OSSEC

Recent Commits

• Scott R. Shinn(26 Aug 26)

  Merge pull request #2304 from atomicturtle/fix/1611-local-ip-bind Bind remoted to a set <local_ip> in that address family only (#1611)

• Scott R. Shinn(26 Aug 26)

  Document that the bind ipv6 flag applies to any non-numeric address. The previous comment said the flag was used only when _ip was unset; getaddrinfo also takes that path for hostnames.

• Scott R. Shinn(26 Aug 26)

  Harden bind cleanup and pin the 1611 regression to one port. Review found leftover sockets on bind failure, a possible fds overflow, and a wildcard test that could send IPv4 and IPv6 to different ephemeral ports.

• Scott R. Shinn(26 Aug 26)

  Stop remoted from mapping a v4 local_ip onto a dual-stack IPv6 socket. A set local_ip binds only that address; ipv6 yes/no applies only when local_ip is omitted.

• Scott R. Shinn(26 Aug 26)

  Merge pull request #2303 from atomicturtle/fix/2065-sender-counter Stop remoted from writing the sender counter into agent 0 rids on key…

• Scott R. Shinn(26 Aug 26)

  Harden sender-counter reload against races flagged in review. Keep outbound counters across a bad sender file parse, re-resolve agent IDs after dropping the key lock, and serialize the public store path so close/reload cannot write a closed FILE*.

• Scott R. Shinn(26 Aug 26)

  Stop remoted from writing the sender counter into agent 0 rids on key reload. Keep the outbound counter on the keystore instead of keyentries[keysize], and replace the sleep(1) FreeKeys drain with an rwlock so a reload cannot close agent files while send still holds them.

• Scott R. Shinn(26 Aug 26)

  Merge pull request #2302 from atomicturtle/feature/1907-json-syslog Forward analysisd JSON alerts over syslog

• Scott R. Shinn(26 Aug 26)

  copilot fixes Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(25 Aug 26)

  Leave alerts rotation to monitord and keep jsonout on when undeclared. Logrotate must not touch /var/ossec/logs/alerts. New json-queue files use the Atomicorp copyright, and a regression covers jsonout_output defaulting on unless the XML tag sets no.

• Scott R. Shinn(25 Aug 26)

  Forward analysisd JSON alerts over syslog so agent_name is a first-class field. JSON syslog_output tails alerts.json (on by default) instead of rebuilding a compact object from alerts.log. Default, CEF, and Splunk formats are unchanged.

• Scott R. Shinn(25 Aug 26)

  Merge pull request #2300 from atomicturtle/fix/2106-dovecot-lip-trailing-comma Stop Dovecot lip= from capturing a trailing comma as dstip.

• Scott R. Shinn(25 Aug 26)

  Stop Dovecot lip= from capturing a trailing comma as dstip. Login and disconnect logs that end at lip=addr, were stuffing the comma into dstip; exclude comma from the IP capture and make mpid optional on success so both formats still match.

• Scott R. Shinn(25 Aug 26)

  Merge pull request #2259 from atomicturtle/feature/1828-libmaxminddb-geoip Replace EOL GeoIP Legacy with libmaxminddb for analysisd.

• Scott R. Shinn(25 Aug 26)

  Merge pull request #2261 from atomicturtle/fix/2107-cdb-mmap-map-failed Check cdb mmap failure with MAP_FAILED.

• Scott R. Shinn(25 Aug 26)

  Merge upstream/main into fix/2107-cdb-mmap-map-failed. Keep the frozen 4.3.0 changelog; record the CDB mmap fix under 4.4.0.

• Scott R. Shinn(25 Aug 26)

  Merge pull request #2285 from atomicturtle/feature/windows-fim-acl Add opt-in Windows FIM **`check_acl`** / `CHECK_ACL` so agents can detect NTFS DACL/ACE changes and raise integrity alerts with human-readable permission detail.

• Scott R. Shinn(25 Aug 26)

  Bump version to 4.3.0 and add llms.txt for release discovery. Keep multi-platform CI on v4.2.0 and enable the upcoming v4.3.0 maintenance branch; packaging scripts and spec follow the same bump.

• Scott R. Shinn(25 Aug 26)

  Enrich GeoIP at decode time for plugin-assigned IPs. Plugin decoders skip SrcIP_FP/DstIP_FP, so MMDB fields were missing from rule matching; skip already-filled lookups after the XML field path.

• Scott R. Shinn(12 Aug 26)

  Merge pull request #2297 from atomicturtle/chore/changelog-4.3.0-tone Tone down 4.3.0 release notes to factual feature descriptions.

• Scott R. Shinn(12 Aug 26)

  Tone down 4.3.0 release notes to factual feature descriptions. Keep the three major capabilities with clear operational detail, without marketing phrasing.

• Scott R. Shinn(12 Aug 26)

  Merge pull request #2296 from atomicturtle/chore/changelog-4.3.0 Chore/changelog 4.3.0

• Scott R. Shinn(12 Aug 26)

  Update 4.3.0 release maintainers list.

• Scott R. Shinn(12 Aug 26)

  Rewrite 4.3.0 release notes around operator-exciting wins. Lead with FIM maintenance mode, then secure syslog shipping and ModSecurity visibility, in plain ops language.

• Scott R. Shinn(12 Aug 26)

  Focus 4.3.0 release notes on the three major features. Expand syslog_output TCP/TLS and FIM maintenance mode details; keep ModSecurity as the third headline and drop lesser enhancements.

• Scott R. Shinn(12 Aug 26)

  Narrow 4.3.0 release notes to the major feature highlights. Keep the detailed General/Bug Fixes lists for attribution; lead with only the headline capabilities operators will notice.

• Scott R. Shinn(12 Aug 26)

  Expand 4.3.0 release notes with per-feature bullets. Call out each user-facing feature in the Release Notes section while keeping the detailed General/Bug Fixes attribution lists intact.

• Scott R. Shinn(12 Aug 26)

  Update 4.3.0 CHANGELOG for merged post-4.2.0 work. Replace the placeholder release notes and add missing entries for syscheck MQ/restart frequency, FIM maintenance mode, decoder/rule fixes, and related operability changes already on main.

• Scott R. Shinn(12 Aug 26)

  Merge pull request #2295 from atomicturtle/fix/syscheck-mq-restart-frequency Fix syscheck queue/restart races and honor FIM frequency under realtime.

• Scott R. Shinn(12 Aug 26)

  Use C11 atomics for analysisd pipeline shutdown and queue fd. sig_atomic_t only covers signal handlers; concurrent pthread access to analysisd_shutting_down and pipeline_m_queue needs _Atomic stores/loads.