OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection
System (HIDS). It has a powerful correlation and analysis engine, integrating
log analysis, file integrity checking, Windows registry monitoring, centralized
policy enforcement, rootkit detection, real-time alerting and active response.
This package adds the configuration overlay with samples, additional rules,
commands, scripts and support for multiple configuration files.
===> The following configuration options are available for ossec-hids-agent-config-3.8.0:
====> System Audit and Rootkit Detection (rootcheck)
BASIC_RC=off: Basic audit and rootkits
====> File Integrity Checking (syscheck)
HOSTDENY_SC=off: Ignore access control files
BASIC_SC=off: "bin", "sbin" and "etc" directories
OSSEC_SC=off: OSSEC directories
PGSQL_SC=off: PostgreSQL configuration files
====> Command Output Monitoring
LOGINS=on: Last logins
PORTS_TCP=on: Open TCP ports
PORTS_UDP=on: Open UDP ports
====> Log Monitoring
BASIC=off: Basic system logs
OSSEC=off: OSSEC active response logs
APACHE=off: Apache logs
NGINX=off: Nginx logs
RADIUS=off: FreeRADIUS logs
VSFTPD=off: Vsftpd logs
====> Active Response Firewall: you have to select exactly one of them
NOFW=on: Custom or no firewall
IPF=off: ipfilter
IPFW=off: ipfirewall
PF=off: Packet Filter
===> Use 'make config' to modify these settings