For UNIX systems, OSSEC only requires gnu make, gcc, and libc. OpenSSL is a suggested, but optional, prerequisite. However, you always have the option to pre-compile it on one system and move the binaries to the final box.
New in version 3.3.
PCRE2 has been added to version 3.3. The build system can either use the system’s PCRE2 libraries, or the necessary bits can be built as part of the installation process.
The default build process expects the pcre2-10.32 source to be installed in src/external:
$ cd ossec-hids-*/src
$ wget https://ftp.pcre.org/pub/pcre/pcre2-10.32.tar.gz
$ tar xzf pcre2-10.32.tar.gz -C src/external
To use the system’s PCRE2, set the PCRE2_SYSTEM variable to yes:
# cd ossec-hids-*
# PCRE2_SYSTEM=yes ./install.sh
zlib is included with OSSEC in src/external/zlib-1.2.11. In previous versions this included version was used by default during the build process, but this changed to using the system zlib. Ensure the correct zlib development packages are installed.
To use the included version of zlib, simply set ZLIB_SYSTEM to no:
# cd ossec-hids-*
# ZLIB_SYSTEM=no ./install.sh
On Ubuntu you will need the build-essential package in order to compile and install OSSEC.
To install the package run the following command.
# apt-get install build-essential zlib1g-dev
To use the system’s pcre2 libraries, install the libpcre2 development package:
# apt-get install libpcre2-dev
If database support is needed mysql-dev or postgresql-dev should be installed. Run the following command to install these packages.
# apt-get install mysql-dev postgresql-dev
To use the SQLite features, the libsqlite3-dev package is necessary.
New in version 3.0.
# apt-get install libsqlite3-dev
RedHat should have most of the packages needed by default. The zlib development package should be installed:
# yum install zlib-devel
To use the system’s pcre2 libraries, add the pcre2 development package:
# yum install pcre2-devel
If database support is needed the package mysql-devel and/or postgresql-devel will need to be installed.
# yum install mysql-devel postgresql-devel
To use the SQLite features, the sqlite-devel package is necessary.
New in version 3.0.
# yum install sqlite-devel
The zlib development package should be installed:
# zypper install zlib-devel
To use the system’s pcre2 libraries, add the pcre2 development package:
# zypper install pcre2-devel
If database support is needed the package mysql-devel and/or postgresql-devel will need to be installed.
# zypper install postgresql-devel mysql-devel
If you want to build and install OSSEC on FreeBSD you can work together with its Ports Collection.
There you can find and setup ossec-hids-agent, ossec-hids-local or ossec-hids-server.
If you want to build and install only the the required dependencies to run an OSSEC server/manager, without installing it:
# cd /usr/ports/security/ossec-hids-server
# make
If you want to install this particular port, you should run make install.
FreeBSD also offers pre-compiled packages for OSSEC and all its dependencies. If you want to install them you must work with pkg.
As OpenBSD also has its own Ports Collection, you can build and install OSSEC using it if you want.
It only offers security/ossec-hids, so:
# cd /usr/ports/security/ossec-hids
# make
Just like the previous example with FreeBSD, if you want to install it all (not just the dependencies) you must run make install instead. Another option would be using pkg_add.
Warning
The Debian instructions are probably out of date. Contributions updating this section would be appreciated.
Debian has replaced bash with dash, and this may cause issues during installation. Dash does not appear to support all of the features available in other shells, and may display an error when trying to set the server’s IP address on an agent system. The error can be ignored, but the server ip address will need to be set.
Do this by making sure something like the following information is in the agent’s ossec.conf:
<ossec_config>
<client>
<server-ip>SERVER'S IP</server-ip>
</client>
This can also be avoided by using bash to run install.sh:
# bash ./install.sh