Upgrading OSSEC 2.7 to 2.8 and the bro-ids rule issue

‘Tis the season for upgrading.

This hour, the target is OSSEC. Next will be a Cloud server running Ubuntu 12.04 LTS, which will be upgraded to Ubuntu 14.04 LTS

OSSEC is a cross-platform and Free Software “host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.”

It is one of the best of its kind, and one piece of software you want on your server as soon as it’s online. Most tutorials you read advocate Fail2ban, but OSSEC brings a lot more to the table than Fail2ban. Don’t get me wrong, Fail2ban is nice to have on your server, but OSSEC is nicer.

Before the upgrade, the target server was running OSSEC 2.7.1. It was then upgraded to OSSEC 2.8, which was released on June 4 (2014). Upgrading OSSEC is a very simple operation, but I ran into a problem at the end. More on that later. For now, here’s how the upgrade was done.

Downloaded OSSEC 2.8 from here. Verified its checksums and moved the compressed tarball to the server. Unpacked it (tar zxf ossec-hids-2.8.tar.gz), changed to the OSSEC directory (cd ossec-hids-2.8), and started the installation by typing ./install.sh.

Your language is likely supported by the installation script.
Upgrade OSSEC 2.7

It wil detect that there’s an existing OSSEC installation and ask for an upgrade.
Upgrade OSSEC 2.7 to 2.8

From this screenshot, you can tell that something did not go as intended: OSSEC analysisd. Testing rules failed. Configuration error. Exiting.
Upgrade OSSEC 2.7 Linux

Querying the status of OSSEC showed that it is not running. What can the log file tell me?
Upgrade OSSEC 2.7 failed

Entries in the log file revealed the cause of the problem: The program failed to load the bro-ids rule: Invalid decoder name: ‘bro-ids’. Error loading the rules: ‘bro-ids_rules.xml’.
Upgrade OSSEC 2.7 logs

I found out that the issue with bro-ids rules is a longstanding one and that the recommended fix, if you can call it that, is to uncomment the bro-ids_rules.xml line in OSSEC’s main configuration file. And that did the trick
Upgrade OSSEC 2.7 bro-ids rule

Now, OSSEC is up and running, monitoring the system and sending email alerts when it detects bad traffic.

Related Posts

7 tips for dual-booting Linux distributions and Windows Alternates title: Tips for dual-booting Windows and Linux; tips for dual-booting Windows and Linux on a computer with 2 two hard drives; tips for dual...
What will ‘rm -rf /’ actually do to your Linux/BSD machine? For expert users of Linux and other UNIX-like operating systems, the command line is where the action is. We (they) claim that stuff gets done faster ...
Upgrade the kernel on Linux Mint 17.2 If you recently upgraded an installation of Linux Mint 17.1 to Linux Mint 17.2, you'll still be using the same kernel, which should be Linux kernel 3....
Fedora 13 btrfs installation guide In the last article about btrfs on Fedora, we showed how to pass the btrfs option to Anaconda, the Fedora system installation program, on Fedora 13. T...
Why I switched from Postgres to MongoDB, then to Neo4j When you're about to start a project and are trying to make a decision on the what applications to use, one way to proceed is to find out what other p...
Install Ubuntu 11.10 on external hard drive, with an ntfs partition at the end How to install Ubuntu 11.04 on external hard disk, showed how to install Ubuntu 11.04 on a portable USB hard drive. This tutorial, written for Ubuntu ...

We Recommend These Vendors and Free Offers

ContainerizeThis 2016 is a free, 2-day conference for all things containers and big data. Featured, will be presentations and free, hands-on workshops. Learn more at ContainerizeThis.com

Launch an SSD VPS in Europe, USA, Asia & Australia on Vultr's KVM-based Cloud platform starting at $5:00/month (15 GB SSD, 768 MB of RAM).

Deploy an SSD Cloud server in 55 seconds on DigitalOcean. Built for developers and starting at $5:00/month (20 GB SSD, 512 MB of RAM).

Want to become an expert ethical hacker and penetration tester? Request your free video training course of Online Penetration Testing and Ethical Hacking

Whether you're new to Linux or are a Linux guru, you can learn a lot more about the Linux kernel by requesting your free ebook of Linux Kernel In A Nutshell.


Leave a Comment

Your email address will not be published. Required fields are marked *

*