ossec (31) Versions 3.0.0 Follow21

Provides custom resources for managing OSSEC HIDS packages and configuration

Policyfile

Berkshelf

Knife

cookbook 'ossec', '~> 3.0.0', :supermarket

cookbook 'ossec', '~> 3.0.0'

knife supermarket install ossec

knife supermarket download ossec

README

Dependencies

Changelog

Quality 50%

ossec cookbook

This cookbook provides custom resources for installing and configuring OSSEC
HIDS from the Atomicorp package archives used by the legacy cookbook.

The package path is constrained by upstream and vendor archive support. Read
[LIMITATIONS.md](LIMITATIONS.md) before expanding platform coverage.

Maintainers

This cookbook is maintained by the Sous Chefs. See
sous-chefs.org.

Requirements

Chef

Chef Infra Client 15.3+

Supported platforms

Amazon Linux 2023
Debian 12 / 13
Rocky Linux 9
Ubuntu 22.04 / 24.04

The actual package archive is broader than this list, but the cookbook only
declares currently-supported platforms that align with the documented vendor
support and the maintained Kitchen matrix.

Resources

[ossec_repository](documentation/ossec_repository.md)
[ossec_install](documentation/ossec_install.md)
[ossec_config](documentation/ossec_config.md)
[ossec_local](documentation/ossec_local.md)
[ossec_client](documentation/ossec_client.md)
[ossec_server](documentation/ossec_server.md)
[ossec_authd](documentation/ossec_authd.md)
[ossec_agent_auth](documentation/ossec_agent_auth.md)

Data bag

Server and client key distribution uses a data bag item that defaults to
ossec/ssh.

{
  "id": "ssh",
  "pubkey": "ssh-ed25519 AAAA...",
  "privkey": "-----BEGIN OPENSSH PRIVATE KEY-----\n..."
}

If you use encrypted data bags, set encrypted_data_bag true on the resource.

Usage

Local manager

ossec_local 'default'

Agent

ossec_client 'default' do
  agent_server_ip '192.0.2.10'
end

Server

ossec_server 'default'

authd

ossec_authd 'default' do
  certificate '/var/ossec/etc/sslmanager.cert'
  key '/var/ossec/etc/sslmanager.key'
end

agent-auth registration

ossec_agent_auth 'default' do
  agent_server_ip '192.0.2.10'
end

Configuration

ossec_config, ossec_local, ossec_client, ossec_server, ossec_authd,
and ossec_agent_auth all accept an ossec_conf hash that is rendered to
/var/ossec/etc/ossec.conf via Gyoku.

For server workflows, agent_conf is written to
/var/ossec/etc/shared/agent.conf.

Example:

ossec_server 'default' do
  ossec_conf(
    'global' => {
      'email_notification' => true,
      'email_to' => 'ossec@example.com',
      'smtp_server' => 'smtp.example.com'
    }
  )
  agent_conf(
    [
      {
        'syscheck' => { 'frequency' => 4321 },
        'rootcheck' => { 'disabled' => true }
      }
    ]
  )
end

Testing

berks install
cookstyle
chef exec rspec --format documentation
KITCHEN_LOCAL_YAML=kitchen.dokken.yml kitchen test default-ubuntu-2404 --destroy=always

Dependent cookbooks

This cookbook has no specified dependencies.

Contingent cookbooks

There are no cookbooks that are contingent upon this one.

Changelog

Standardise files with files in sous-chefs/repo-management
Standardise files with files in sous-chefs/repo-management

Unreleased

Convert the cookbook to a full custom-resource layout under resources/
Remove legacy recipes/ and attributes/ content
Modernize supported platforms and align Kitchen and CI with the current matrix
Add LIMITATIONS.md, resource documentation, test cookbook recipes, and resource-focused ChefSpec/InSpec coverage

3.0.0 (2026-04-20)

⚠ BREAKING CHANGES

Migrate to Custom Resources and remove recipes (#194)

Features

Migrate to Custom Resources and remove recipes (#194) (d58551d)

Bug Fixes

ci: Update workflows to use release pipeline (#188) (1cc004a)
repair release workflow validation (#195) (fb09242)

2.0.18 (2025-10-16)

Bug Fixes

ci: Update workflows to use release pipeline (#188) (1cc004a)