OSSEC

Recent Commits

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2240 from atomicturtle/fix/1489-postfix-452-false-positive Fix Postfix rule 3331 false positive on postscreen client ports.

• Scott R. Shinn (28 Jun 26)

  Fix Postfix rule 3331 false positive on postscreen client ports. Stop the postfix-reject decoder from capturing the client port as the SMTP id, and anchor rule 3331 to exact response code 452. Closes #1489 Assisted-By: Fable 5

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2239 from atomicturtle/fix/1776-msauth-enterprise-admins Fix msauth Enterprise Admins false positives and negatives.

• Scott R. Shinn (28 Jun 26)

  Fix msauth Enterprise Admins false positives and negatives. Anchor well-known group SID regexes so user RIDs like -51901 no longer match Enterprise Admins (-519), and chain universal group rules 18229-18231 through 18213-18215 so 4756/4757 member changes are detected. Closes #1776 Assisted-By: Fable 5

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2238 from atomicturtle/fix/2141-dpkg-remove-false-positive Fix false dpkg install alert when removing packages.

• Scott R. Shinn (28 Jun 26)

  Fix false dpkg install alert when removing packages. Rule 2902 matched any "status installed" line in /var/log/dpkg.log. During apt remove, dpkg logs the pre-removal state that way, so uninstalls incorrectly triggered "New dpkg (Debian Package) installed" before the expected remove/purge alerts. Match install, upgrade, and configure action lines instead of status snapshots. Rule 2903 (remove/purge) is unchanged. Closes #2141. Assisted-By: Fable 5

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2237 from atomicturtle/fix/2140-cis-ubuntu-sources Fix false CIS apt sources alert on Ubuntu 24.04.

• Scott R. Shinn (28 Jun 26)

  Fix false CIS apt sources alert on Ubuntu 24.04. Ubuntu 24.04 moved repository configuration to /etc/apt/sources.list.d/ubuntu.sources (DEB822 format), leaving sources.list empty. Extend the CIS 2.6 rootcheck to accept security repos from either file. Closes #2140. Assisted-By: Fable 5

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2236 from atomicturtle/fix/1975-broken-doc-links Update stale IIS and Windows doc URLs in setup helpers (#1975).

• Scott R. Shinn (28 Jun 26)

  Update stale IIS and Windows doc URLs in setup helpers (#1975). Replace dead ossec.net/en/manual.html#iis and ossec.net/en/win.html links in contrib/iis-logs.bat and src/win32/setup-iis.c with current Sphinx documentation URLs so Windows IIS setup tools point users to the right pages. closes issue #1975 Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2214 from atomicturtle/feature/threading-pthread-migration Feature/threading pthread migration

• Scott R. Shinn (28 Jun 26)

  Windows build fixes Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn (28 Jun 26)

  Merge main into feature/threading-pthread-migration. Keep threaded authd shutdown (authd_HandleSIG + worker pool drain) over main's immediate authd_shutdown exit path from #919. Assisted-By: Auto

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2235 from atomicturtle/fix/2110-journald-polling Poll journald continuously instead of on command frequency (#2110).

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2234 from atomicturtle/fix/syscheck-index-fallback Restore linear scan fallback for syscheck db lookups (#1248).

• Scott R. Shinn (28 Jun 26)

  Poll journald continuously instead of on command frequency (#2110). Journald localfiles were handled like command sources: reads ran only when the configured frequency elapsed and f_check was even, producing ~1000 second bursts of delayed alerts. Journal locations such as "all" were also checked as filesystem paths, triggering "File not available, ignoring it" messages. Poll journald every logcollector loop iteration, skip journald entries in the file maintenance path, and fix sd_read_journal() to validate sd_journal_get_fd(), read entries once per next call, and handle journal errors cleanly. closes issue #2110 Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn (28 Jun 26)

  Restore linear scan fallback for syscheck db lookups (#1248). The per-agent hash index added in #1248 speeds syscheck decoding, but when index creation fails or an entry is missing, DB_Search() treated every file as new and appended duplicate +++ lines on each scan. Under memory pressure that could grow the manager syscheck database without bound and break FIM change detection. Extract shared entry handling into DB_ProcessFoundEntry() and fall back to the pre-index linear scan when the hash is unavailable or incomplete. Only append a new database line when both lookups miss. Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2233 from atomicturtle/fix/1415-logcollector-command-frequency Honor localfile command frequency after logcollector restart (#1415).

• Scott R. Shinn (28 Jun 26)

  Honor localfile command frequency after logcollector restart (#1415). For command and full_command localfiles, logcollector stores the last run time in logff[i].size and compares it against the configured frequency (logff[i].ign). On startup that field was zero, so the interval check always passed and the command ran immediately on every restart. Initialize size to the current time when registering command-based localfiles so the configured frequency is respected from the first daemon loop. Closes issue #1415 Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2232 from atomicturtle/fix/455-diff-truncation-notice Indicate when report_changes diffs are truncated (#455).

• Scott R. Shinn (28 Jun 26)

  Indicate when report_changes diffs are truncated (#455). When syscheck or agentless monitoring includes a diff in an alert, users had no reliable way to tell if more changes were omitted. Line- limited truncation only appended a vague "More changes.." suffix, and byte-limit truncation was not flagged at all. Track truncation explicitly in gen_diff_alert() for both syscheckd and agentlessd, including when the diff file exceeds the read buffer, and append a clear "... diff was truncated ..." notice to the notification. Closes Issue #455 Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn (28 Jun 26)

  Merge upstream/main into feature/threading-pthread-migration. Resolve conflicts keeping pthread mail/remoted paths while taking upstream DH auto-selection (#2213), maild constants (#1890), and remoted queue reconnect behavior via remoted_send_mq_msg(). Assisted-By: Auto

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2231 from atomicturtle/fix/919-authd-graceful-exit Restore rule.group in JSON alert output (#1838).

• Scott R. Shinn (28 Jun 26)

  Restore rule.group in JSON alert output (#1838). W_JSON_ParseGroups() populates rule.groups and compliance arrays but stopped emitting the raw rule.group string after 487708e removed it from Eventinfo_to_jsonstr(). Add the field back in W_JSON_ParseGroups() so both Eventinfo and Archive JSON paths expose the original comma-separated group value alongside the parsed groups array. Closes issue #1838 Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2230 from atomicturtle/fix/1838-json-rule-group Restore rule.group in JSON alert output (#1838).

• Scott R. Shinn (28 Jun 26)

  Restore rule.group in JSON alert output (#1838). W_JSON_ParseGroups() populates rule.groups and compliance arrays but stopped emitting the raw rule.group string after 487708e removed it from Eventinfo_to_jsonstr(). Add the field back in W_JSON_ParseGroups() so both Eventinfo and Archive JSON paths expose the original comma-separated group value alongside the parsed groups array. Closes issue #1838 Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2229 from atomicturtle/fix/1296-syscheck-diff-exit Fix syscheck diff false errors and snapshot handling (#1296).

• Scott R. Shinn (28 Jun 26)

  Fix syscheck diff false errors and snapshot handling (#1296). seechanges_addfile() treated system(diff) != 256 as failure, so diff exit code 0 (identical snapshots) logged spurious "Unable to run diff" errors reported since OSSEC 2.8.x. Decode the wait status with WIFEXITED and WEXITSTATUS, accepting diff exit codes 0 and 1 as success. Also harden snapshot setup in the same path: remove a duplicated tmp_location build and redundant seechanges_dupfile() call, and abort when rename() of the prior last-entry snapshot fails instead of overwriting state and running diff against missing or wrong paths. Closes issue #1296 Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn (28 Jun 26)

  Merge pull request #2228 from atomicturtle/fix/1274-authd-ipv6-key Validate agent keys with OS_IsValidIP for IPv6 authd -i keys

• Scott R. Shinn (28 Jun 26)

  Validate agent keys with OS_IsValidIP for IPv6 authd -i keys OS_IsValidName is for agent names only; IPv6 source-IP keys from ossec-authd -i must be checked with OS_IsValidIP. Restore agent-auth key validation on Linux and unify both clients on OS_IsValidAgentKey(). closes issue #1274 Signed-off-by: Scott R. Shinn <[email protected]>