[ossec-dev] A few feature requests

[Jeff Schroeder <jeffschroed@xxxxxxxxx>]

Currently, the agent name is only allowed to be lowercase
alphanumeric. Why?

1.) ids1.sys.dev1.coresys.tmcs (internal dns) seems like a perfectly
valid agent name to me, and worked with 1.2 (even though it
complained) yet doesn't work in 1.3 beta.

2.) We would like to monitor by hostnames and not IP address.
gethostbyaddr() isn't difficult. Can you add that on hosts that
support it (ie anything posix based)?

3.) Some way to script the key creation / export / import process. If
ossec works out, my team manages several hundred (more than 900)
servers. Expect would work, but is a hack. If you want to be taken
serious as an "enterprise" ids, batch operations should be though
about.

Something like this would be perfect and unix-y:
ssh ossec-server '/var/ossec/bin/export_key --id 002' > 002.key
cat 002.key | ssh ossec-client-002 '/var/ossec/bin/import_key -'