AES Encryption Support

Starting with version 4.0.0, OSSEC supports AES-256 encryption for agent-manager communications. This provides a more secure alternative to the legacy Blowfish encryption.

Key Features:

  • Algorithm: AES-256-CBC

  • Key Size: 256 bits

  • Initialization Vector (IV): Randomly generated per message

Configuration:

AES encryption is supported alongside the existing encryption methods. The specific encryption algorithm used is determined by the key format managed by the manage_agents tool.

Note

Both the OSSEC manager and agent must be running version 4.0.0 or later to support AES encryption.

Configuration Examples

By default, OSSEC 4.0.0 agents use AES encryption, and the manager accepts both AES and Blowfish. You can explicitly configure these settings in ossec.conf.

Manager Configuration (ossec.conf):

To restrict the manager to only accept AES connections:

<remote>
  <crypto_accept>aes</crypto_accept>
</remote>

Agent Configuration (ossec.conf):

To force an agent to use Blowfish (legacy mode):

<client>
  <crypto_method>blowfish</crypto_method>
</client>