OSSEC PGP/GPG keys

Release tarballs for OSSEC HIDS are signed with a GPG key. Use these pages for maintainer public keys and verification steps.

Verify a release tarball

  1. Download the tarball and detached .asc signature from GitHub Releases or ossec.net.

  2. Import the signing key (prefer the file from ossec.net over keyservers):

    curl -O https://www.ossec.net/files/OSSEC-ARCHIVE-KEY.asc
gpg --import OSSEC-ARCHIVE-KEY.asc

  3. Verify (replace VERSION with the release tag, for example 4.2.0):

    gpg --verify ossec-hids-VERSION.tar.gz.asc ossec-hids-VERSION.tar.gz

    A good signature shows Good signature from Scott R. Shinn <scott@atomicorp.com>. A warning that the key is not ultimately trusted is normal until you assign local trust with gpg --edit-key.

Current release signing key fingerprint:

B50F B194 7A0A E311 45D0  5FAD EE1B 0E6B 2D83 87B7

Installation instructions with verification examples are in Manager/Agent Installation. See also How do I verify the release tarball GPG signature? if gpg --recv-key fails.

Maintainer keys