Security tool to monitor and check logs and intrusions - local (standalone) installation
# pkg install ossec-hids-localinstalls 3.8.0 from latest; from quarterly (2026Q4) 3.8.0# cd /usr/ports/security/ossec-hids-local && make install clean# make -C /usr/ports/security/ossec-hids-local config # change options first
ossec, ossecm, ossecr, group ossecAll the files related to OSSEC have been installed in: /usr/local/ossec-hids You need to create main configuration file: /usr/local/ossec-hids/etc/ossec.conf For information on proper configuration see: https://www.ossec.net/docs/syntax/ossec_config.html To enable the startup script add ossec_hids_enable="YES" to /etc/rc.conf. If you intend to use "firewall-drop" active response on this OSSEC instance create the script: /usr/local/ossec-hids/active-response/bin/firewall-drop.sh You can copy or hard link (symbolic link is not supported) one of the scripts already provided by OSSEC: /usr/local/ossec-hids/active-response/bin/ipfilter.sh /usr/local/ossec-hids/active-response/bin/ipfw.sh /usr/local/ossec-hids/active-response/bin/pf.sh For further steps see the documentation: https://www.ossec.net/docs/syntax/head_ossec_config.active-response.html Consider installing "security/ossec-hids-local-config" to ease OSSEC configuration. For additional help execute: # /usr/local/etc/rc.d/ossec-hids help
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 3.8.0 | ✗ | – |
| FreeBSD 15 | 3.8.0 | ✗ | – |
| FreeBSD 14 | 3.8.0 | ✗ | 3.8.0 |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 3.8.0 | ✗ | – |
| FreeBSD 14 | 3.8.0 | ✗ | 3.8.0 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
pkg audit for the packaged version 3.8.0.security/ossec-hids-local: Remove non-default option PRELUDE prelude has been defunct for some times and has been marked deprecated. This removes the non-default OPTION PRELUDE. PR: 296318 Approved by: dominik.lisiak@bemsoft.pl (maintainer-timeout)822ec4a435
security/ossec-hids*: fix make warnings use backticks rather than $() which is rather fraught with make PR: 288365 Approved by: sjg (bmake maintainer)6764a97f12
security/ossec-hids: update to 3.8.0 No additional binary changes to ossec-hids-* ports. Changes in configuration: - Changed default value of ossec_hids_fetch_connect_time from 40 to 60 seconds. - Limited PostgreSQL syscheck to config files only. PR: 285478abfff1b87f
security/ossec-hids*: local_rules.xml replaced with sample file PR: 266176 Reported by: dominik.lisiak@bemsoft.pl (maintainer)68d6aa009c
Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
security/ossec-hids* : Fix build Remove unwanted patches from previous commit PR: 265688 Fixes: 2b0855d security/ossec-hids: Update to 3.7.0b1d0b5eecd
security/ossec-hids: Update to 3.7.0 PR: 2656692b0855dcfb
security/ossec-hids-*: fix broken config scripts - No binary changes - Replaced all 'sed' invocations with 'sed -E' and adjusted regexes accordingly PR: 256545 Submitted by: Dominik Lisiak (maintainer)329f3e8d8b
*/*: Remove redundant '-*' from CONFLICTS definitions The conflict checks compare the patterns first against the package names without version (as reported by "pkg query "%n"), then - if there was no match - agsinst the full package names including the version (as reported by "pkg query "%n-%v"). Approved by: portmgr (blanket)04b9da4140
One more small cleanup, forgotten yesterday. Reported by: lwhsucf118ccf87
Remove # $FreeBSD$ from Makefiles.305f148f48
Fails on riscv64 the same way as on aarch64. Approved by: portmgr (tier-2 blanket) Obtained from: lonesome.com build testingb200046550
Mark various ports BROKEN on aarch64. Obtained from: local run @lonesome.com7ea3033324
Fix build of ossec-hids-agent with -fno-common Update the referenced master port and included version.mk file. The patches are not relevant for ossec-hids-local, but have to be added there to become effective in ossec-hids-agents.d443b0b243
security/ossec-hids: Update to 3.6.0 PR: 244340 Submitted by: Dominik Lisiak <dominik.lisiak@bemsoft.pl> (maintainer)78fefcee42
security/ossec-hids*: update to 3.5.0
ChangeLogs:
https://github.com/ossec/ossec-hids/releases/tag/3.4.0
https://github.com/ossec/ossec-hids/releases/tag/3.5.0
PR: 242110
Submitted by: dominik.lisiak@bemsoft.pl (maintainer)64391cfc2aMove remaining USE_MYSQL, WANT_MYSQL_VER to USES=mysql581cac9416
Prepare for powerpc-on-clang by deleting hard-coded tests for architecture as a stand-in for "are we running on gcc". In some cases we only need to specifically test for "are we on the ancient base gcc", e.g, the usage of 'pragma'. While here, in some cases turn off SSE functions more specifically based on ARCH, and turn off -mtune=generic everywhere. These are part of a larger work in progress; these commits are for ports that would have been touched by the the powerpc-on-clang test regardless. Approved by: portmgr (tier-2 blanket)a00547aa72
security/ossec-hids: upgrade 3.1.0 -> 3.3.0 security/ossec-hids-local: upgrade 3.1.0 -> 3.3.0 security/ossec-hids-local-config: upgrade 3.1.0 -> 3.3.0 - Added LUA option. Bundled Lua support is no longer compiled in by default PR: 237632 Submitted by: Dominik Lisiak <dominik.lisiak@bemsoft.pl> (maintainer) Relnotes: https://github.com/ossec/ossec-hids/releases/tag/3.3.0 https://github.com/ossec/ossec-hids/releases/tag/3.2.0b747f9fc07
Update devel/readline to 8.0 - Bump PORTREVISION of dependent ports for shlib change Changes: https://tiswww.case.edu/php/chet/readline/CHANGES PR: 236156 Exp-run by: antoine40c9c7f7eb
Remove GeoIP-related options. Where possible, replace GeoIP 1 defaults with GeoIP 2. Also, as suggested by zi, add an UPDATING note about this.2eb84a7a05
security/ossec-hids-local: build fix as user [1] While here: - add new option PGSQL_SC ossec-hids-*-config [1] - improved option descriptions [1] - fix build with GCC-based architectures [2] PR: 233168 [1] PR: 233291 [2] Submitted by: Dominik Lisiak <dominik.lisiak@bemsoft.pl> (maintainer) [1] Submitted by: Piotr Kubaj <pkubaj@anongoth.pl> [2] Approved by: Dominik Lisiak <dominik.lisiak@bemsoft.pl> (maintainer) [2]d27a45063e
Fix build as a user.3096a0f0e3
security/ossec-hids-server: update from 2.8.3 to 3.1.0 PR: 232794 Submitted by: Dominik Lisiak <dominik.lisiak@bemsoft.pl> (maintainer)868061ef79
security/security/ossec-hids-(server|local|client): SSL fix / stage QA
Fix 1: Set LDFLAGS for SSL support
Fix 2: Fix stage-QA failures in both -local and -server:
Two log files were present in these stage directories that were
not listed in the plist. One of them were registered by the
-client port so rather than remove them from the stage, add them
to the package list
Fix 3: revbump after fix 2
Approved by: SSL and general blankets6a739f4a97Mark as broken on various tier-2 archs. While here, pet portlint. Approved by: portmgr (tier-2 blanket)c92cf8332c
Update security/ossec-hids-* to 2.8.2. Approved by: swills (mentor) MFH: 2015Q2 Security: c470db07-1098-11e5-b6a8-002590263bf57f16b2fac1
Add missing USE_OPENSSL=yes PR: 195796c88aaf5c89
- Update ossec to 2.7.1 - Stagify - Fix build with clang Reviewed by: zi@9da100720e
Add NO_STAGE all over the place in preparation for the staging support (cat: security)a65ed2e51b
- Updated to 2.7 (ChangeLog: http://www.ossec.net/?p=577) - Trimmed Makefile headers - Removed patches incorporated into upstream - Added conditional patch for compilation on 7.x, early 8.x systems - Fixed QAT-reported plist problems - Added new users and group for use with daemons Requested by: various users (via private email)9d5e4df451
- Update to 1.4 PR: ports/117761 Submitted by: valerio.daelli at gmail.com (maintainer)36014b1c04
- Add ossec-hids-local as slave port PR: ports/111944 Submitted by: Valerio Daelli <valerio.daelli at gmail.com>24bea4ab44