LoginSign Up
← Back to all sparks
O

OSSEC

DEVOPS
Velocity3.8

Host-based intrusion detection system

www.ossec.net ↗

A 20-year-old HIDS is being re-engineered for scale and modern crypto.

hidsintrusion-detectionthreadingcryptographyfile-integritylegacy-modernization
◆Current state
OSSEC has moved through three substantial releases in six months under Atomicorp maintainership. The 4.0.0 release broke backwards compatibility by making AES the default agent transport and modernized file integrity monitoring to SHA-256; 4.2.0 followed with a multi-threaded analysisd pipeline and a self-contained Windows agent installer. The work is concentrated in a small number of hands — most PRs in these releases carry a single contributor tag.
◆Where it's heading
This is a modernization program, not feature expansion. The pattern across releases is removing decade-old constraints: single-threaded analysis, Blowfish crypto, MD5/SHA-1 integrity hashes, 2GB file limits, dependency-hunting Windows installs. Each release trades compatibility for correctness, and the project has been willing to force server-before-agent upgrade ordering to get there.
◆Prediction
Expect the threading work started in 4.2.0 to extend further into the manager daemons, and continued removal of legacy crypto paths. Whether the Blowfish fallback survives another major version is the open question the entries don't answer.

◆Recent moves

  1. 6d ago

    Multi-threaded analysisd and a self-contained Windows agent land in 4.2.0

    ⚡ SPARK

    4.2.0 makes analysisd multi-threaded by default on Linux servers and migrates manager daemons to pthreads with a shared thread pool. Against the 4.0.0 crypto overhaul, this is the second structural rewrite in six months — the project is systematically removing the architectural limits of its original design.

    View source ↗
  2. 3mo ago

    RC1 adds SMTP auth, IPv6 whitelisting, and files over 2GB

    A release candidate adding SMTP authentication and TLS to the mail daemon, IPv6 whitelisting improvements, and support for files over 2GB. The changelog is explicitly marked incomplete, and much of the listed work is build and packaging plumbing — CI actions, Rocky Linux 9 support, CentOS 7 fixes.

    View source ↗
  3. 6mo ago

    AES becomes the default agent transport in 4.0.0

    ⚡ SPARK

    4.0.0 made AES the default for agent-server communication, breaking compatibility with 3.8.0 and older servers, and moved file integrity monitoring to SHA-256. It also closed multiple heap use-after-free bugs and uncontrolled recursion in the XML parser, and replaced insecure agent key generation. This is the release that set the modernization agenda 4.2.0 continues.

    View source ↗