OSSEC v2.2 will be released soon and we need help beta testing it. The code is pretty stable already and have been through a series of internal testings.
So, if you have a spare system or can install it on your production network, we would love to hear some feedback (just follow the instructions at our Beta testing wiki page.
New features/Bug fixes
- Added tool to proper validate if the system is little or big endian.
- Added “ignore” option to rootcheck (specially to deal with large NFS shares and avoid scaning them)
- Added option to log every rootcheck event (not only the FTS ones).
- Fixed configuration error when no parameter was given to the agent.conf file
- Added rules to ignore constant CRON login/logout alerts (happening on Debian/Ubuntu)
- Changed the way we handle Windows sockets to avoid timeouts on shared files
- Added support for roundcube logs. (Thanks to Michael Starks for the work).
- Added support for Netscreen alert (IDS) events.
- Added command line options to the manage_agents tool.
- Fixed issue of duplicated IP addresses on syscheck_control. (Patch by ddpbsd at gmail.com).
- Fixed the way we handle /0 netmasks on all the control tools.
- Added custom fine-grained entries to syscheck on Windows. The goal is to reduce the amount of directories check and increase usefulness.
- Added option to disable message id checks. Useful when you plan to reuse keys.
- Added support for WordPress logs. They come from the wpsyslog2 plugin that we modified to log everything to syslog (from new posts, new comments, logins, logouts, etc).
- Added support for escaping “<” on the XML and regex libraries.
- Fixed bug on syscheck_control where the zero/ignore options were not working on some systems. (Thanks to Michael Starks for the report).
- Added support for Trend OSCE (Office scan) log files
- Fixed installation script on AIX to only use /bin/false if it is installed.
Download
- Download Unix: http://www.ossec.net/files/snapshots/ossec-hids-090826.tar.gz
- Download Windows: http://ossec.net/files/snapshots/ossec-win32-090826.exe
Thanks!