...

...

md5sum: 56ca4ea98cfb71d6df0b377ee18b06d5

sha256sum: d37c1e71fe5ba27691b363ff275c5203a1c1917cba6d05d926058f701fe809da

Linux only release (at this stage). UPDATE - Windows was released on 2023-11-20.

The New Stuff

...

We require a minimum of version 7.4 for PHP. This is fine for the supported distributions as listed above, however, if you have installed a custom PHP it's on you to upgrade it.

This is a large upgrade. New installs will "just work", but upgraders should take the time and install it into a testing environment before migrating production instances.

Changes

system Becomes devices

...

Rules now have a regex option to match attributes.

We are incredibly proud of what we have achieved with this release, even if outwardly not a lot is visible. Image Removed

Going forward this will enable us to improve the code and add new features at a much faster pace - and we have some ideas for killer features. Stay tuned for those. Image Removed

Screenshots

Click to enlarge.

're introducing a new Collector mode - Stand-Alone. When you turn a Server into a Collector, you can choose from either a regular Collector (as it has always been) or a Stand-Alone Collector. Stand-Alone Collectors are not managed by the Server. They are essentially another Server that is completely separate but sends all found devices to the nominated Server.

We are incredibly proud of what we have achieved with this release, even if outwardly not a lot is visible. Image Added

Going forward this will enable us to improve the code and add new features at a much faster pace - and we have some ideas for killer features. Stay tuned for those. Image Added

Screenshots

Click to enlarge.

Upgrading From an Unsupported Distribution

...

On your new server, install Open-AudiT AudIT v5.0.0 as per a regular fresh install.

...

On your original Open-AudIT server, take a backup of the database. Note - you may need to substitute your MySQL root user password if it is not the default). Note #2- The log entries in the database will be deleted, remove the DELETE LOGS command from below if you really need to keep them (most users shouldn't).

mysql -u root -popenauditrootuserpassword openaudit -e "DELETE FROM oa_user_sessions; DELETE FROM logs;"
mysqldump -u root -popenauditrootuserpassword --extended-insert=FALSE --routines openaudit > /tmp/openaudit.

...

sql

On your new server, copy the database backup from the original server along with a couple of other directories. Run the below (obviously substitute the items in CAPITAL letters).

scp YOUR_USERNAME@ORIGINAL_OPEN_AUDIT_SERVER:/tmp/openaudit.sql /usr/local/open-audit/
scp YOUR_USERNAME@ORIGINAL_OPEN_AUDIT_SERVER:/var/www/html/open-audit/custom_images/* /usr/local/open-audit/public/custom_images/
scp YOUR_USERNAME@ORIGINAL_OPEN_AUDIT_SERVER:/usr/local/open-audit/code_igniter/application/attachments/* /usr/local/open-audit/app/Attachments/

If you have Baselines you wish to keep, on your new server, copy them across.

Replace $WWWGRP with www-data for Debian and Ubuntu and apache for Redhat.

sudo mkdir

mysql -u root -popenauditrootuserpassword openaudit -e "DELETE FROM oa_user_sessions; DELETE FROM logs;"
mysqldump -u root -popenauditrootuserpassword --extended-insert=FALSE --routines openaudit > /tmp/openaudit.sql

On your new server, copy the database backup from the original server along with a couple of other directories. Run the below (obviously substitute the items in CAPITAL letters).

scp YOUR_USERNAME@ORIGINAL_OPEN_AUDIT_SERVER:/tmp/openaudit.sql /usr/local/open-audit/temp_baselines_results
scp YOUR_USERNAME@ORIGINAL_OPEN_AUDIT_SERVER:/usr/local/omk/var/wwwoae/htmlbaselines/open-audit/custom_images/*results/*.json /usr/local/open-audit/public/custom_images/
scp YOUR_USERNAME@ORIGINAL_OPEN_AUDIT_SERVER:temp_baselines_results/
chmod -R 777 /usr/local/open-audit/code_igniter/application/attachments/*temp_baselines_results
chown -R $WWWGRP:$WWWGRP /usr/local/open-audit/app/Attachments/temp_baselines_results

On your new server, restore the database.

...

IE - Your file will contain this. Only copy the red text, not including the " quotes.

"Open-AudIT Enterprise" : "53616c7465645f5f3a52599dcec64e1c6db004a02d8bf07783dc8a72bd58db49b29504272a92006075b4fdeaeb7394a4529183aedc32c0212345678985ea78308010cf73a35530c597bb49df3f9bf8ffab54893251724257d1ffc8d7fee8f38f7a45637488bff6f74b2e479673e8aa187acb7ae2860f7705a7fbe4e0e636e3cf9f4f05023c519ae8d51177dcf6edb5c6d6a5508c2dc151096bfc7054ee09eae45d7e56be954a14f5ca374d330f3179256f551a1c972f18e77934aafeae0b19081d929b3fd91296c549d5723dd01b7a03cb758b228cd551f69838f63d4c9123456789bc9e81b634daf8e40d0fd4bf11da3b9794cf91450b48c8185655fd0a431fe28d9fd5d7d40c72c27a153616c7465645f5f3a525d58db49b295042...a03cb758b228cd5511da3b9794cf914500c72c27a1",

So you would copy and paste this into the Open-AudIT GUI.

53616c7465645f5f3a52599dcec64e1c6db004a02d8bf07783dc8a72bd58db49b29504272a92006075b4fdeaeb7394a4529183aedc32c0212345678985ea78308010cf73a35530c597bb49df3f9bf8ffab54893251724257d1ffc8d7fee8f38f7a45637488bff6f74b2e479673e8aa187acb7ae2860f7705a7fbe4e0e636e3cf9f4f05023c519ae8d51177dcf6edb5c6d6a5508c2dc151096bfc7054ee09eae45d7e56be954a14f5ca374d330f3179256f551a1c972f18e77934aafeae0b19081d929b3fd91296c549d5723dd01b7a03cb758b228cd551f69838f63d4c9123456789bc9e81b634daf8e40d0fd4bf11da3b9794cf91450b48c8185655fd0a431fe28d9fd5d7d40c72c27a153616c7465645f5f3a525d58db49b295042...a03cb758b228cd5511da3b9794cf914500c72c27a1

Example included response

"included":
{
    "audit_log":
    [
        {
            "debug": "",
            "device_id": "332",
            "devices.name": "heimdall",
            "id": "185",
            "ip": "127.000.000.001",
            "timestamp": "2023-06-26 13:08:23",
            "type": "audit",
            "username": "",
            "version": "4.4.2",
            "wmi_fails": ""
        },
        {
            "debug": "",
            "device_id": "332",
            "devices.name": "heimdall",
            "id": "186",
            "ip": "127.000.000.001",
            "timestamp": "2023-06-26 14:58:38",
            "type": "audit",
            "username": "",
            "version": "4.4.2",
            "wmi_fails": ""
        }
    ],
    "bios": 
    [
        {
            "asset_tag": "",
            "current": "y",
            "date": "12/12/2018",
            "device_id": "332",
            "first_seen": "2023-06-26 13:08:23",
            "id": "31",
            "last_seen": "2023-10-02 20:07:51",
            "manufacturer": "Phoenix Technologies LTD",
            "model": "Phoenix BIOS - Firmware Rev. 6.00",
            "name": "Phoenix BIOS - Firmware Rev. 6.00",
            "revision": "4.6",
            "serial": "VMware-56 4d bd 9b 23 af 49 f8-c7 b4 bc 06 39 fd 99 62",
            "smversion": "2.7",
            "version": "6.00"
        }
    ]
 } 

...