After reading the DigitalOcean's documentation on OSSEC, I decided to install OSSEC
on a Ubuntu server 16.04: it is open source and has a good reputation.
The above documentation is a bit outdated, though, three years old, so I wonder if it is still valid.
However, my main concern is whether to install OSSEC
compiling from source or to take advantage of the available Debian packages from the download page. This is also a question asked by a user at the bottom of the DigitaOcean's tutorial: "Are there reasons for compiling from source rather than using the DEB packages OSSEC provides for Ubuntu?".
I would always prefer installing packages, nevertheless the last August someone at GitHub opened an issue on the deb packages, which is still open.
Also I noticed that the OSSEC version of the packages corresponds to the OSSEC's development version 2.9.2, while the source is version 2.9.1.
Lastly, deb packages are divided in two types: server
and agent
, and I would like to choose the local
kind of installation: which one gives me this choice?
I suppose that installing from packages would not require to install build-essential
and inotify-tools
and all dependencies are satisfied.
All the tutorials I was able to find on how to install OSSEC
on Ubuntu, even a recent one, instruct to install from source.
wazuh-agent
&wazuh-server
. I'm still testing it out, ... would recommend you give it a look.