OSSEC

Recent Commits

• Scott R. Shinn(07 Oct 26)

  Merge pull request #2319 from atomicturtle/fix/1078-drop-search-url-ignore Drop rule 31107 search-URL suppressions for web attacks

• Scott R. Shinn(07 Oct 26)

  Drop rule 31107 search-URL suppressions for web attacks. Stock search.php/searchword ignores hid real SQLi/XSS on CMS search endpoints (#1078).

• Scott R. Shinn(07 Oct 26)

  Merge pull request #2318 from atomicturtle/fix/989-iis-default-user-agent Extract User-Agent from default IIS W3C access logs

• Scott R. Shinn(07 Oct 26)

  Extract User-Agent from default IIS W3C access logs. Align web-accesslog-iis-default with modern IIS field layout so rules and alerts can use the client agent string (#989).

• Scott R. Shinn(07 Oct 26)

  Merge pull request #2317 from atomicturtle/fix/1964-win-agent-auth-keys Write the Windows agent key next to agent-auth.exe

• Scott R. Shinn(07 Oct 26)

  Write the Windows agent key in the directory that contains agent-auth.exe. The installer lets the user choose that directory, and ossec-agent reads client.keys from there.

• Scott R. Shinn(07 Oct 26)

  Merge pull request #2316 from atomicturtle/fix/1472-authd-password Accept a shared authd password that ends with a newline

• Scott R. Shinn(06 Oct 26)

  Reject an enrollment request that does not fit in the send buffer. Removing the 32-character cap let a long password truncate the agent name out of the authd request.

• Scott R. Shinn(06 Oct 26)

  Treat a trailing newline in authd.pass as a line ending. A short shared password was rejected because the client kept the newline and the manager always deleted the last character.

• Scott R. Shinn(06 Oct 26)

  Merge pull request #2315 from atomicturtle/fix/agent-auth-client-keys-mode Write agent-auth client.keys as mode 0440

• Scott R. Shinn(06 Oct 26)

  Write agent-auth client.keys as mode 0440. agentd reads the key after dropping to the ossec group, so enrollment must not leave the file owner-only.

• Scott R. Shinn(06 Oct 26)

  Merge pull request #2314 from atomicturtle/fix/el7-pipeline-atomics Build analysisd pipeline atomics with GCC 4.8

• Scott R. Shinn(06 Oct 26)

  Build analysisd pipeline atomics with GCC 4.8. EL7 has no stdatomic.h. Use the compiler's __atomic builtins there so loads and stores stay equivalent to C11.

• Scott R. Shinn(06 Oct 26)

  Merge pull request #2313 from atomicturtle/fix/2312-authd-systemd-type Run ossec-authd under systemd as a foreground service

• Scott R. Shinn(05 Oct 26)

  Run ossec-authd under systemd as a foreground service. Type=forking waits for the parent to exit, but -f never daemonizes, so start times out.

• Scott R. Shinn(17 Sept 26)

  Merge pull request #2309 from atomicturtle/version-4.4.0-update Bump version to 4.4.0 and record the post-4.3.0 changelog.

• Scott R. Shinn(15 Sept 26)

  Bump version to 4.4.0 and record the post-4.3.0 changelog. Keep multi-platform CI on v4.2.0/v4.3.0 and enable the upcoming v4.4.0 maintenance branch; the spec honors %{_smp_mflags} for parallel make.

• Scott R. Shinn(15 Sept 26)

  Merge pull request #2308 from atomicturtle/fix/2307-win32ui-manifest Use a four-part win32ui manifest version so the agent UI can start.

• Scott R. Shinn(15 Sept 26)

  Use a four-part win32ui manifest version so the agent UI can start. Windows SideBySide rejects assemblyIdentity version "1.5" and fails win32ui.exe with event 63 (issue 2307).

• Scott R. Shinn(26 Aug 26)

  Merge pull request #2304 from atomicturtle/fix/1611-local-ip-bind Bind remoted to a set <local_ip> in that address family only (#1611)

• Scott R. Shinn(26 Aug 26)

  Document that the bind ipv6 flag applies to any non-numeric address. The previous comment said the flag was used only when _ip was unset; getaddrinfo also takes that path for hostnames.

• Scott R. Shinn(26 Aug 26)

  Harden bind cleanup and pin the 1611 regression to one port. Review found leftover sockets on bind failure, a possible fds overflow, and a wildcard test that could send IPv4 and IPv6 to different ephemeral ports.

• Scott R. Shinn(26 Aug 26)

  Stop remoted from mapping a v4 local_ip onto a dual-stack IPv6 socket. A set local_ip binds only that address; ipv6 yes/no applies only when local_ip is omitted.

• Scott R. Shinn(26 Aug 26)

  Merge pull request #2303 from atomicturtle/fix/2065-sender-counter Stop remoted from writing the sender counter into agent 0 rids on key…

• Scott R. Shinn(26 Aug 26)

  Harden sender-counter reload against races flagged in review. Keep outbound counters across a bad sender file parse, re-resolve agent IDs after dropping the key lock, and serialize the public store path so close/reload cannot write a closed FILE*.

• Scott R. Shinn(26 Aug 26)

  Stop remoted from writing the sender counter into agent 0 rids on key reload. Keep the outbound counter on the keystore instead of keyentries[keysize], and replace the sleep(1) FreeKeys drain with an rwlock so a reload cannot close agent files while send still holds them.

• Scott R. Shinn(26 Aug 26)

  Merge pull request #2302 from atomicturtle/feature/1907-json-syslog Forward analysisd JSON alerts over syslog

• Scott R. Shinn(26 Aug 26)

  copilot fixes Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(25 Aug 26)

  Leave alerts rotation to monitord and keep jsonout on when undeclared. Logrotate must not touch /var/ossec/logs/alerts. New json-queue files use the Atomicorp copyright, and a regression covers jsonout_output defaulting on unless the XML tag sets no.

• Scott R. Shinn(25 Aug 26)

  Forward analysisd JSON alerts over syslog so agent_name is a first-class field. JSON syslog_output tails alerts.json (on by default) instead of rebuilding a compact object from alerts.log. Default, CEF, and Splunk formats are unchanged.