BSD Ports

security/ossec-hids-server 3.8.0 DragonFly

Security tool to monitor and check logs and intrusions - server installation

System
DragonFly
Repository
DPorts
Maintainer
[email protected] (as in FreeBSD)
License
GPLv2
Categories
security
Package size
617.5 KiB, 4807.8 KiB installed

Description

OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection System (HIDS). It has a powerful correlation and analysis engine, integrating log analysis, file integrity checking, Windows registry monitoring, centralized policy enforcement, rootkit detection, real-time alerting and active response.

In the other systems

SystemPortVersion
DragonFlysecurity/ossec-hids-server3.8.0
FreeBSDsecurity/ossec-hids-server3.8.0
HardenedBSDsecurity/ossec-hids-server3.8.0
GhostBSDsecurity/ossec-hids-server3.8.0

Install

Binary package:

pkg install ossec-hids-server

From DPorts:

cd /usr/dports/security/ossec-hids-server && make install clean

Dependencies

Run dependencies 5

Configuration

No options to configure.

Service scripts
none

Message after installing

All the files related to OSSEC have been installed in:
/usr/local/ossec-hids

You need to create main configuration file:
/usr/local/ossec-hids/etc/ossec.conf

For information on proper configuration see:
https://www.ossec.net/docs/syntax/ossec_config.html

To enable the startup script add ossec_hids_enable="YES" to /etc/rc.conf.

If you intend to use "firewall-drop" active response on this OSSEC instance
create the script:
/usr/local/ossec-hids/active-response/bin/firewall-drop.sh

You can copy or hard link (symbolic link is not supported) one of the scripts
already provided by OSSEC:
/usr/local/ossec-hids/active-response/bin/ipfilter.sh
/usr/local/ossec-hids/active-response/bin/ipfw.sh
/usr/local/ossec-hids/active-response/bin/pf.sh

For further steps see the documentation:
https://www.ossec.net/docs/syntax/head_ossec_config.active-response.html

Consider installing "security/ossec-hids-server-config" to ease
OSSEC configuration.

For additional help execute:
# /usr/local/etc/rc.d/ossec-hids help