{"id":19249302,"url":"https://github.com/sous-chefs/ossec","last_synced_at":"2025-10-11T02:06:30.107Z","repository":{"id":2725953,"uuid":"3720882","full_name":"sous-chefs/ossec","owner":"sous-chefs","description":"Development repository for the ossec cookbook","archived":false,"fork":false,"pushed_at":"2025-09-10T16:26:57.000Z","size":286,"stargazers_count":44,"open_issues_count":2,"forks_count":65,"subscribers_count":28,"default_branch":"main","last_synced_at":"2025-09-17T00:53:28.408Z","etag":null,"topics":["chef","chef-cookbook","chef-resource","hacktoberfest","managed-by-terraform","ossec"],"latest_commit_sha":null,"homepage":"https://supermarket.chef.io/cookbooks/ossec","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sous-chefs.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"sous-chefs"}},"created_at":"2012-03-14T18:36:12.000Z","updated_at":"2025-09-10T16:27:00.000Z","dependencies_parsed_at":"2025-04-19T15:50:02.301Z","dependency_job_id":"61ce6a22-a36b-4988-986a-3ac60762231a","html_url":"https://github.com/sous-chefs/ossec","commit_stats":{"total_commits":249,"total_committers":32,"mean_commits":7.78125,"dds":0.7550200803212852,"last_synced_commit":"74ba65b6bbe4c47b8fc399b8bf61713ed68f0152"},"previous_names":[],"tags_count":29,"template":false,"template_full_name":null,"purl":"pkg:github/sous-chefs/ossec","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sous-chefs%2Fossec","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sous-chefs%2Fossec/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sous-chefs%2Fossec/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sous-chefs%2Fossec/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sous-chefs","download_url":"https://codeload.github.com/sous-chefs/ossec/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sous-chefs%2Fossec/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279005910,"owners_count":26083994,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-11T02:00:06.511Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["chef","chef-cookbook","chef-resource","hacktoberfest","managed-by-terraform","ossec"],"created_at":"2024-11-09T18:13:36.801Z","updated_at":"2025-10-11T02:06:30.079Z","avatar_url":"https://github.com/sous-chefs.png","language":"Ruby","funding_links":["https://opencollective.com/sous-chefs"],"categories":[],"sub_categories":[],"readme":"# ossec cookbook\n\n[![Cookbook Version](https://img.shields.io/cookbook/v/ossec.svg)](https://supermarket.chef.io/cookbooks/ossec)\n[![Build Status](https://img.shields.io/circleci/project/github/sous-chefs/ossec/master.svg)](https://circleci.com/gh/sous-chefs/ossec)\n[![OpenCollective](https://opencollective.com/sous-chefs/backers/badge.svg)](#backers)\n[![OpenCollective](https://opencollective.com/sous-chefs/sponsors/badge.svg)](#sponsors)\n[![License](https://img.shields.io/badge/License-Apache%202.0-green.svg)](https://opensource.org/licenses/Apache-2.0)\n\nInstalls OSSEC from source in a server-agent installation. See:\n\n[http://www.ossec.net/docs/manual/installation/index.html](http://www.ossec.net/docs/manual/installation/index.html)\n\nFor managing Wazuh, consider using the Wazuh Chef Cookbook here: [https://github.com/wazuh/wazuh-chef](https://github.com/wazuh/wazuh-chef)\n\n## Maintainers\n\nThis cookbook is maintained by the Sous Chefs. The Sous Chefs are a community of Chef cookbook maintainers working together to maintain important cookbooks. If you’d like to know more please visit [sous-chefs.org](https://sous-chefs.org/) or come chat with us on the Chef Community Slack in [#sous-chefs](https://chefcommunity.slack.com/messages/C2V7B88SF).\n\n## Requirements\n\n### Platforms\n\n- Ubuntu / Debian\n- RHEL and derivatives\n\n### Chef\n\n- Chef 16.13+\n\n### Cookbooks\n\n- yum-atomic\n\n## Attributes\n\n- `node['ossec']['dir']` - Installation directory for OSSEC, default `/var/ossec`. All existing packages use this directory so you should not change this.\n- `node['ossec']['server_role']` - When using server/agent setup, this role is used to search for the OSSEC server, default `ossec_server`.\n- `node['ossec']['server_env']` - When using server/agent setup, this value will scope the role search to the specified environment, default nil.\n- `node['ossec']['agent_server_ip']` - The IP of the OSSEC server. The client recipe will attempt to determine this value via search. Default is nil, only required for agent installations.\n- `node['ossec']['data_bag']['encrypted']` - Boolean value which indicates whether or not the OSSEC data bag is encrypted\n- `node['ossec']['data_bag']['name']` - The name of the data bag to use\n- `node['ossec']['data_bag']['ssh']` - The name of the data bag item which contains the OSSEC keys\n\n### ossec.conf\n\nOSSEC's configuration is mainly read from an XML file called `ossec.conf`. You can directly control the contents of this file using node attributes under `node['ossec']['conf']`. These attributes are mapped to XML using Gyoku. See the [Gyoku site](https://github.com/savonrb/gyoku) for details on how this works.\n\nChef applies attributes from all attribute files regardless of which recipes were executed. In order to make wrapper cookbooks easier to write, `node['ossec']['conf']` is divided into the three installation types mentioned below, `local`, `server`, and `agent`. You can also set attributes under `all` to apply settings across all installation types. The typed attributes are automatically deep merged over the `all` attributes in the normal Chef manner.\n\n`true` and `false` values are automatically mapped to `\"yes\"` and `\"no\"` as OSSEC expects the latter.\n\n`ossec.conf` makes little use of XML attributes so you can generally construct nested hashes in the usual fashion. Where an attribute is required, you can do it like this:\n\n```ruby\ndefault['ossec']['conf']['all']['syscheck']['directories'] = [\n  { '@check_all' =\u003e true, 'content!' =\u003e '/bin,/sbin' },\n  '/etc,/usr/bin,/usr/sbin'\n]\n```\n\nThis produces:\n\n```xml\n\u003csyscheck\u003e\n  \u003cdirectories check_all=\"yes\"\u003e/bin,/sbin\u003c/directories\u003e\n  \u003cdirectories\u003e/etc,/usr/bin,/usr/sbin\u003c/directories\u003e\n\u003c/syscheck\u003e\n```\n\nThe default values are based on those given in the OSSEC manual. They do not include any specific rules, checks, outputs, or alerts as everyone has different requirements.\n\n### agent.conf\n\nOSSEC servers can also distribute configuration to agents through the centrally managed XM file called `agent.conf`. Since Chef is better at distributing configuration than OSSEC is, the cookbook leaves this file blank by default. Should you want to populate it, it is done in a similar manner to the above. Since this file is only used on servers, you can define the attributes directly under `node['ossec']['agent_conf']`. Unlike conventional XML files, `agent.conf` has multiple root nodes so `node['ossec']['agent_conf']` must be treated as an array like so.\n\n```ruby\ndefault['ossec']['agent_conf'] = [\n  {\n    'syscheck' =\u003e { 'frequency' =\u003e 4321 },\n    'rootcheck' =\u003e { 'disabled' =\u003e true }\n  },\n  {\n    '@os' =\u003e 'Windows',\n    'content!' =\u003e {\n      'syscheck' =\u003e { 'frequency' =\u003e 1234 }\n    }\n  }\n]\n```\n\nThis produces:\n\n```xml\n\u003cagent_config\u003e\n  \u003csyscheck\u003e\n    \u003cfrequency\u003e4321\u003c/frequency\u003e\n  \u003c/syscheck\u003e\n  \u003crootcheck\u003e\n    \u003cdisabled\u003eyes\u003c/disabled\u003e\n  \u003c/rootcheck\u003e\n\u003c/agent_config\u003e\n\n\u003cagent_config os=\"Windows\"\u003e\n  \u003csyscheck\u003e\n    \u003cfrequency\u003e1234\u003c/frequency\u003e\n  \u003c/syscheck\u003e\n\u003c/agent_config\u003e\n```\n\n## Recipes\n\n### repository\n\nAdds the OSSEC repository to the package manager. This recipe is included by others and should not be used directly. For highly customised setups, you should use `ossec::install_agent` or `ossec::install_server` instead.\n\n### install_agent\n\nInstalls the agent packages but performs no explicit configuration.\n\n### install_server\n\nInstall the server packages but performs no explicit configuration.\n\n### common\n\nPuts the configuration file in place and starts the (agent or server) service. This recipe is included by other recipes and generally should not be used directly.\n\nNote that the service will not be started if the client.keys file is missing or empty. For agents, this results in an error. For servers, this prevents ossec-remoted from starting, resulting in agents being unable to connect. Once client.keys does exist with content, simply perform another chef-client run to start the service.\n\n### default\n\nRuns `ossec::install_server` and then configures for local-only use. Do not mix this recipe with the others below.\n\n### agent\n\nOSSEC uses the term `agent` instead of client. The agent recipe includes the `ossec::client` recipe.\n\n### client\n\nConfigures the system as an OSSEC agent to the OSSEC server. This recipe will search for the server based on `node['ossec']['server_role']`. It will also set the `agent_server_ip` attribute. The ossec user will have an SSH key created so the server can distribute the agent key.\n\n### server\n\nSets up a system to be an OSSEC server. This recipe will search for all nodes that have an `ossec` attribute and add them as an agent.\n\nTo manage additional agents on the server that don't run chef, or for agentless OSSEC configuration (for example, routers), add a new node for them and create the `node['ossec']['agentless']` attribute as true. For example if we have a router named gw01.example.com with the IP `192.168.100.1`:\n\n```shell\n% knife node create gw01.example.com\n{\n  \"name\": \"gw01.example.com\",\n  \"json_class\": \"Chef::Node\",\n  \"automatic\": {\n  },\n  \"normal\": {\n    \"hostname\": \"gw01\",\n    \"fqdn\": \"gw01.example.com\",\n    \"ipaddress\": \"192.168.100.1\",\n    \"ossec\": {\n      \"agentless\": true\n    }\n  },\n  \"chef_type\": \"node\",\n  \"default\": {\n  },\n  \"override\": {\n  },\n  \"run_list\": [\n  ]\n}\n```\n\nEnable agentless monitoring in OSSEC and register the hosts on the server. Automated configuration of agentless nodes is not yet supported by this cookbook. For more information on the commands and configuration directives required in `ossec.conf`, see the [OSSEC Documentation](http://www.ossec.net/docs/manual/agent/agentless-monitoring.html)\n\n### agent_auth\n\nIf you do not wish to distribute agent keys via SSH then the authd mechanism provides an alternative. Set the `agent_server_ip` attribute manually and this recipe will attempt to register with the given server running ossec-authd. To allow registration with a new server after changing `agent_server_ip`, delete the client.keys file and rerun the recipe.\n\n### authd\n\nFor a server to accept agent registrations, it needs to be running ossec-authd. This recipe installs an init script for it (systemd only for now) and will attempt to start it once the mandatory SSL certificate and key have been put in place. From OSSEC 2.9, you can also set a CA certificate to validate agents against.\n\n## Usage\n\nThe cookbook can be used to install OSSEC in one of the three types:\n\n- local - use the ossec::default recipe.\n- server - use the ossec::server recipe.\n- agent - use the ossec::client recipe\n\nFor local-only installations, add just `recipe[ossec]` to the node run list, or put it in a role (like a base role).\n\n### Server/Agent\n\nThis section describes how to use the cookbook for server/agent configurations.\n\nThe server will use SSH to distribute the OSSEC agent keys. Create a data bag `ossec`, with an item `ssh`. It should have the following structure:\n\n```shell\n{\n  \"id\": \"ssh\",\n  \"pubkey\": \"\",\n  \"privkey\": \"\"\n}\n```\n\nGenerate an ssh keypair and get the privkey and pubkey values. The output of the two ruby commands should be used as the privkey and pubkey values respectively in the data bag.\n\n```shell\nssh-keygen -t rsa -f /tmp/id_rsa\nruby -e 'puts IO.read(\"/tmp/id_rsa\")'\nruby -e 'puts IO.read(\"/tmp/id_rsa.pub\")'\n```\n\nFor the OSSEC server, create a role, `ossec_server`. Add attributes per above as needed to customize the installation.\n\n```shell\n% cat roles/ossec_server.rb\nname \"ossec_server\"\ndescription \"OSSEC Server\"\nrun_list(\"recipe[ossec::server]\")\noverride_attributes(\n  \"ossec\" =\u003e {\n    \"conf\" =\u003e {\n      \"server\" =\u003e {\n        \"global\" =\u003e {\n          \"email_to\" =\u003e \"ossec@yourdomain.com\",\n          \"smtp_server\" =\u003e \"smtp.yourdomain.com\"\n        }\n      }\n    }\n  }\n)\n```\n\nFor OSSEC agents, create a role, `ossec_client`.\n\n```shell\n% cat roles/ossec_client.rb\nname \"ossec_client\"\ndescription \"OSSEC Client Agents\"\nrun_list(\"recipe[ossec::client]\")\noverride_attributes(\n  \"ossec\" =\u003e {\n    \"conf\" =\u003e {\n      \"agent\" =\u003e {\n        \"syscheck\" =\u003e {\n          \"frequency\" =\u003e 321\n        }\n      }\n    }\n  }\n)\n```\n\n## Customization\n\nThe main configuration file is maintained by Chef as a template, `ossec.conf.erb`. It should just work on most installations, but can be customized for the local environment. Notably, the rules, ignores and commands may be modified.\n\nFurther reading:\n\n- [OSSEC Documentation](http://www.ossec.net/docs/index.html)\n\n## Contributors\n\nThis project exists thanks to all the people who [contribute.](https://opencollective.com/sous-chefs/contributors.svg?width=890\u0026button=false)\n\n### Backers\n\nThank you to all our backers!\n\n![https://opencollective.com/sous-chefs#backers](https://opencollective.com/sous-chefs/backers.svg?width=600\u0026avatarHeight=40)\n\n### Sponsors\n\nSupport this project by becoming a sponsor. Your logo will show up here with a link to your website.\n\n![https://opencollective.com/sous-chefs/sponsor/0/website](https://opencollective.com/sous-chefs/sponsor/0/avatar.svg?avatarHeight=100)\n![https://opencollective.com/sous-chefs/sponsor/1/website](https://opencollective.com/sous-chefs/sponsor/1/avatar.svg?avatarHeight=100)\n![https://opencollective.com/sous-chefs/sponsor/2/website](https://opencollective.com/sous-chefs/sponsor/2/avatar.svg?avatarHeight=100)\n![https://opencollective.com/sous-chefs/sponsor/3/website](https://opencollective.com/sous-chefs/sponsor/3/avatar.svg?avatarHeight=100)\n![https://opencollective.com/sous-chefs/sponsor/4/website](https://opencollective.com/sous-chefs/sponsor/4/avatar.svg?avatarHeight=100)\n![https://opencollective.com/sous-chefs/sponsor/5/website](https://opencollective.com/sous-chefs/sponsor/5/avatar.svg?avatarHeight=100)\n![https://opencollective.com/sous-chefs/sponsor/6/website](https://opencollective.com/sous-chefs/sponsor/6/avatar.svg?avatarHeight=100)\n![https://opencollective.com/sous-chefs/sponsor/7/website](https://opencollective.com/sous-chefs/sponsor/7/avatar.svg?avatarHeight=100)\n![https://opencollective.com/sous-chefs/sponsor/8/website](https://opencollective.com/sous-chefs/sponsor/8/avatar.svg?avatarHeight=100)\n![https://opencollective.com/sous-chefs/sponsor/9/website](https://opencollective.com/sous-chefs/sponsor/9/avatar.svg?avatarHeight=100)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsous-chefs%2Fossec","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsous-chefs%2Fossec","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsous-chefs%2Fossec/lists"}