cropped-logo-wp-top-2.png\",\"contentUrl\":\"https:\/\/dev.adavault.com\/wp-content\/uploads\/2020\/10\/cropped-logo-wp-top-2.png\",\"width\":512,\"height\":512,\"caption\":\"ADAvault.com\"},\"image\":{\"@id\":\"https:\/\/dev.adavault.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/adavaultops\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/dev.adavault.com\/#\/schema\/person\/49b7a35bfadc7aa22c3643a455a1f179\",\"name\":\"webmaster\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/dev.adavault.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/cab5b4ef880b9b0561c19eeea56044b2fad250d084091ecd4feb7e8faf92d61f?s=96&d=retro&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/cab5b4ef880b9b0561c19eeea56044b2fad250d084091ecd4feb7e8faf92d61f?s=96&d=retro&r=g\",\"caption\":\"webmaster\"},\"sameAs\":[\"https:\/\/adavault.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cardano Node Security Monitoring - ADAvault","description":"The ADAvault blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/","og_locale":"en_GB","og_type":"article","og_title":"Cardano Node Security Monitoring - ADAvault","og_description":"The ADAvault blog","og_url":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/","og_site_name":"ADAvault","article_published_time":"2021-01-28T22:08:52+00:00","article_modified_time":"2023-01-29T17:42:20+00:00","og_image":[{"width":1293,"height":718,"url":"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-08.44.34.png","type":"image\/png"}],"author":"webmaster","twitter_card":"summary_large_image","twitter_creator":"@adavaultops","twitter_site":"@adavaultops","twitter_misc":{"Written by":"webmaster","Estimated reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#article","isPartOf":{"@id":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/"},"author":{"name":"webmaster","@id":"https:\/\/dev.adavault.com\/#\/schema\/person\/49b7a35bfadc7aa22c3643a455a1f179"},"headline":"Cardano Node Security Monitoring","datePublished":"2021-01-28T22:08:52+00:00","dateModified":"2023-01-29T17:42:20+00:00","mainEntityOfPage":{"@id":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/"},"wordCount":1399,"publisher":{"@id":"https:\/\/dev.adavault.com\/#organization"},"image":{"@id":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#primaryimage"},"thumbnailUrl":"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-08.44.34.png","keywords":["Cardano Node","cnhids","grafana dashboard","host based intrusion detection","ossec","security monitoring"],"articleSection":["Cardano Community"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/","url":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/","name":"Cardano Node Security Monitoring - ADAvault","isPartOf":{"@id":"https:\/\/dev.adavault.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#primaryimage"},"image":{"@id":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#primaryimage"},"thumbnailUrl":"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-08.44.34.png","datePublished":"2021-01-28T22:08:52+00:00","dateModified":"2023-01-29T17:42:20+00:00","description":"The ADAvault blog","breadcrumb":{"@id":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#primaryimage","url":"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-08.44.34.png","contentUrl":"https:\/\/dev.adavault.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-28-at-08.44.34.png","width":1293,"height":718},{"@type":"BreadcrumbList","@id":"https:\/\/dev.adavault.com\/index.php\/2021\/01\/28\/cardano-node-security-monitoring\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/dev.adavault.com\/"},{"@type":"ListItem","position":2,"name":"Cardano Node Security Monitoring"}]},{"@type":"WebSite","@id":"https:\/\/dev.adavault.com\/#website","url":"https:\/\/dev.adavault.com\/","name":"ADAvault","description":"","publisher":{"@id":"https:\/\/dev.adavault.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/dev.adavault.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/dev.adavault.com\/#organization","name":"ADAvault.com","url":"https:\/\/dev.adavault.com\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/dev.adavault.com\/#\/schema\/logo\/image\/","url":"https:\/\/dev.adavault.com\/wp-content\/uploads\/2020\/10\/cropped-logo-wp-top-2.png","contentUrl":"https:\/\/dev.adavault.com\/wp-content\/uploads\/2020\/10\/cropped-logo-wp-top-2.png","width":512,"height":512,"caption":"ADAvault.com"},"image":{"@id":"https:\/\/dev.adavault.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/adavaultops"]},{"@type":"Person","@id":"https:\/\/dev.adavault.com\/#\/schema\/person\/49b7a35bfadc7aa22c3643a455a1f179","name":"webmaster","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/dev.adavault.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/cab5b4ef880b9b0561c19eeea56044b2fad250d084091ecd4feb7e8faf92d61f?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/cab5b4ef880b9b0561c19eeea56044b2fad250d084091ecd4feb7e8faf92d61f?s=96&d=retro&r=g","caption":"webmaster"},"sameAs":["https:\/\/adavault.com"]}]}},"_links":{"self":[{"href":"https:\/\/dev.adavault.com\/index.php\/wp-json\/wp\/v2\/posts\/1212","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.adavault.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.adavault.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.adavault.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.adavault.com\/index.php\/wp-json\/wp\/v2\/comments?post=1212"}],"version-history":[{"count":59,"href":"https:\/\/dev.adavault.com\/index.php\/wp-json\/wp\/v2\/posts\/1212\/revisions"}],"predecessor-version":[{"id":3923,"href":"https:\/\/dev.adavault.com\/index.php\/wp-json\/wp\/v2\/posts\/1212\/revisions\/3923"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dev.adavault.com\/index.php\/wp-json\/wp\/v2\/media\/1213"}],"wp:attachment":[{"href":"https:\/\/dev.adavault.com\/index.php\/wp-json\/wp\/v2\/media?parent=1212"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.adavault.com\/index.php\/wp-json\/wp\/v2\/categories?post=1212"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.adavault.com\/index.php\/wp-json\/wp\/v2\/tags?post=1212"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}