{"id":1944,"date":"2026-10-23T21:13:49","date_gmt":"2026-10-23T21:13:49","guid":{"rendered":"http:\/\/blog.webhost.pro\/?p=1944"},"modified":"2026-10-23T21:21:32","modified_gmt":"2026-10-23T21:21:32","slug":"how-to-install-ossec","status":"publish","type":"post","link":"https:\/\/webhostpro.com\/blog\/how-to-install-ossec\/","title":{"rendered":"How to install OSSEC"},"content":{"rendered":"\n<div class=\"wp-block-group ai-summarization-summary\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"wp-block-paragraph\">This guide covers installing OSSEC 4.4.1 as a standalone host-based intrusion detection system on Ubuntu 24.04. It explains installing dependencies, verifying the release signature, running the installer, starting the service, and configuring file integrity monitoring and rootkit detection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It also covers SMTP alert delivery, real-time monitoring limitations, safe testing, troubleshooting, and configuration practices that reduce alert noise and protect sensitive data. Regular alert review, software updates, backups, access controls, and firewall maintenance remain important.<\/p>\n<\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">How to Install OSSEC on Ubuntu 24.04<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">OSSEC is an open-source host-based intrusion detection system that helps you monitor security events, investigate suspicious activity, and detect changes to important files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide covers a standalone installation on an Ubuntu 24.04 server, including file monitoring, alerts, and basic troubleshooting.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What does OSSEC monitor?<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Changes to monitored files and directories.<\/li>\n\n\n\n<li>Security events in configured system and application logs.<\/li>\n\n\n\n<li>Indicators of rootkits and suspicious system configurations.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">An alert is a reason to investigate, not proof of a compromise. Software updates, deployments, and routine administration also change files.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Before you begin<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An Ubuntu 24.04 server with SSH access.<\/li>\n\n\n\n<li>A user with sudo privileges.<\/li>\n\n\n\n<li>A recent backup or server snapshot.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These commands are for Ubuntu. AlmaLinux and other distributions use different package names and installation commands.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If OSSEC or Wazuh is already installed, review its upgrade instructions before continuing. Do not install a second monitoring system over an existing installation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Install the build dependencies<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt install build-essential zlib1g-dev libpcre2-dev libevent-dev libssl-dev libcurl4-openssl-dev libmagic-dev libsystemd-dev curl ca-certificates gnupg<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">2. Download and verify OSSEC<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Download the current stable Unix release and its matching GPG signature from the <a href=\"https:\/\/www.ossec.net\/download-ossec\/\">official OSSEC download page<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the time of this update, the release is OSSEC 4.4.1. Check the official page before installing, as newer releases may be available.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Work in a dedicated directory:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir -p ~\/ossec-install\ncd ~\/ossec-install<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Place the release archive and matching signature in this directory. Import the official signing key:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -fLO https:\/\/www.ossec.net\/files\/OSSEC-ARCHIVE-KEY.asc\ngpg --import OSSEC-ARCHIVE-KEY.asc\ngpg --fingerprint EE1B0E6B2D8387B7<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Compare the fingerprint with the one published in the official installation documentation:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>B50F B194 7A0A E311 45D0 5FAD EE1B 0E6B 2D83 87B7<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For the 4.4.1 release, verify the archive with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>gpg --verify ossec-hids-4.4.1.tar.gz.asc ossec-hids-4.4.1.tar.gz<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Continue only after the signature verifies successfully. Adjust the filenames if you downloaded a newer release.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Run the installer<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tar -xzf ossec-hids-4.4.1.tar.gz\ncd ossec-hids-4.4.1\nsudo .\/install.sh<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For monitoring one server independently, choose <code>local<\/code> when asked for the installation type. Keep the default installation directory, <code>\/var\/ossec<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enable file integrity monitoring and rootcheck. Leave active response disabled during initial setup so you can review alerts before allowing automated blocking.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you enable email notifications, enter your own delivery settings. Keep SMTP passwords out of tutorials, screenshots, and support messages.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Start OSSEC<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo \/var\/ossec\/bin\/ossec-control start\nsudo \/var\/ossec\/bin\/ossec-control status<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check for startup errors:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tail -n 50 \/var\/ossec\/logs\/ossec.log<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm that your installation starts automatically after a reboot. Startup integration depends on the installation method and operating system.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Configure file integrity monitoring<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Back up the configuration before editing it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp -a \/var\/ossec\/etc\/ossec.conf \/var\/ossec\/etc\/ossec.conf.bak\nsudo nano \/var\/ossec\/etc\/ossec.conf<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Find the existing <code>&lt;syscheck&gt;<\/code> section. Merge the following settings into it, preserving other options you need and avoiding duplicate directory entries:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;syscheck&gt;\n  &lt;frequency&gt;3600&lt;\/frequency&gt;\n  &lt;alert_new_files&gt;yes&lt;\/alert_new_files&gt;\n\n  &lt;directories check_all=\"yes\" realtime=\"yes\"&gt;\/etc&lt;\/directories&gt;\n  &lt;directories check_all=\"yes\"&gt;\/usr\/bin,\/usr\/sbin&lt;\/directories&gt;\n&lt;\/syscheck&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This example schedules a full scan every hour and enables near-real-time monitoring for existing file content changes under <code>\/etc<\/code>. Adjust the scan interval to suit your server&#8217;s size and workload.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To monitor website files, add an entry for your actual document root:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;directories check_all=\"yes\" realtime=\"yes\"&gt;\/var\/www\/example.com\/public&lt;\/directories&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Exclude busy cache, session, and temporary directories where appropriate. Monitoring constantly changing files creates noise and makes useful alerts harder to spot.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Leave <code>report_changes<\/code> disabled for directories containing passwords, API keys, or other secrets. Enabling it can retain copies of file contents and include sensitive changes in alerts.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6. Understand real-time monitoring limits<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Real-time monitoring begins after the initial scan establishes a baseline. It does not make every check instantaneous.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">New-file alerts require a scheduled scan, and permission or ownership changes may also wait for that scan. Do not assume every event will generate an immediate notification.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">7. Configure email delivery<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">OSSEC 4.1 and later support authenticated SMTP and TLS when built with the required libcurl support. Use the current <a href=\"https:\/\/www.ossec.net\/docs\/docs\/manual\/output\/alerts-smtp.html\">OSSEC documentation<\/a> to locate the SMTP configuration instructions for your release.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can also deliver alerts through a properly configured local mail relay. Do not assume that setting the SMTP hostname alone is enough for an external email provider.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Test delivery separately from event detection. An alert appearing in the local log does not prove that an email reached your inbox.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">8. Test monitoring safely<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Create a dedicated test file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>printf 'OSSEC monitoring test\\n' | sudo tee \/etc\/ossec-monitoring-test.txt<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Allow a scheduled scan to discover it, then change its contents:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>printf 'OSSEC monitoring test changed\\n' | sudo tee -a \/etc\/ossec-monitoring-test.txt<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Review the alerts:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tail -n 100 \/var\/ossec\/logs\/alerts\/alerts.log<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Remove the test file when finished:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo rm \/etc\/ossec-monitoring-test.txt<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Check <code>\/var\/ossec\/logs\/ossec.log<\/code> for startup, configuration, and delivery errors.<\/li>\n\n\n\n<li>Confirm that monitored directories exist and match your server&#8217;s actual paths.<\/li>\n\n\n\n<li>Allow the initial scan to finish before testing real-time changes.<\/li>\n\n\n\n<li>Review alert thresholds if events appear locally but do not generate email.<\/li>\n\n\n\n<li>Restart OSSEC after configuration changes and check its status again.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/webhostpro.com\/blog\/wp-content\/uploads\/2026\/10\/DDOS.webp\"><img loading=\"lazy\" decoding=\"async\" width=\"1170\" height=\"694\" src=\"https:\/\/webhostpro.com\/blog\/wp-content\/uploads\/2026\/10\/DDOS-1170x694.webp\" alt=\"\" class=\"wp-image-5763\" style=\"aspect-ratio:1.8338471012527633\" srcset=\"https:\/\/webhostpro.com\/blog\/wp-content\/uploads\/2026\/10\/DDOS-1170x694.webp 1170w, https:\/\/webhostpro.com\/blog\/wp-content\/uploads\/2026\/10\/DDOS-768x456.webp 768w\" sizes=\"auto, (max-width: 1170px) 100vw, 1170px\" \/><\/a><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo \/var\/ossec\/bin\/ossec-control restart\nsudo \/var\/ossec\/bin\/ossec-control status<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Keep monitoring useful<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Review alerts regularly, tune noisy rules, and keep OSSEC updated. File monitoring works best alongside tested backups, timely software updates, restricted administrative access, and a maintained firewall.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For current releases and configuration details, visit the <a href=\"https:\/\/www.ossec.net\/docs\/\">official OSSEC documentation<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This guide covers installing OSSEC 4.4.1 as a standalone host-based intrusion detection system on Ubuntu 24.04. It explains installing dependencies, verifying the release signature, running the installer, starting the service, and configuring&hellip;<\/p>\n","protected":false},"author":1,"featured_media":5759,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"wpai_generated_summary":"This guide covers installing OSSEC 4.4.1 as a standalone host-based intrusion detection system on Ubuntu 24.04. It explains installing dependencies, verifying the release signature, running the installer, starting the service, and configuring file integrity monitoring and rootkit detection.\n\nIt also covers SMTP alert delivery, real-time monitoring limitations, safe testing, troubleshooting, and configuration practices that reduce alert noise and protect sensitive data. Regular alert review, software updates, backups, access controls, and firewall maintenance remain important.","wpai_meta_description":"Secure an Ubuntu 24.04 server with OSSEC 4.4.1 using verified downloads, file integrity monitoring, rootkit detection, SMTP alerts, and safe tests.","footnotes":""},"categories":[8,6,10],"tags":[92,128,768,1970,1995,327,750,767,769,616,906,628,654,657,696],"class_list":["post-1944","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server-tips","category-website-news","category-website-tips","tag-business-2","tag-cpanel","tag-how-to","tag-hudsonhost","tag-hudsonpanel","tag-install","tag-manage","tag-ossec","tag-server-security","tag-vps","tag-web-host","tag-web-hosting","tag-website","tag-website-builder","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/webhostpro.com\/blog\/wp-json\/wp\/v2\/posts\/1944","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webhostpro.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webhostpro.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webhostpro.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webhostpro.com\/blog\/wp-json\/wp\/v2\/comments?post=1944"}],"version-history":[{"count":3,"href":"https:\/\/webhostpro.com\/blog\/wp-json\/wp\/v2\/posts\/1944\/revisions"}],"predecessor-version":[{"id":5764,"href":"https:\/\/webhostpro.com\/blog\/wp-json\/wp\/v2\/posts\/1944\/revisions\/5764"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webhostpro.com\/blog\/wp-json\/wp\/v2\/media\/5759"}],"wp:attachment":[{"href":"https:\/\/webhostpro.com\/blog\/wp-json\/wp\/v2\/media?parent=1944"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webhostpro.com\/blog\/wp-json\/wp\/v2\/categories?post=1944"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webhostpro.com\/blog\/wp-json\/wp\/v2\/tags?post=1944"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}