.. _installation_installation-requirements:

==========================
Installations requirements
==========================

For UNIX systems, OSSEC only requires gnu make, gcc, and libc.
OpenSSL is a suggested, but optional, prerequisite. 
However, you always have the option to pre-compile
it on one system and move the binaries to the final box.

PCRE2
^^^^^

.. versionadded:: 3.3

`PCRE2 <https://www.pcre.org/>`_ support has been added to version 3.3.
The build system can either use the system's PCRE2 libraries,
or the library can be built as part of the installation process.

The default build process expects the `pcre2-10.32` source to be installed in `src/external`:

.. code-block:: console

   $ cd ossec-hids-*/src
   $ wget https://ftp.pcre.org/pub/pcre/pcre2-10.32.tar.gz
   $ tar xzf pcre2-10.32.tar.gz -C src/external

To use the system's PCRE2, set the `PCRE2_SYSTEM` variable to yes:

.. code-block:: console

   # cd ossec-hids-*
   # PCRE2_SYSTEM=yes ./install.sh

If the system's PCRE2 library is used, verify that JIT is enabled. If it is not, set `USE_PCRE2_JIT` to no:

.. code-block:: console

   # PCRE2_SYSTEM=yes USE_PCRE2_JIT=no ./install.sh

zlib
^^^^

`zlib <https://www.zlib.net/>`_ is included with OSSEC in `src/external/zlib-1.2.11`. In previous
versions this included version was used by default during the build process, but this changed to 
using the system zlib. Ensure the correct zlib development packages are installed.

To use the included version of zlib, simply set `ZLIB_SYSTEM` to `no`:

.. code-block:: console

   # cd ossec-hids-*
   # ZLIB_SYSTEM=no ./install.sh

Ubuntu
^^^^^^

On Ubuntu you will need the *build-essential* package in order to
compile and install OSSEC.

To install the package run the following command.

.. code-block:: console

    # apt-get install build-essential zlib1g-dev

To use the system's pcre2 libraries, install the libpcre2 development package:

.. code-block:: console

   # apt-get install libpcre2-dev

If database support is needed *mysql-dev* or *postgresql-dev* should be
installed. Run the following command to install these packages.

.. code-block:: console 

    # apt-get install mysql-dev postgresql-dev

To use the SQLite features, the `libsqlite3-dev` package is necessary.

.. versionadded:: 3.0

.. code-block:: console

   # apt-get install libsqlite3-dev


RedHat/CentOS
^^^^^^^^^^^^^

RedHat should have most of the packages needed by default. The zlib development package
should be installed:

.. code-block:: console

   # yum install zlib-devel

To use the system's pcre2 libraries, add the pcre2 development package:

.. code-block:: console

   # yum install pcre2-devel

If database support is needed the package mysql-devel and/or postgresql-devel will
need to be installed.

.. code-block:: console

    # yum install mysql-devel postgresql-devel

To use the SQLite features, the `sqlite-devel` package is necessary.

.. versionadded:: 3.0

.. code-block:: console

   # yum install sqlite-devel

OpenSuse
^^^^^^^^

The zlib development package should be installed:

.. code-block:: console

   # zypper install zlib-devel

To use the system's pcre2 libraries, add the pcre2 development package:

.. code-block:: console

   # zypper install pcre2-devel

If database support is needed the package mysql-devel and/or postgresql-devel will
need to be installed.

.. code-block:: console

   # zypper install postgresql-devel mysql-devel

Debian
^^^^^^

.. warning::

   The Debian instructions are probably out of date. Contributions updating this section
   would be appreciated.


Debian has replaced bash with dash, and this may cause issues during
installation. Dash does not appear to support all of the features
available in other shells, and may display an error when trying to set
the server's IP address on an agent system. The error can be ignored,
but the server ip address will need to be set.

Do this by making sure something like the following information is in
the agent's ossec.conf:

.. code-block:: console

   <ossec_config>
     <client>
       <server-ip>SERVER'S IP</server-ip>
     </client>

This can also be avoided by using bash to run ``install.sh``:

.. code-block:: console

   # bash ./install.sh

Alpine Linux
^^^^^^^^^^^^

To build OSSEC on Alpine Linux the following packages should be installed:

.. code-block:: console

   # apk add libc-dev pcre2-dev bsd-compat-headers libevent-dev openssl-dev zlib-dev linux-headers

Even with the `linux-headers` package installed, make will not be able to find `a.out.h`.
Until the installer is fixed, link `a.out.h` to `src/headers`:

.. code-block:: console

   $ ln -s /usr/include/linux/a.out.h ./headers/a.out.h


OpenBSD
^^^^^^^

To build OSSEC on OpenBSD the following packages should be installed:

.. code-block:: console

   # pkg_add pcre2 gmake

To add database support for a server the *postgresql-client* or *mariadb-client* will need to be installed.

For sqlite support, install the *sqlite3* package.

FreeBSD
^^^^^^^

*TBD*