OSSSEC is my preferred host-based intrusion detection system (HIDS). I have to admit I am a bit partial to it because my good friend Daniel Cid built it and sold it to Trend Micro / Third Brigade back in 2008. I have what many don’t have, that’s the ability to pester Daniel until he tells me and guides through all my issues. In the process I have learned a number of things and made some very interesting observations about the product, here is where I will be sharing them.

Being that my focus is on website security my employment and utilization of the product will be as such. I won’t talk much to the configuration and monitoring of large scale enterprises, but will likely get into large n-tier implementations of web enterprises. This could include the utilization of load balancers, web servers and database servers, and possibly some storage devices. Pretty straight forward stuff.

Unfortunately, one of the observations I have made is that the implementation of OSSEC is piss poor. They are not monitoring anything of value. The other observation is simplicity. What I have learned about my dear friend is that he doesn’t believe in complexity, where possible he tries to simplify, and while I know if he had the chance he would rewrite OSSEC, simplicity is still at its core. I mention this because it’s very important to note when you work with the application.

So let’s start there.

The one caveat I need to make is that I don’t run off the version of OSSSEC provided here: http://www.ossec.net/?page_id=19. I actually run off Daniel’s branch here: https://bitbucket.org/dcid/ossec-hids/get/tip.tar.gz. This includes almost all the changes provided in the latest version of 2.7 and is pulled into the latest versions on the main site.
[Read more...]