How to Install and Configure OSSEC on Ubuntu and Debian

This guide provides a clear, step-by-step process for installing and configuring the OSSEC Host-based Intrusion Detection System on Ubuntu and Debian servers.

OSSEC

Advanced Protection for Your Server

Ubuntu/Debian

What is OSSEC?

OSSEC is a popular, open-source Host-based Intrusion Detection System (HIDS). You can think of it as a highly intelligent security camera and alarm system built specifically for your server's operating system. It constantly watches your server from the inside, giving you real-time visibility into any security-related events or suspicious behaviors taking place.

One of the main reasons system administrators rely on OSSEC is its powerful, built-in feature set. It automatically performs deep log analysis, monitors critical files and folders for unauthorized changes (known as file integrity monitoring), and actively searches your system for hidden malware or rootkits. If a hacker tries to modify a core system file or attempts to guess a user's password, OSSEC immediately catches the anomaly and sends you an alert.

Beyond just detecting threats, OSSEC also offers an "Active Response" feature. This means it can move beyond simply warning you and actually take automated action to stop an ongoing attack. For example, if OSSEC notices someone repeatedly trying to log in with the wrong password, it can automatically update your server's firewall to block that attacker's IP address before they can do any real harm.

Prerequisites

  • A server running a supported version of Ubuntu or Debian.
  • A user account with root or sudo (administrator) privileges.
  • A stable internet connection to download the necessary packages.
  • Basic familiarity with using the Linux command line.

Step-by-Step Installation

Method 1: Installing via APT Package Manager (Recommended)

This is the easiest and most reliable way to install OSSEC. We will use the official Atomicorp repository to download pre-built packages.
1

Add the Official Repository

First, download and run the script that connects your system to the secure OSSEC package repository.
BASH 
wget -q -O - https://updates.atomicorp.com/installers/atomic | sudo bash
2

Update Your Package List

Ensure your server knows about the latest available software packages.
BASH 
sudo apt-get update
3

Install the OSSEC Software

You can install either the main server (which analyzes everything) or the agent (which sends data to the server).
To install the OSSEC Server:
BASH 
sudo apt-get install ossec-hids-server
To install the OSSEC Agent on another machine:
BASH 
sudo apt-get install ossec-hids-agent
4

Start the Service

Enable the OSSEC service so it starts automatically when your server boots up, and then start it.
Bash 
sudo systemctl enable ossec-hids
sudo systemctl start ossec-hids
sudo systemctl status ossec-hids

Method 2: Installing from Source Code (Advanced)

Use this method only if you need special configurations, such as linking OSSEC to a database.
1

Install Required Dependencies

Install the necessary tools to compile software on your system.
BASH 
sudo apt-get update
sudo apt-get install build-essential make zlib1g-dev libpcre2-dev libevent-dev libssl-dev libcurl4-openssl-dev libsystemd-dev
(Optional) If you want database support, install the database development tools:
BASH 
# For MySQL/MariaDB:
sudo apt-get install default-libmysqlclient-dev libmariadb-dev-compat

# For PostgreSQL:
sudo apt-get install libpq-dev
2

Download the Source Code

Download the latest OSSEC release (v4.2.0) and open the extracted folder.
BASH 
wget https://github.com/ossec/ossec-hids/archive/refs/tags/v4.2.0.tar.gz
tar -zxvf v4.2.0.tar.gz
cd ossec-hids-4.2.0
3

Run the Installer

Run the installation script. If you need database support, you must declare it here using an environment variable.
For a normal installation:
BASH 
sudo ./install.sh
For an installation with MySQL database support:
BASH 
sudo env DATABASE=mysql ./install.sh
4

Answer the Setup Questions

The installer will ask you a few simple questions. Just choose your language (default is en), select the installation type (like server or local), and answer "yes" to enable features like file checking, rootkit detection, and active response.
5

Start OSSEC

For source installations, use this built-in command to start the program.
BASH 
sudo /var/ossec/bin/ossec-control start

Next Steps: Connecting Agents to the Server

If you installed a Server and an Agent, you must link them together so they can share data securely.
1. On the Server: Run the key manager tool to add your new agent and generate a secure authentication key. Copy this key.
BASH 
sudo /var/ossec/bin/manage_agents
2. On the Agent: Run the exact same command on the agent machine, but choose the option to import the key you just copied.
BASH 
sudo /var/ossec/bin/manage_agents
3. Restart: Finally, restart the OSSEC service on both machines to apply the changes and start monitoring.

Final Thoughts

You have now successfully set up a powerful security monitoring system to protect your server environment.

  • Added the secure software repository or downloaded the necessary source code files.
  • Installed the OSSEC Server to collect, store, and analyze all of your security data.
  • Installed the OSSEC Agent on endpoint machines to monitor their local activities.
  • Generated and imported authentication keys to securely connect your agents to the main server.
  • Started the OSSEC service to activate file integrity monitoring and automatic threat blocking.

With OSSEC actively running in the background, your infrastructure is now continuously monitored and defended against potential cyber threats.

Explore Dedicated Servers

CTCservers Recommended Tutorials

Install-ROCm

Web, Network

Step-by-Step Guide: Install AMD ROCm on Ubuntu with RX 6600 GPU

Learn how to quickly and easily set up AMD ROCm on Ubuntu for your RX 6600 GPU, enabling powerful machine learning, AI workloads, and GPU-accelerated computing right on your system.
Install LAMP

Web, Network, Linux, Mysql, Ubuntu

LAMP Setup Guide 2026: Ubuntu & Debian | CTCservers

Install a secure LAMP stack on Debian or Ubuntu. Follow our step-by-step guide to configure Linux, Apache, MySQL, and PHP for your web server.
Deploy Phi-3

Web, Network, Ubuntu

Deploy Phi-3 with Ollama on Ubuntu GPU | CTCservers

Learn how to easily deploy the Phi-3 LLM on an Ubuntu 24.04 GPU server using Ollama and WebUI. Follow our step-by-step tutorial for seamless AI hosting.

Discover CTCservers Dedicated Server Locations

CTCservers servers are available around the world, providing diverse options for hosting websites. Each region offers unique advantages, making it easier to choose a location that best suits your specific hosting needs.