--- title: OSSEC-HIDS Installation & Configuration on Amazon EC2 Instance description: OSSEC (Open Source HIDS SEcurity) is a host-based intrusion detection system. OSSEC actively monitors all aspects of Unix/Windows systems activity with file integrity monitoring, log analysis and monitoring, rootcheck, windows registry monitoring and process monitoring. You can configure active response in OSSEC to take immediate action when specific alert is triggered. --- [![e-Zest logo_An accion lab company_Colour](https://blog.e-zest.com/hubfs/images/Logos%20with%20Tagline/Corporate/SVG/e-Zest%20logo_An%20accion%20lab%20company_Colour.svg "e-Zest logo_An accion lab company_Colour")](https://www.e-zest.com/) - [WORK](https://www.e-zest.com/our-work) - [SERVICES](https://www.e-zest.com/our-services) - [Product Engineering](https://www.e-zest.com/digital-product-engineering-services) - [Enterprise Data Services](https://www.e-zest.com/enterprise-data-services) - [Digital Commerce](https://www.e-zest.com/digital-commerce-services) - [Digital Operations](https://www.e-zest.com/digital-operations) - [Digital Consulting](https://www.e-zest.com/digital-transformation-consulting-services) - [Digital Experience Design](https://www.e-zest.com/digital-experience-design) - [INSIGHTS](https://blog.e-zest.com/) - [CAREERS](https://www.e-zest.com/careers) - [ENTERPRISE DATA SERVICES](https://www.e-zest.com/enterprise-data-services) - [GENERATIVE AI](https://www.e-zest.com/generative-ai) - [Healthcare](https://healthcare.e-zest.com) - [Contact Us](https://www.e-zest.com/contact-us) - ![Elevating Product Engineering with AI and ML](https://blog.e-zest.com/hubfs/Elevating%20Product%20Engineering%20with%20AI%20and%20ML.jpg) [BLOGS](https://blog.e-zest.com) #### Elevating Product Engineering with AI and ML As technology evolves and customer choices broaden, there is an increasing ... [Read more](https://blog.e-zest.com/elevating-product-engineering-with-ai-and-ml) - ![e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024](https://blog.e-zest.com/hubfs/e-Zest%20%E2%80%93%20An%20Accion%20Labs%20Company%20-%20Gets%20Recognition%20as%20a%20Contender%20in%20the%20ISG%20Provider%20LensTM%20Study%20on%20Digital%20Engineering%20Services%202024.jpg) [NEWS](https://blog.e-zest.com/news) #### e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024 We are delighted to announce that e-Zest – An Accion Labs Company has been ... [Read more](https://blog.e-zest.com/news/e-zest-an-accion-labs-company-gets-recognition-as-a-contender-in-the-isg-provider-lens-study-on-digital-engineering-services-2024) - ![e-Zest Solutions supports Digital Pune Mission](https://blog.e-zest.com/hubfs/blog-files/Digital%20Literacy%20Bus%20e-Zest.png) [CSR](https://blog.e-zest.com/csr) #### e-Zest Solutions supports Digital Pune Mission **Pune, India:** e-Zest Solutions, a leading digital technology innovation ... [Read more](https://blog.e-zest.com/csr/e-zest-solutions-supports-digital-pune-mission) - [Work](https://www.e-zest.com/our-work) - [Services](https://www.e-zest.com/our-services) - [Insights](https://blog.e-zest.com) - [Careers](https://www.e-zest.com/careers) - [Enterprise Data](https://www.e-zest.com/enterprise-data-services) - [Generative AI](https://www.e-zest.com/generative-ai) - [Innovations](https://www.e-zest.com/innovations) - [Healthcare](https://healthcare.e-zest.com) - [About](https://www.e-zest.com/about-us) - [Contact](https://www.e-zest.com/contact-us) - [Blog](https://blog.e-zest.com/) - [News](https://blog.e-zest.com/news) - [CSR](https://blog.e-zest.com/csr) - [![Linkedin Icon](https://blog.e-zest.com/hubfs/icons/linkedin_icon_white.svg)](https://www.linkedin.com/company/e-zest-solutions/) - [![Twitter Icon](https://blog.e-zest.com/hubfs/twitter-logo-silhouette%20(5).svg)](https://twitter.com/ezest) - [![Facebook Icon](https://blog.e-zest.com/hubfs/facebook-app-logo%20(4).svg)](https://www.facebook.com/61259256638) - [![Instagram Icon](https://blog.e-zest.com/hubfs/instagram-logo%20(4).svg)](https://www.instagram.com/ezestsolutions/) - [![Youtube Icon](https://blog.e-zest.com/hubfs/icons/youtube_icon_white.svg)](https://www.youtube.com/user/ezestcorporate) [![Go to top icon](https://blog.e-zest.com/hubfs/AA%20Assets/top%20button.svg)](https://blog.e-zest.com/ossec-hids-installation-and-configuration-on-amazon-ec2-instance#top) Hit enter to search or ESC to close Insights e-Zest members share technology ideas to foster digital transformation. - [Blog](https://blog.e-zest.com) - [Whitepaper](https://blog.e-zest.com/whitepaper) - [Playbook](https://blog.e-zest.com/playbook) - [News](https://blog.e-zest.com/news) - [Innovation](https://blog.e-zest.com/innovation) - [Media Kit](https://www.e-zest.com/media-kit) # OSSEC-HIDS Installation & Configuration on Amazon EC2 Instance [Serendra Birari](https://blog.e-zest.com/author/serendra-birari) Jul 06, 2018 - - - - OSSEC (Open Source HIDS SEcurity) is a host-based intrusion detection system. OSSEC actively monitors all aspects of Unix/Windows systems activity with file integrity monitoring, log analysis and monitoring, rootcheck, windows registry monitoring and process monitoring. You can configure active response in OSSEC to take immediate action when specific alert is triggered. **OSSEC Agent/Server installation & configuration:** **1. Configure OSSEC Server** - To get OSSEC email alerts first install and configure any mail service like Postfix, Sendmail etc - Install required dependencies also (Only for Debian systems). Update the list of available packages and their versions. **apt-get update** Install newer versions of the packages. **apt-get upgrade** Install required packages. OSSEC requires gcc & make to compile & install. **apt-get install build-essential** To install make & gcc on Debian based systems. **yum install make gcc** To install make & gcc on RHEL based systems. - Download the latest version of the OSSEC (Choose version as per your requirement). **wget **[https://github.com/ossec/ossec-hids/archive/2.9.3.tar.gz](https://github.com/ossec/ossec-hids/archive/2.9.3.tar.gz) You can find more OSSEC packages on below URL. [https://github.com/ossec/ossec-hids/releases](https://github.com/ossec/ossec-hids/releases) - Extract the downloaded file. **tar -xvzf 2.9.3.tar.gz** - Change the directory to the extracted directory. **cd ossec-hids-2.9.3** - Run install.sh to install OSSEC. **sh install.sh** **You will get prompt to answer some questions.** (en/br/cn/de/el/es/fr/hu/it/jp/nl/pl/ru/sr/tr) \[en\]:en Select your language. **What kind of installation do you want? (server, agent, local, hybrid or help)** Server *server: To install only OSSEC server.* *agent: To install only OSSEC agent.* *local: To monitor the server it has been installed on.* *hybrid: To install OSSEC server & agent on same system.* *help: To get help related to installation.* **Setting up the installation environment** Choose where to install the OSSEC HIDS \[/var/ossec\]: Location to install OSSEC. **Configuring the OSSEC HIDS** (1) Do you want e-mail notification? (y/n) \[y\]: y What's your e-mail address? (2) What's your SMTP server ip/host? (3) Do you want to run the integrity check daemon? (y/n) \[y\]: y (4) Do you want to run the rootkit detection engine? (y/n) \[y\]: y (5) Do you want to enable active response? (y/n) \[y\]: y (6) Do you want to enable the firewall-drop response? (y/n) \[y\]: y (7) Default white list for the active response: (8) Do you want to add more IPs to the white list? (y/n)? \[n\]: n (9) Do you want to enable remote syslog (port 514 udp)? (y/n) \[y\]: y **Installing the system** - To manage OSSEC service. **/var/ossec/bin/ossec-control start** **/var/ossec/bin/ossec-control stop** **/var/ossec/bin/ossec-control restart** **/var/ossec/bin/ossec-control status** - Add OSSEC agent on OSSEC server. **Perform following steps on OSSEC server:** Execute below command to manage OSSEC agent **/var/ossec/bin/manage\_agents** (A)dd an agent (A). \* A name for the new agent: OSSEC\_Agent\_1 \* The IP Address of the new agent: \* An ID for the new agent \[001\]: \* Agent information: ID: 001 Name: OSSEC\_Agent\_1 IP Address: Confirm adding it?(y/n):y (E)xtract key for an agent (E). \* Provide the ID of the agent to extract the key (or '\\q' to quit): 001 \* Copy extracted key then quit. (L)ist already added agents (L). \* To list out added agents. (R)emove an agent (R). \* Provide the ID of the agent to be removed (or '\\q' to quit): 001 \* Confirm deleting it?(y/n):y (Q)uit. Restart OSSEC service after you add agent. **2. Configure OSSEC Agent** a) Perform Step a to Step e from OSSEC Server configuration to install OSSEC agent. b) Run install.sh to install OSSEC. **sh install.sh** **You will get prompt to answer some questions.** (en/br/cn/de/el/es/fr/hu/it/jp/nl/pl/ru/sr/tr) \[en\]:en Select your language. **What kind of installation do you want? (server, agent, local, hybrid or help)** agent **Setting up the installation environment.** Choose where to install the OSSEC HIDS \[/var/ossec\]: Location to install OSSEC. **Configuring the OSSEC HIDS.** (1) What's the IP Address or hostname of the OSSEC HIDS server?: (2) Do you want to run the integrity check daemon? (y/n) \[y\]: y (3) Do you want to run the rootkit detection engine? (y/n) \[y\]: y (4) Do you want to enable active response? (y/n) \[y\]: y (5) Setting the configuration to analyze the following logs: Press Enter **Installing the system** c) Add OSSEC agent to OSSEC server. **Perform following steps on OSSEC agent.** **i) /var/ossec/bin/manage\_agents** (I)mport key from the server (I). \* Paste it here (or '\\q' to quit): Paste extracted OSSEC agent key \* Agent information: ID: 001 Name: OSSEC\_Agent\_1 IP Address: Confirm adding it?(y/n):y (Q)uit. d) To start OSSEC service. **/var/ossec/bin/ossec-control start** **3. Centralized Agent Configuration** Sometimes you will get below error while starting OSSEC service on agent. *"ossec-syscheckd (1226): ERROR: Error reading XML file '/var/ossec/etc/shared/agent.conf': XMLERR: File '/var/ossec/etc/shared/agent.conf' not found."* “/var/ossec/etc/shared/agent.conf” file holds the configuration for agents. With this file configured you can manage all agents centrally i.e. from OSSEC server itself. First, create “/var/ossec/etc/shared/agent.conf” file on OSSEC server with required configuration. This file will get sync on agent at same location with same name when you restart the OSSEC service on agent. The configuration in this file is same as “/var/ossec/etc/ossec.conf” but you can create more specific configuration as per agent name, OS etc as follows. ** ** */var/log/maillog* *syslog* ** ** ** ** */var/log/\** *syslog* ** ** **4. Configure OSSEC agent on Windows OS** a) Download Windows OSSEC agent setup from below URL & Install it. [http://www.ossec.net/downloads.html](http://www.ossec.net/downloads.html) b) Insert OSSEC Server IP & extracted key of OSSEC agent in OSSEC Agent Manager. ![c2](https://blog.e-zest.com/hs-fs/hubfs/c2.png?width=275&name=c2.png) c) Restart OSSEC agent from OSSEC Agent Manager ![c3](https://blog.e-zest.com/hs-fs/hubfs/c3.png?width=260&name=c3.png) **5. Automatically add new OSSEC agents to OSSEC server** OSSEC agent and server authenticate & communicate using authentication keys in a secure manner. Each agent share a key-pair with the server. However, here is one problem, if you have a hundred agents you need a hundred keys. To eliminate this time consuming process you can add new daemon on the server, called ossec-authd. With ossec-authd, you can create centralized key authentication. By default, ossec-authd listen on port 1515. First, you need to create the certificate & private key for SSL. - **Perform below steps on OSSEC server** i. To install SSL development tool **apt-get install libssl-dev** To install SSL package on Debian based systems. **yum install openssl-devel** To install SSL package on RHEL based systems. ii) To generate SSL key **openssl genrsa -out /var/ossec/etc/sslmanager.key 2048** SSL key will get stored in “/var/ossec/etc/sslmanager.key” iii) To generate SSL certificate **openssl req -new -x509 -key /var/ossec/etc/sslmanager.key -out /var/ossec/etc/sslmanager.cert -days 365** You will get prompt to answer some questions. Leave answer field blank it will take default value. If you enter '.', the field will be left blank. *Country Name (2 letter code) \[AU\]:* *State or Province Name (full name) \[Some-State\]:* *Locality Name (eg, city) \[\]:* *Organization Name (eg, company) \[Internet Widgits Pty Ltd\]:* *Organizational Unit Name (eg, section) \[\]:* *Common Name (e.g. server FQDN or YOUR name) \[\]:* *Email Address \[\]:* SSL certificate will get stored in ‘’/var/ossec/etc/sslmanager.cert’’ iv) To start ossec-authd **/var/ossec/bin/ossec-authd -p 1515 >/dev/null 2>&1 &** v) To restart OSSEC service. **/var/ossec/bin/ossec-control restart** - **Perform below steps on OSSEC agent** i. To add agent automatically first you need to install and configure OSSEC agent. You can install & configure OSSEC agent without interacting with install.sh. For that, you need to modify "**ossec-hids-2.9.3/etc/preloaded-vars.conf.example**" file present in OSSEC package. First, rename the file as "**ossec-hids-2.9.3/etc/preloaded-vars.conf**" and make required changes. Therefore, install script (install.sh) can collect the answers to its questions. ii. To complete authentication process on agent. **/var/ossec/bin/agent-auth -m -A -p 1515** *INFO: Connected to :1515* *INFO: Using agent name as: * *INFO: Send request to manager. Waiting for reply.* *INFO: Received response with agent key* *INFO: Valid key created. Finished.* *INFO: Connection closed.* iii. To restart OSSEC service. **/var/ossec/bin/ossec-control restart** - Sometimes you will face below error while configuring authentication key. In this case, just try with different version of OSSEC. *“ERROR: Not compiled. Missing OpenSSL Support'”* - Do not use underscore (\_) in Agent name parameter. **6. How OSSEC Agent/Server Works:** OSSEC agents communicate with OSSEC server on 1514/UDP in secure mode. OSSEC agents are “passive” one; they do not run rules, they just send logs to the OSSEC server, and receives active-response instructions from the server. OSSEC server gathers everything and triggers rules, alerts and active-response. **7. Below are some important files of OSSEC** a) **/var/ossec/etc** OSSEC configuration files. Mainly i. **ossec.conf** - Main configuration file The ossec.conf has 6 sections: **global (global);** You can manage SMTP server, email settings like alert recipient & sender here. In addition, you can white list some host/IP here. By default, OSSEC sends 12 emails alerts per hour. You can increase or decrease that no between 1 and 9999. ** *yes* *Alert\_Recipient\_Mail\_ID* *SMTP\_Server\_IP* *Sender\_Mail\_ID* *N* *127.0.0.1* ** **rules (rules);** You can specify rule files to load. Therefore, OSSEC can perform as per those rules. ** *rules\_config.xml* ** *pam\_rules.xml* ** When you need to write your own rules, then you need to modify the “/var/ossec/rules/local\_rules.xml”. **syscheck (syscheck/rootcheck);** You can manage files, which should be check and ignore by OSSEC here. In addition, you can change system check frequency also. You can enable real time monitoring. ** ** *79200* ** */etc,/usr/bin,/usr/sbin* */bin,/sbin* ** */etc,/usr/bin* */root,/var/www* ** ** ** */etc/mtab* */etc/mnttab* ** *C:\\WINDOWS/System32/LogFiles* *C:\\WINDOWS/Debug* ** Also rootcheck files configured by default here. ** */var/ossec/etc/shared/rootkit\_files.txt* */var/ossec/etc/shared/rootkit\_trojans.txt* */var/ossec/etc/shared/cis\_rhel5\_linux\_rcl.txt* ** **alerts (alert);** **log\_alert\_level:** Level at which alert is stored (in log/alerts/alerts.log) **email\_alert\_level:** Level at which alert are sent by email ** *1* *7* ** Even with a specific level set in email\_alert\_level, you will received some alerts that are below this threshold. Because some rules are configured to be sent, whatever the level is **active-response (command/active-response);** You can configure active-response here as per your need. ** ** ** *host-deny* *local* *6* *600* ** **collector (localfile)** You can manage all files monitored by OSSEC. You can add specific files you want monitor. You can add regular expression to monitor files as per your need. ** ** *syslog* */var/log/messages* ** ** *syslog* */var/log/secure* ** **ii. decoder.xml & local\_decoder.xml** – Decoder log parsing regular expressions **iii. /var/ossec/logs** All OSSEC logs are available here **ossec.log** – Output of OSSEC itself **/alerts/alerts.log** – This file contains all alerts generated by OSSEC **iv. /var/ossec/rules** This directory contains all regular expressions used to generate alerts. You can change behaviour of OSSEC by modifying rules under this directory. **8. OSSEC Daemons:** a) Analysisd – Does all the analysis (main process) b) Remoted – Receives logs from agents c) Logcollector – Reads log files d) Agentd – Sends logs to the server e) Maild – Sends alerts through e-mails f) Execd – Executes the active responses g) Monitord – Monitors agent status, signs and compresses log files, etc h) Syscheckd - Checks configured files for changes to the permissions, checksums and ownership **9. OSSEC alert levels:** OSSEC alerts are classified in multiple levels. From the lowest (00) to the maximum level 16. Levels 1 is not in use right now. Each rule is configured with an alert level. In addition, when a rule is triggered, depending on its level, it is sent (or not) by email. Below is the description of each level: ![11-3](https://blog.e-zest.com/hs-fs/hubfs/11-3.png?width=566&name=11-3.png)As per alert level, you get to know that alert is critical or not. However, alert message should be the deciding factor. This is how you can install and configure OSSEC-HIDS on Amazon EC2 Instance. - - - ### Similar Blog ## Helping Organizations Thrive in the Digital Age [Contact Us](https://www.e-zest.com/contact-us) - [About](https://www.e-zest.com/about-us) - [Services](https://www.e-zest.com/our-services) - [Work](https://www.e-zest.com/our-work) - [Insights](https://blog.e-zest.com/) - [Healthcare](https://healthcare.e-zest.com/) - [Accion Labs](https://www.accionlabs.com/) - - - - - - Dallas - Detroit - Hannover - Vienna - London - Pune © 2025 e-Zest Solutions - [Privacy Policy](https://www.e-zest.com/privacypolicy) - [Cookie Policy](https://www.e-zest.com/cookie-policy) Contact us Contact us e-Zest is a leading digital innovation partner for enterprises and technology companies that utilizes emerging technologies for creating engaging customers experiences. Being a customer-focused and technology-driven company, it always helps clients in crafting holistic business value for their software development efforts. It offers software development and consulting services for cloud computing, enterprise mobility, big data and analytics, user experience and digital commerce. ![](https://dc.ads.linkedin.com/collect/?pid=322361&fmt=gif)