Upgrade OSSEC version

[conorsch]

Feature request

Description

Upgrade OSSEC to the latest stable version, currently 2.9.2 (the servers currently run 2.8.2). As of #1668 we have the OSSEC build logic integrated in this repository, so we can make changes to the OSSEC version in line with the standard release process.

We also need to resolve #1756 as part of the upgrade.

User Stories

As an Admin for SecureDrop, I want my alerts to be informative and actionable, and as bug-free as possible.

As a developer for SecureDrop, I want to use the latest tooling available to provide a reliable and secure monitoring story for Admins.

[ageis]

I'd also like to suggest what I believe is a slight improvement here, concerning Syscheck settings in /var/ossec/etc/internal_options.conf:

# Syscheck checking/usage speed. To avoid large cpu/memory
# usage, you can specify how much to sleep after generating
# the checksum of X files. The default is to sleep 2 seconds
# after reading 15 files.
syscheck.sleep=2
syscheck.sleep_after=15

^ These defaults are pretty slow and basically means that take Syscheck will take a while to complete depending how many files are on the system. Something like sleeping for 1 second after every 64 or 128 files seems more sane to me especially since we are not very resource-constrained.

[emkll]

As of this comment, the latest version is now 2.9.3. The 2.9.x family currently has issues with ipv4 only hosts (see ossec/ossec-hids#917). A fix has been merged (see ossec/ossec-hids#1259) but not included in the 2.9.3 release (per https://github.com/ossec/ossec-hids/blob/v2.9.3/src/os_net/os_net.c#L70).

As expected, authd fails to bind to port when the host is running in ipv4-only:

root@mon-staging:/var/ossec# ./bin/ossec-authd -d -i 10.0.1.2
2018/01/24 17:27:48 ossec-authd: DEBUG: Starting ...
2018/01/24 17:27:48 ossec-authd: INFO: Started (pid: 5341).
2018/01/24 17:27:48 ossec-authd: DEBUG: Returning CTX for server.
2018/01/24 17:27:48 getaddrinfo: Name or service not known
2018/01/24 17:27:48 ossec-authd: Unable to bind to port 1515

Since there are no CVEs associated with the version we are running, I suggest we wait for the next release.

[emkll]

It seems like the bug described above appears to be fixed in 2.9.4 released last week. We should consider upgrading these packages in the next SecureDrop release.

[redshiftzero]

Thanks for checking on this @emkll, added to 0.9 milestone

[redshiftzero]

Closing this in favor of #3701, which we should try to do in 0.9.0