Skip to content

Releases: ossec/ossec-hids

Release list

4.3.0

4.3.0 Latest
Latest

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 25 Aug 14:05
4.3.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
82f8583
This commit was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.

OSSEC changelog (4.3.0) support@atomicorp.com

Release Maintainers

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

OSSEC 4.3.0 adds three main capabilities; other enhancements and fixes are listed below.

  • FIM maintenance mode — Per-agent mode via agent_control -M (enable, disable, status, end with -u <id>). While enabled, syscheck accepts file changes into the baseline without generating integrity alerts. end restarts syscheck/rootcheck and clears maintenance when that scan finishes (#677, #1289, #1681).
  • TCP/TLS syslog_output — ossec-csyslogd supports TCP and optional TLS (protocol, tls, tls_verify, tls_ca) in addition to UDP. Alert payloads (default/CEF/JSON/Splunk) may use up to OS_MAXSTR instead of a 2048-byte limit (#1762).
  • ModSecurity audit logs — Collect libmodsecurity serial audit logs with the modsec-audit localfile format, and decode nginx ModSecurity error-log events with new rules (#1390).

General

Bug Fixes

  • @atomicturtle - PR 2295 - Fix syscheck queue/restart races and honor FIM <frequency> under realtime
  • @atomicturtle - Make PCRE2 JIT optional (soft-fail compile, match via pcre2_match) so analysisd starts on macOS (#2040)
  • @atomicturtle - Restore ossec-lua binary names after Lua 5.4.7 upgrade (#2245)
  • @atomicturtle - Accept AR expect username (alias of user), fall back to srcuser, and document fixed script argv (#2104)
  • @atomicturtle - Decode cPanel login lines from webmaild/whostmgrd/cpaneld as well as cpsrvd (#1132)
  • @atomicturtle - Avoid FIM false positives from xxx hash placeholders and checksum read failures (#1590, #1704)
  • @atomicturtle - Match web-accesslog URLs that contain spaces; do not treat POST as a simple ignored request (#914, #922)
  • @atomicturtle - Require more attack-group context and same_location for rule 40501 (#1082)
  • @atomicturtle - Stop treating MJ12bot as a malicious user agent in rule 31508 (#1317)
  • @atomicturtle - Ignore snap and /dev/loop df 100% alerts under rule 532 (#1418)
  • @atomicturtle - Label /var/ossec/logs as var_log_t for logrotate and allow logrotate_t on ossec_log_t (#1948)
  • @atomicturtle - Replace dead Honeynet Project link in rule 40601 (#2111)
  • @atomicturtle - Limit PHP CGI rule 31110 to .php and cgi-bin URLs (#1101)
  • @atomicturtle - Ignore ProFTPD sreaddir buffer growth as a false positive (#1015)
  • @atomicturtle - Pass CFLAGS/LDFLAGS into bundled ossec-lua/ossec-luac via MYCFLAGS/MYLDFLAGS (#1568)
  • @atomicturtle - Open csyslogd syslog_output sockets before chroot so hostnames work without losing OS_Connect multi-address fallback (#1744)
  • @atomicturtle - Emit a single To: plus one comma-separated Cc: for granular/extra recipients so ISPs stop rejecting duplicate To headers (#1901)
  • @atomicturtle - Strip Recv-Q/Send-Q from default netstat listen check to stop rule 533 false positives (#495, #2063)
  • @reyjrar / @atomicturtle - PR 235 - Canonicalize Windows FIM paths so realtime and scheduled scans use the same slash form
  • @lazyp / @atomicturtle - PR 564 - Skip leading XML declarations (and UTF-8 BOM) in OS_ReadXML
  • @AdUser / @atomicturtle - PR 2105 - Insert SQL NULL for missing alert src_ip/dst_ip in os_dbd (not the string 'NULL')
  • @doke2 / @atomicturtle - PR 663 - Log AGENTCONFIG path when reading shared agent.conf in syscheckd
  • @crlorentzen / @atomicturtle - PR 1124 - Fix PIX/ASA 6-308001/605004/605005 field extraction (masked/empty users, remote IP)

Contributors

reyjrar, AdUser, and 10 other contributors
Assets 4
Loading
1 Join discussion

4.2.0

4.2.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 02 Aug 21:32
4.2.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
928b24e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OSSEC changelog (4.2.0) support@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

This release focuses on analysisd scalability and broader stability. Key enhancements include an always-on multi-threaded analysisd pipeline for Linux servers, pthread migration for manager daemons, rootcheck file-hash enrichment in alerts, and a self-contained Windows agent installer that ships required MinGW/OpenSSL runtime DLLs. It also includes numerous fixes across authd, maild, syscheck, logcollector, and rules.

Security Fixes

General

Bug Fixes

Contributors

atomicturtle and Hu6li
Loading
0 Join discussion

4.1.0

4.1.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 27 May 15:44
4.1.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
67eefdc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OSSEC changelog (4.1.0)

Release Maintainers

Dan Parriott

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

Key enhancements include SMTP authentication support, IPv6 whitelisting improvements, and support for large files (>2GB). This release also includes multiple bug fixes for analysisd and logcollector crashes. This changelog is not yet complete

Security Fixes

General

Bug Fixes

Contributors

atomicturtle and mobstef
Loading
0 Join discussion

4.1.0 RC1

4.1.0 RC1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 11 Apr 20:30
4.1.0-rc1
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
f657be9
This commit was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.

OSSEC changelog (4.1.0) support@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

This changelog is not yet complete

Key enhancements include SMTP authentication support, IPv6 whitelisting improvements, and support for large files (>2GB). This release also includes multiple bug fixes for analysisd and logcollector crashes. This changelog is not yet complete

Security Fixes

General

Bug Fixes

Contributors

atomicturtle and mobstef
Loading

# OSSEC 4.0.0 Release Notes

# OSSEC 4.0.0 Release Notes

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 01 Feb 21:47
4.0.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
69986fa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Maintainers

Contributors on this release

Release Notes

Major security and stability release addressing critical memory safety issues and modernizing cryptographic implementations. This release includes fixes for multiple heap use-after-free (UAF) vulnerabilities, uncontrolled recursion in XML parsing, and implementation of secure random number generation for agent key creation. Additionally, file integrity monitoring has been modernized with SHA-256 support, and several external dependencies have been updated to their latest stable versions.

⚠️ Breaking Changes

Warning

AES Encryption Now Default for Agent Communication

OSSEC 4.0.0 agents now use AES encryption by default for agent-server communication. This is NOT backwards compatible with OSSEC 3.8.0 and older servers.

Migration Options:

  1. Upgrade servers first (recommended): Update all OSSEC servers to 4.0.0 before upgrading agents.
  2. Use legacy Blowfish encryption on 4.0.0 agents: Add the following to your agent's ossec.conf: 
    <client>
  <crypto_method>blowfish</crypto_method>
</client>

Configuration Changes

  • SHA-256 File Integrity Monitoring: SHA-256 is now enabled by default for all monitored directories. No configuration changes are required for new installs.
  • To disable SHA-256 (if needed for compatibility): 
    <syscheck>
  <directories check_sha256sum="no">/etc</directories>
</syscheck>

🔒 Security Fixes

  • Critical Memory Safety: Fix critical UAF bug in memory leak fix (Issue #1818) - PR 2178
  • Heap UAF: Fix Issue #1817: Heap UAF in OSSEC Alert decoder with leak-free Eventinfo refactor - PR 2177
  • Recursion Fix: Fix uncontrolled recursion in os_xml _ReadElem (Issue #1953) - PR 2175
  • Secure RNG: Implement secure RNG for agent key generation using OpenSSL RAND_bytes - PR 2167

General Fixes & Improvements

  • FIM Modernization: SHA-256 integration and safe buffer handling - PR 2166
  • Lua Update: Update Lua to version 5.4.7 - PR 2165
  • zlib Update: Update zlib to version 1.3.1 - PR 2164
  • cJSON Update: Update cJSON to version 1.7.18 - PR 2163
  • Windows Builds: Build fixes for Windows - PR 2162
  • Packaging: Add RPM spec file - PR 2147
  • Agent Auth: Handle SSL EOF condition in agent-auth - PR 2146
  • Performance: Ignore ENOENT in OS_RemoveCounter to prevent benign error messages - PR 2171
  • Stability: Improve logcollector crash fix to check read function pointer (Issue #2156) - PR 2168
  • Testing: Improve error message in ossec-testrule for missing rule matches (Issue #2093) - PR 2170
  • CLI: Fix help/version argument exit codes - PR 2174
  • Bugfix: Fix for Issue #2056 in syscheck decoder - PR 2173
  • Code Quality: Clean up redundant NULL checks in report filter function (Issue #2133) - PR 2169

Contributors

atomicturtle
Loading
0 Join discussion

3.8.0

3.8.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 05 Jan 21:26
3.8.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
a282687
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OSSEC changelog (3.8.0) scott@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

Update to authd to enforce chrooting, and privilege separation. The authd daemon will by default run as the ossec user. Adds support for AIX 7.x on power architecture (8/9/10).

General

Contributors

pwntester, ngarratt, and 6 other contributors
Loading
0 Join discussion

3.7.0

3.7.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 17 Jan 16:06
3.7.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
1ecffb1
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

OSSEC changelog (3.7.0) scott@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (http://www.atomicorp.com)

Contributors on this release

Release Notes

Support for Journald

What's Changed

New Contributors

Full Changelog: 3.6.0...3.7.0

Contributors

nurse, icy, and 13 other contributors
Loading

3.6.0

3.6.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 14 Feb 21:05
3.6.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
9772223
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

OSSEC changelog (3.6.0) scott@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (http://www.atomicorp.com)

Contributors on this release

Release Notes

Its that time of year again, our annual independent security audit! Joining our previous two years auditors, Apple Security and OVH Internet is security researcher Daniel McCarney (@cpu) who performed a very in depth analysis on our IDS engine updates (PCRE2, and more). With a project as critical as OSSEC in securing cloud and enterprise assets its very important to us to have independent assessments of the framework. So again we want to thank all of our auditors, old and new for their contribution to the project.

Coder? Tester? Enthusiast? If you're interested in joining our team, or just interacting with the OSSEC community , email us for a slack invite at: invite@ossec.net

General

Loading

V3.5.0

V3.5.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 18 Nov 14:00
3.5.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
b1d087f
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

OSSEC changelog (3.5.0) scott@atomicorp.com

Release Maintainers

Dan Parriott
Scott R. Shinn (http://www.atomicorp.com)
Dominik Lisiak

Contributors on this release

Release notes:

This would have been a minor 3.4.1 update if it wasnt for Boris Lukashev of https://www.sempervictus.com
contributing a much needed update to multi-line log analysis. Previous usage of multi-line in OSSEC in
the past was limited in processing events that did not use indentiation, a fairly common modern practice
for readability. This update adds a new type: multi-line_indented to handle this condition (Example: postgresql).

Maintenance fixes in this release also address issue #1781, which affected maild when calling an external program, and add support for Fedora 31

Whats New:

General

  • (@ddpbsd) - Fix for Issue #1781, corrects issues with program sending mail
Loading

V3.4.0

V3.4.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 18 Oct 20:29
3.4.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
a789a7b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

OSSEC changelog (3.4.0) scott@atomicorp.com

Release Maintainers

Dan Parriott
Scott R. Shinn (http://www.atomicorp.com)
Dominik Lisiak

Contributors on this release

Release notes

Big changes in this release add support for the following new platforms:

  • Debian buster
  • Fedora 30
  • RHEL 8
  • (Much awaited!) Centos 8

@jubois has completed the first round of pcre2 rule updates. This is a very exciting change to the overall IDS engine in OSSEC and opens the platform up to much more complex (and faster!) search functionality.

Snapcraft.io universal linux packaging support (aka Snaps) allow for a universal OSSEC package across multiple linux distributions.

Last but not least, @ddpbsd has a long awaited fix for agentd/maild when ipv6 is disabled and/or hostnames are used instead of IPs in PR#1698. Thanks again to all our community contributors, and dedicated team members for their work on this release!

New Rules / Decoders

  • (@aquerubin) Updated IPv4-dependent regexp in ownCloud decoders. PR#1697
  • (@jubois) Fix Issue #1708 (Incorrect regex match) PR#1710
  • (@jubois) PCRE2 rulefiles conversion PR#1711
  • (@jubois) PCRE2 decoders conversion PR#1712
  • (@aquerubin) Fix owncloud decoder PR#1724
  • (@iasdeoupxe) Additional ownCloud decoder fix PR#1725
  • (@iasdeoupxe) Second ownCloud decoder fix PR#1726
  • (@ddpbsd) Adjust pix decoder and a firewall rule PR#1749
  • (@binrush) Fixed missing same_source_ip in rule 11306 PR#1751 pureftpd
  • (@ddpbsd) Addition to sshd rule, new ntpd rule PR#1757,
  • (@ddpbsd) Fix rule IDs PR#1760 - openbsd_rules

General

  • (@ddpbsd) syscheck, Try to silence the "Attempted to check FS status for" message. PR#1701
  • (@ddpbsd) syscheck, Add some basic error handling to syscheck_control PR#1702
  • (@ddpbsd) core, More unlink and fopen error handling in src/util PR#1703
  • (@almirb) active-response,Added Cloudflare active-response script. PR#1709
  • (@Varstahl) cyslogd, csyslogd CEF – Remove duplicate parameters and fix discarded hashes PR#1713
  • (@atomicturtle) - docs, Updating links, using https, conference links PR#1714
  • (@Varstahl) cyslogd, Fix: csyslogd – CEF escaping / multi-line syslog
  • (@ddpbsd) core, Check return values for unlink(2) calls PR#1733
  • (@mikeroyal) packaging, snap build support PR#1737
  • (@ddpbsd) core, Set PCRE2_SYSTEM to no by default. PR#1738
  • (@ddpbsd) logtest, Remove leading space from field names PR#1741
  • (@bchavet) analysisd, Verify Googlebot PR#1752 , this is a code function in generic_samples.c
  • (@ddpbsd) analysisd, Free the lf->fields memory. PR#1758, fixes issue #1727
  • (@ddpbsd) testing, Update some travis-ci bits PR#1759 - travis fixes
Loading