OSSEC changelog (4.3.0) support@atomicorp.com
Release Maintainers
Scott R. Shinn (https://www.atomicorp.com)
Contributors on this release
- @atomicturtle
- @reyjrar
- @hyn172
- @lazyp
- @awiddersheim
- @doke2
- @bchurchill
- @alex-front
- @crlorentzen
- @hcw2016
- @AdUser
Release Notes
OSSEC 4.3.0 adds three main capabilities; other enhancements and fixes are listed below.
- FIM maintenance mode — Per-agent mode via
agent_control -M(enable,disable,status,endwith-u <id>). While enabled, syscheck accepts file changes into the baseline without generating integrity alerts.endrestarts syscheck/rootcheck and clears maintenance when that scan finishes (#677, #1289, #1681). - TCP/TLS
syslog_output—ossec-csyslogdsupports TCP and optional TLS (protocol,tls,tls_verify,tls_ca) in addition to UDP. Alert payloads (default/CEF/JSON/Splunk) may use up toOS_MAXSTRinstead of a 2048-byte limit (#1762). - ModSecurity audit logs — Collect libmodsecurity serial audit logs with the
modsec-auditlocalfile format, and decode nginx ModSecurity error-log events with new rules (#1390).
General
- @atomicturtle - Add optional TCP and TLS to syslog_output (ossec-csyslogd) (#1762)
- @atomicturtle - Raise csyslogd syslog/CEF/JSON alert buffer from 2048 to OS_MAXSTR (#1762)
- @atomicturtle - Add Asterisk IPv6 denied decoder so srcip omits square brackets (#1892)
- @atomicturtle - Allow manage_agents
-f -to bulk-load agents from stdin (#459) - @atomicturtle - Ignore deleted agents in list_agents/get_agents; fix OS_RemoveAgent agent-info cleanup (#244)
- @atomicturtle - Support
###trailing comments in CDB list text files (#1527) - @atomicturtle - Use a dedicated OSSEC iptables chain for firewall-drop active response (#678)
- @atomicturtle - Add ModSecurity / libmodsecurity serial audit log support (
modsec-auditlog format) plus nginx error-log ModSecurity decoders/rules (#1390) - @atomicturtle - Add per-agent FIM maintenance mode via agent_control (#677, #1289, #1681)
- @atomicturtle - Detect Postfix SMTP connect aborts and escalate by source IP (#1897)
- @atomicturtle - Match Snort [Drop] fast alerts in the snort decoder (#1926)
- @atomicturtle - Decode named client IPs with optional BIND @cookie prefix (#1927)
- @atomicturtle - Add muhstik to blacklisted user-agent rule 31508 (#1387)
- @atomicturtle - Reject dangerous/ambiguous syscheck_control flag combinations such as
-r -u(#462) - @hyn172 / @atomicturtle - PR 504 - Add Windows interactive (logon type 2) success detail rule 18262
- @awiddersheim / @atomicturtle - PR 578 - Refactor Unix MQ start/send retry loops without changing wait budgets
- @bchurchill / @atomicturtle - PR 633 - Enable Linux compile/link hardening by default (PIE, FORTIFY, stack protector, full RELRO)
- @alex-front / @atomicturtle - PR 1036 - Add cPanel/cpsrvd decoders and rules; tighten postgresql_log so it does not steal cPanel logs (#1132)
- @hcw2016 / @atomicturtle - PR 1166 - Backup agent state before remove/force-delete and alert on duplicated IP
Bug Fixes
- @atomicturtle - PR 2295 - Fix syscheck queue/restart races and honor FIM
<frequency>under realtime - @atomicturtle - Make PCRE2 JIT optional (soft-fail compile, match via pcre2_match) so analysisd starts on macOS (#2040)
- @atomicturtle - Restore ossec-lua binary names after Lua 5.4.7 upgrade (#2245)
- @atomicturtle - Accept AR expect
username(alias ofuser), fall back to srcuser, and document fixed script argv (#2104) - @atomicturtle - Decode cPanel login lines from webmaild/whostmgrd/cpaneld as well as cpsrvd (#1132)
- @atomicturtle - Avoid FIM false positives from xxx hash placeholders and checksum read failures (#1590, #1704)
- @atomicturtle - Match web-accesslog URLs that contain spaces; do not treat POST as a simple ignored request (#914, #922)
- @atomicturtle - Require more attack-group context and same_location for rule 40501 (#1082)
- @atomicturtle - Stop treating MJ12bot as a malicious user agent in rule 31508 (#1317)
- @atomicturtle - Ignore snap and /dev/loop df 100% alerts under rule 532 (#1418)
- @atomicturtle - Label /var/ossec/logs as var_log_t for logrotate and allow logrotate_t on ossec_log_t (#1948)
- @atomicturtle - Replace dead Honeynet Project link in rule 40601 (#2111)
- @atomicturtle - Limit PHP CGI rule 31110 to .php and cgi-bin URLs (#1101)
- @atomicturtle - Ignore ProFTPD sreaddir buffer growth as a false positive (#1015)
- @atomicturtle - Pass CFLAGS/LDFLAGS into bundled ossec-lua/ossec-luac via MYCFLAGS/MYLDFLAGS (#1568)
- @atomicturtle - Open csyslogd syslog_output sockets before chroot so hostnames work without losing OS_Connect multi-address fallback (#1744)
- @atomicturtle - Emit a single To: plus one comma-separated Cc: for granular/extra recipients so ISPs stop rejecting duplicate To headers (#1901)
- @atomicturtle - Strip Recv-Q/Send-Q from default netstat listen check to stop rule 533 false positives (#495, #2063)
- @reyjrar / @atomicturtle - PR 235 - Canonicalize Windows FIM paths so realtime and scheduled scans use the same slash form
- @lazyp / @atomicturtle - PR 564 - Skip leading XML declarations (and UTF-8 BOM) in OS_ReadXML
- @AdUser / @atomicturtle - PR 2105 - Insert SQL NULL for missing alert src_ip/dst_ip in os_dbd (not the string 'NULL')
- @doke2 / @atomicturtle - PR 663 - Log AGENTCONFIG path when reading shared agent.conf in syscheckd
- @crlorentzen / @atomicturtle - PR 1124 - Fix PIX/ASA 6-308001/605004/605005 field extraction (masked/empty users, remote IP)