/PLAYBOOK · 2026-08-23

OSSEC HIDS Deployment: Open-Source Host IDS Config Guide

Hands-on OSSEC HIDS: install and init, Agent enrollment, rule alerts, file integrity monitoring, and log analysis. Full commands and config samples for a lightweight host intrusion detection stack.

Applicable Scenarios

OSSEC HIDS fits mid-size server fleets that need lightweight host intrusion detection. OSSEC is an open-source HIDS: log analysis, file integrity monitoring, rootkit detection, and active response on Linux and Windows. Typical uses: compliance file-change audit, SSH brute-force and anomalous login detection, centralized security logs from many hosts, baseline monitoring without a commercial EDR budget.

Prerequisites

Server host (2C4G minimum), OS CentOS 7+ / Ubuntu 18.04+
Agent hosts reachable from the Server
Server firewall allows UDP/TCP 1514 (Agent comms) and 1515 (registration)
Root on all hosts

How It Works

Classic C/S: Agent collects local logs, runs FIM and rootkit checks, ships events over an encrypted channel to Server. Server Analysisd matches events against rules; hits emit alerts to local logs, mail, or active-response scripts. Rule engine is XML. Thousands of default rules; custom rules supported.

Procedure

Step 1: Install OSSEC Server

`# install deps (CentOS)
yum install -y gcc make libevent-devel zlib-devel openssl-devel pcre2-devel

# download source (3.7.0 example)
cd /opt
curl -L -o ossec-hids-3.7.0.tar.gz https://github.com/ossec/ossec-hids/archive/refs/tags/v3.7.0.tar.gz
tar xzf ossec-hids-3.7.0.tar.gz
cd ossec-hids-3.7.0

# run installer; choose server
./install.sh
# language zh/en; install type server; accept remaining defaults`

Step 2: Init and start

`# register service and start
/var/ossec/bin/ossec-control start
systemctl enable ossec 2>/dev/null || true

# verify processes
/var/ossec/bin/ossec-control status
# expected: ossec-monitord / ossec-logcollector / ossec-remoted / ossec-syscheckd / ossec-analysisd / ossec-maild all running`

Step 3: Add Agent clients

`# register Agent on Server (interactive name, IP)
/var/ossec/bin/manage_agents

# A (add) -> Agent name and IP -> confirm
# then E (extract) the new Agent; copy the generated key

# on the monitored host install Agent (install.sh, type agent)
# after install, import key
/var/ossec/bin/manage_agents
# I (import) paste Server-exported key, then R restart

# Agent connects to Server
/var/ossec/bin/ossec-control start`

Step 4: Verify Agent online

`# Server: list connected Agents
/var/ossec/bin/agent_control -l
# expected: new Agent listed; Last keep alive keeps updating

# on Agent, generate a test log (e.g. failed SSH login)
tail -f /var/ossec/logs/ossec.log`

Step 5: File integrity monitoring

Edit Server /var/ossec/etc/ossec.conf, add watched dirs under syscheck:

`<syscheck>
  <directories check_all="yes">/etc,/usr/bin,/usr/sbin,/root/bin</directories>
  <directories check_all="yes" real_time="yes">/var/www/html</directories>
  <frequency>43200</frequency>
</syscheck>`

`# restart to apply
/var/ossec/bin/ossec-control restart`

Config Verification

`# alert log: confirm syscheck baseline built
grep -i "syscheck" /var/ossec/logs/ossec-alerts.log | tail -20

# modify a watched file to fire an alert
echo "test" >> /etc/hosts
sleep 30
grep -i "modified" /var/ossec/logs/ossec-alerts.log | tail -5
# expected: "File '.../hosts' modified"`

File-change records in the alert log mean the FIM path is live.

FAQ

FAQ 1: Agent cannot register or reach Server?

Check in order: Server firewall allows 1514/1515 (firewall-cmd --add-port=1514/udp --permanent && firewall-cmd --reload); Agent key matches Server export; Server ossec-remoted is running. On Server, tcpdump -i eth0 udp port 1514 confirms Agent heartbeats.

FAQ 2: Alert flood?

Lower log level in the alerts section of ossec.conf, or add level="0" for specific rules in /var/ossec/etc/rules/local_rules.xml (0 = no alert). Demote high-volume noise (network errors); keep high-priority alerts.

Summary

OSSEC HIDS delivers log analysis, FIM, and active response at low resource cost. Viable baseline monitoring for mid-size server fleets. After deploy, watch alert quality, tune local_rules.xml to the business, and close the loop with external SIEM or alerting.