Wazuh is a free and open source platform used for threat prevention, detection,
and response. It is capable of protecting workloads across on-premises,
virtualized, containerized, and cloud-based environments.
Wazuh solution consists of an endpoint security agent, deployed to the
monitored systems, and a management server, which collects and analyzes data
gathered by the agents. Besides, Wazuh has been fully integrated with the
Elastic Stack, providing a search engine and data visualization tool that
allows users to navigate through their security alerts.
===> The following configuration options are available for wazuh-manager-4.14.10:
INOTIFY=off: Kevent based real time monitoring
ZEROMQ=off: ZeroMQ support
===> Use 'make config' to modify these settings
security/wazuh*: update to 4.14.9
- Update cpython bundle to 3.11.17
- Remove obsolete patch file
- Use PYTHON_DISTVERSION for avoid temporarily pkg-plist issues when
system python is updated. The best is keep system python and bundle
python with the same version.
ChangeLog at:
https://documentation.wazuh.com/current/release-notes/release-4-14-9.html
PR: 299490
security/wazuh-manager: Fix build/install
- Remove sqlite3 from USES. Now it consumes sqlite3 inside of wazuh
libraries
- Other minor modifications
Reported by: pkg-fallout
security/wazuh-manager: Remove non-default option PRELUDE
prelude has been defunct for some times and I have marked it deprecated.
PR: 296319
Approved by: acm
security/wazuh-manager: Fix build with new version of python 3.11.15
- Update bundle python version to 3.11.15
- Fix issue when MySQL option is selected [1]
- Bump PORTREVISION
PR: 293256
Reported by: Mykola K. <nikolaytihonov2022 at gmail.com> [1]
security/wazuh-*: Update to 4.14.3
- Fallback to 0 when elapsed-times is a non-numeric value
- Fix getPorts function issues on all versions of FreeBSD
- Update entry about java version into wazuh-indexer/pkg-message file
- Use a modified version of Python async inotify module to
work on FreeBSD (https://github.com/alonsobsd/asyncinotify)
- Define USE=inotify when INOTIFY option is selected
ChangeLog at:
https://documentation.wazuh.com/current/release-notes/release-4-14-3.html
security/wazuh-*: Update to 4.14.2
- Now, Wazuh source code is obtained from
https://github.com/alonsobsd/wazuh-freebsd.
This repository includes all changes to run Wazuh Suite on FreeBSD. dtxdf and
I
will maintain this repository in where will try to add all Wazuh features to
FreeBSD.
- wazuh-dashboards : Update version of opensearch to 2.19.4
ChangeLog at:
https://documentation.wazuh.com/current/release-notes/release-4-14-2.html
Reviewed by: acm dtxdf
Tested by: acm dtxdf
security/wazuh-manager: Add users and groups functions support
- Now wazuh-manager can obtain users and groups information from host
- Fix start_time data to show correct datetime data from wazuh-dashboard
processes option
- Bump PORTREVISION
security/wazuh-manager: Improve port
- Fix issue when agent/manager connection use TCP instead of UDP.
(Thanks to dtxdf) [1]
- wazuh-manager settings use TCP by default
- FreeBSD sca,decoders and rules files were updated to fix some conflict
issues.
- Bump PORTREVISION
PR: 291040
Reported by: Paweł Krawczyk <p+freebsd at krvtz.net> [1]
security/wazuh-manager: Fix error when running with legacy algorithms
Traceback (most recent call last):
File "/var/ossec/framework/scripts/cluster_control.py", line 16, in <module>
import wazuh.core.cluster.cluster
File
"/var/ossec/framework/python/lib/python3.11/site-packages/wazuh/core/cluster/cluster.py",
line 22, in <module>
from wazuh.core.cluster.utils import (
File
"/var/ossec/framework/python/lib/python3.11/site-packages/wazuh/core/cluster/utils.py",
line 21, in <module>
from wazuh.core.configuration import get_ossec_conf
File
"/var/ossec/framework/python/lib/python3.11/site-packages/wazuh/core/configuration.py",
line 23, in <module>
from wazuh.core.utils import cut_array, load_wazuh_xml, safe_move
File
"/var/ossec/framework/python/lib/python3.11/site-packages/wazuh/core/utils.py",
line 32, in <module>
from api import configuration
File
"/var/ossec/framework/python/lib/python3.11/site-packages/api/configuration.py",
line 13, in <module>
from cryptography import x509
File
"/var/ossec/framework/python/lib/python3.11/site-packages/cryptography/x509/__init__.py",
line 7, in <module>
from cryptography.x509 import certificate_transparency, verification
File
"/var/ossec/framework/python/lib/python3.11/site-packages/cryptography/x509/certificate_transparency.py",
line 8, in <module>
from cryptography.hazmat.bindings._rust import x509 as rust_x509
RuntimeError: OpenSSL 3.0's legacy provider failed to load. This is a fatal
error by default, but cryptography supports running without legacy algorithms by
setting the environment variable CRYPTOGRAPHY_OPENSSL_NO_LEGACY. If you did not
expect this error, you have likely made a mistake with your OpenSSL
configuration.
Approved by: acm@
security/wazuh-{agent,manager}: Improve getSerialNumber
Instead of returning UNKNOWN_VALUE, we can leverage the sysctl
'kern.hostuuid' so that users can uniquely identify their devices.
Approved by: acm@
security/wazuh-manager: Fix SIGSEGV when modulesd is starting
When modulesd stops while decompressing the vulnerability detection database,
it accesses an uninitialized structure, causing a SIGSEGV.
Approved by: acm@
security/wazuh-*: Improve ports
- agent and manager: Avoid change permissions to local.sqlite file.
Now it uses read-only mode.
- manager: dos2unix to api.yaml file
- server: logstash8 was updated to 8.19.9 and it needs openjdk21+
- Bump PORTREVISION
Reported by: dtxdf
security/wazuh-manager: Improve port to run inside jail
- Reimplement getPackages() using SQLite
getPackages() is a function used to get a set of information about
the packages installed on the system where the manager and agent
are installed. To obtain this information, pkg-query(8) was used;
however, prior to this commit, it was assumed that pkg(8) was
installed on the system, which could be wrong, especially on systems
such as jails, where pkg(8) is normally used from the host. With
this change, we leverage SQLite to read the pkg(8) database and
obtain information about the packages, which is also much more
efficient than executing a command. This also fixes the segmentation
fault inside jail in wazuh-modulesd when this condition occurs.
- Fix wazuh-apid when security.bsd.see_other_{u,g}ids=0
wazuh-apid checks the status of some daemons (or services) before
(Only the first 15 lines of the commit message are shown above )
security/wazuh: Update to 4.14.1
- Python bundle update to 3.11.4
- wazuh-agent and wazuh-manager : Add support for 15-RELEASE and 16-CURRENT
- wazuh-agent and wazuh-manager : Improve FreeBSD system information functions
- wazuh-dashboards : Update version of opensearch to 2.19.3
- wazuh-manager: Update pkg-message with entries about vulnerability detector
and indexer connector configuration
ChangeLog at:
https://documentation.wazuh.com/current/release-notes/release-4-14-1.html
PR: 290771290782291040
python.mk: rename PYTHON_EXT_SUFFIX to PYTHON_TAG, document, etc
EXT_SUFFIX, according to PEP 3149, refers to the full tag and
extension for compiled extension module objects, eg .cpython-311.so,
.cpython-313t.so, etc. We do not use the correct semantic meaning,
and this usage becomes ambiguous and confusing when tags do not
match between bytecode and compiled extension module objects.
Rename our PYTHON_EXT_SUFFIX to PYTHON_TAG to align with PEP 3147's
specification of a magic tag, which consists of implementation name
and shorthand version only. This is meant for bytecode and other
files containing this tag in their filename that do not depend on
a specific Python ABI for the same version. Chase all existing
consumers.
(Only the first 15 lines of the commit message are shown above )
python: bump all USE_PYTHON=distutils consumers after RUN_DEPENDS removal
Any missed ports, feel free to bump.
Any ports that need setuptools at runtime can have the devel/py-setuptools
manually added back to RUN_DEPENDS, but understand that this practice
is deprecated; see CHANGES for details.
security/wazuh-manager: Fix issues
- Fix issue when protocol is equal to udp46 or tcp46 on FreeBSD getPorts()
function
- Fix issue when process elapsed-times value is equal to hyphen on FreeBSD
getProcessesInfo() function
- Install librocksdb.so.8 library instead of librocksdb.so.8.3.2 one.
It avoids missing library issues
- Bump PORTREVISION
Sponsored by: Entersekt
security/wazuh-*: Update to 4.9.2
- wazuh-manager: Remove support for freebsd13-aarch64
- wazuh-manager: Cache files were generated from python3.11 instead of
python3.10
- wazuh-manager: Remove obsolete patch files
- wazuh-dashboards : Use opensearch-dashboards230 instead of
opensearch-dashboards210
ChangeLog at: https://github.com/wazuh/wazuh/releaseshttps://github.com/wazuh/wazuh-dashboard-plugins/releases
PR: 282160
Reported by: Ian Dickens <ian at south-border.com>
security/wazuh-*: Update to 4.7.5
- Fix build/installation on aarch64
- Fix runtime issues on 14.x and 15.x because of openssl3 support [1]
PR: 279363
Reported by: girgen [1]
security/wazuh-*: Update to 4.7.2
- Install FreeBSD rules, decoders and SCA files by default
- Strip python binary and so files
- Add devel/libffi and databases/arrow to LIB_DEPENDS
- Update pkg-message files
- Othe minor modifications
ChangeLog
at: https://documentation.wazuh.com/current/release-notes/release-4-7-2.html
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
security/wazuh: Update to 4.7.0
- Fix ssl=openssl build [1]
- Fix permissions of backup/db directory. Now backup are generated without
problems
- Add support for get ports info
- Add support for get processes info
- Add a better way for get memory info
- Add new decoders and rules files (https://github.com/alonsobsd/wazuh-freebsd)
- Update FreeBSD sca files (https://github.com/alonsobsd/wazuh-freebsd)
- Minor changes to SysInfo::getPackages function
- Another minor modifications
PR: 275008
Reported by: franco _at_ opnsense.org [1]
security/wazuh-*: Update to 4.6.0
- security/wazuh-manager: Deactivate CIS files. The are renamed to
yml.deprecated
- security/wazuh-agent: Don't install all CIS files
- Turn security.keys a sample file. It helps to avoid remove client.keys on
update
- Update pkg-message.in files
- Another minor modifications
security/wazuh-*: Update to 4.5.3
- security/wazuh-agent: Enable INOTIFY option by default. It enables Kevent
based real time monitoring. See some examples like use it at:
https://wazuh.com/blog/detecting-common-linux-persistence-techniques-with-wazuh/
- security/wazuh-manager: Add entries to pkg-message.in about FreeBSD SCA files
and FreeBSD decoders and rules files. I'll maintain update versions of these
files at https://github.com/alonsobsd/wazuh-freebsd
- security/wazuh-dashboard: Update project url to new one
- Othe minor modifications
security/wazuh-*: Update to 4.5.0
- wazuh-indexer and wazuh-dashboards now use 2.9.0 version of opensearch and
opensearch-dashboard
- Revert beats dependency to beats7 (filebeat) at security/wazuh-server. beats8
has some issues with filebeat (Take a look at PR/272701)
security/wazuh-*: Update to 4.4.4
- Add python path files from lang/python39/files
- wazuh-indexer and wazuh-dashboards now use 2.8.0 version of opensearch and
opensearch-dashboard
- Update beats dependency to beats8 (filebeat) at security/wazuh-server
security/wazuh-*: Update to 4.4.3
- Mark IGNORE on FreeBSD 12-aarch64
- Use makepatch to generate patch files
- Fix typo at wazuh-agent and wazuh-manager pkg-message files [1]
- Fix some linking issues when devel/libsysinfo is installed (using ports).
wazuh-manager compile/install a library with the same name like libsysinfo and
it is used by syscollector feature.
- wazuh-dashboard use opensearch-dashboards 2.7.0
- Some other modifications
ChangeLog at: https://github.com/wazuh/wazuh/releases
PR: 271376
Reported by: lambert _ at _ sanesecurityguy.com [1]
*/*: Update path set in BUILD_DEPENDS for CMake
Commit b23ea4e2d2f51b53d8915fe9fd7b4efbdd575e38 changed its location to
devel/cmake-core
Approved by: portmgr (blanket)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/wazuh-*: update to 4.3.7
- Add better way to install python wheels. It could fix issues when fbsd is
updated to security patch or minor release
ChangeLog at: https://github.com/wazuh/wazuh/releases/tag/v4.3.7
security/wazuh-manager: Fix build
- Fix build on 14-CURRENT
- It works only on amd64. It could works on i386 but I prefer don't expend time
on it because i386 passed to tier 2 on 13.x. aarch64 could be a good platform
for it. I'll try looking on it later
- Bump PORTREVISION
Reported by: pkg-fallout
security/wazuh-manager: New port: Security tool to monitor and check logs and
intrusions (server)
Wazuh is a free and open source platform used for threat prevention, detection,
and response. It is capable of protecting workloads across on-premises,
virtualized, containerized, and cloud-based environments.
Wazuh solution consists of an endpoint security agent, deployed to the
monitored systems, and a management server, which collects and analyzes data
gathered by the agents. Besides, Wazuh has been fully integrated with the
Elastic Stack, providing a search engine and data visualization tool that
allows users to navigate through their security alerts.
WWW: https://wazuh.com/
