Container for OSSEC HIDS log analysis server written with simplicity and security in mind.
738
Since automated builds are not available anymore, this README will not be updated automatically, but should be up-to-date. This also means that the Github repository is no longer displayed as the source. Images are now pushed using GitLab CI so the build process logs are available there. The images are also available on GitLab so definitely use those especially if we start hitting the new Docker Hub limits.
registry.gitlab.com/kalaksi-containers/ossec-log-server)docker.io/kalaksi/ossec-log-server)This container is for running OSSEC HIDS log analysis server and optionally sending alerts via email. It accepts syslog-formatted logs. One use case is a centralized log archiving and analysis server for your containers. I currently use this container and Logspout to achieve this.
Simply put, this container has been written with simplicity and security in mind.
Many community containers run unnecessarily with root privileges by default and don't provide help for dropping unneeded CAPabilities either. Additionally, overly complex shell scripts and unofficial base images make it harder to verify the source and keep everything up-to-date.
To remedy the situation, these images have been written with security, simplicity and overall quality in mind.
| Requirement | Status | Details |
|---|---|---|
| Don't run as root | ❌ | Difficult to get around. Currently ossec-control drops the privileges. |
| Transparent build process | ✅ | For verifying that the container matches the code. See GitLab CI. |
| Official base image | ✅ | |
| Drop extra CAPabilities | ❌ | TODO: test what can be dropped |
| No default passwords | ✅ | No static default passwords. That would make the container insecure by default. |
| Support secrets-files | ✅ | Support providing e.g. passwords via files instead of environment variables. |
| Handle signals properly | ✅ | |
| Simple Dockerfile | ✅ | No overextending the container's responsibilities. Keep everything in the Dockerfile if reasonable. |
| Versioned tags | ✅ | Offer versioned tags for stability. |
See the Tags tab on Docker Hub for specifics. Basically you have:
latest tag that always has the latest changes.1.1 which would follow branch 1.1.x on GitHub.See Dockerfile and docker-compose.yml (https://github.com/kalaksi/docker-ossec-log-server) for usable environment variables. Variables that are left empty will use default values.
As OSSEC gets upgraded to a more recent version (and the version tag changes), your will face the common issue of configurations getting outdated.
In that case, you can try to resolve the configuration issues yourself and update the configuration OR move aside both etc and rules directories on your data-volume so that OSSEC will then create a new default configuration. After that, you can bring over any manual changes you might have done.
ossec-contol and run the necessary processes directly. Helps running things as non-root and for detecting crashes.See the repository on https://github.com/kalaksi/docker-ossec-log-server. All kinds of contributions are welcome!
Copyright (c) 2018 [email protected]. See LICENSE for license information.
As with all Docker images, the built image likely also contains other software which may be under other licenses (such as software from the base distribution, along with any direct or indirect dependencies of the primary software being contained).
As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.
Content type
Image
Digest
sha256:1e3dc0754…
Size
32.5 MB
Last updated
over 3 years ago
docker pull kalaksi/ossec-log-server