diff --git a/README.md b/README.md
index ab1237c..b5b86d3 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,7 @@ Default attributes from the ossec-server role:
'ossec@example.net',
],
"email_from" => 'ossec-server@example.net',
+ "email_idsname" => 'ossec',
"smtp_server" => 'localhost',
"white_list" => [
'127.0.0.1',
@@ -97,6 +98,7 @@ Default attributes from the ossec-server role:
'/etc/mcollective/facts.yaml' => {},
'/etc/blkid.tab' => {},
'/etc/mtab' => {},
+ '/etc/hosts.deny' => {},
'/etc/mail/statistics => {}',
'/etc/random-seed' => {},
'/etc/adjtime' => {},
diff --git a/attributes/ossec.rb b/attributes/ossec.rb
index ad91c1d..cf35584 100644
--- a/attributes/ossec.rb
+++ b/attributes/ossec.rb
@@ -6,6 +6,7 @@ default["ossec"]["receiver_port"] = "1514"
default["ossec"]["log_alert_level"] = "1"
default["ossec"]["email_alert_level"] = "7"
default["ossec"]["email_maxperhour"] = "9999"
+default["ossec"]["email_idsname"] = "ossec"
default["ossec"]["memory_size"] = "100000"
default["ossec"]["remote"]["connection"] = "secure"
default["ossec"]["agents"] = {}
@@ -125,6 +126,7 @@ default["ossec"]["syscheck"]["ignore"]['/etc/openvpn/openvpn-status.log'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/motd'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/blkid.tab'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/mtab'] = {}
+default["ossec"]["syscheck"]["ignore"]['/etc/hosts.deny'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/mail/statistics'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/random-seed'] = {}
default["ossec"]["syscheck"]["ignore"]['/etc/adjtime'] = {}
diff --git a/libraries/core.rb b/libraries/core.rb
index c3b6865..39885f9 100644
--- a/libraries/core.rb
+++ b/libraries/core.rb
@@ -32,7 +32,7 @@ module OssecCore
def ossec_event_location_search()
# resolve the location search of an email_alert block to a hostname
- node["ossec"]["email_alerts"].each do|recipient,params|
+ node["ossec"]["email_alerts"].each do |recipient, params|
if params.has_key?('event_location_search')
if Chef::Config[:solo]
Chef::Log.warn('This recipe uses search. Chef Solo does not support search.')
diff --git a/metadata.rb b/metadata.rb
index f9c6d09..acdc301 100644
--- a/metadata.rb
+++ b/metadata.rb
@@ -4,7 +4,7 @@ maintainer_email "psi-jack@linux-help.org"
license "GPLv2"
description "Installs/Configures ossec"
long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
-version "1.2.1"
+version "1.2.2"
issues_url "http://git.linux-help.org/Linux-Help/ossec-ng/issues"
source_url "http://git.linux-help.org/Linux-Help/ossec-ng"
diff --git a/templates/default/ossec-server.conf.erb b/templates/default/ossec-server.conf.erb
index ff5c1f9..c49981e 100644
--- a/templates/default/ossec-server.conf.erb
+++ b/templates/default/ossec-server.conf.erb
@@ -6,14 +6,62 @@
<%= recipient %>
<% end -%>
<%= node["ossec"]["smtp_server"] %>
- <%= node["ossec"]["email_from"]%>
- <%=node["ossec"]["email_maxperhour"]%>
+ <%= node["ossec"]["email_from"] %>
+ <%= node["ossec"]["email_maxperhour"] %>
+ <%= node["ossec"]["email_idsname"] %>
<%=node["ossec"]["memory_size"]%>
<% node["ossec"]["white_list"].sort_by {|k| k}.each do |ip| -%>
<%= ip %>
<% end -%>
+<% node["ossec"]["email_alerts"].sort_by {|k,v| k}.each do |recipient,params|
+ locations = []
+ if params.has_key?('event_location_tag')
+ locations = @ossec_agents.select{
+ |n| n[:tags].include?(
+ params[:event_location_tag]
+ )
+ }.map {|n2| n2.network.lanip || '172.172.172.172'}
+ elsif params.has_key?('resolved_search')
+ locations = params[:resolved_search]
+ end
+ if locations.count > 0
+ locations.sort_by {|k| k}.each do |location| -%>
+
+ <%= recipient %>
+ <%= location %>
+<% params.sort_by {|k,v| k}.each do |key, value|
+ unless key =~ /event_location_tag|event_location_search|resolved_search/
+ if key.eql?('tags')
+ value.sort_by {|k| k}.each do |tag| -%>
+ <<%= tag %> />
+<% end
+ else -%>
+ <<%= key %>><%= value %><%= key %>>
+<% end
+ end
+ end -%>
+
+<% end
+ else -%>
+
+ <%= recipient %>
+<% params.sort_by {|k,v| k}.each do |key, value|
+ unless key =~ /event_location_tag|event_location_search|resolved_search/
+ if key.eql?('tags')
+ value.sort_by {|k| k}.each do |tag| -%>
+ <<%= tag %> />
+<% end
+ else -%>
+ <<%= key %>><%= value %><%= key %>>
+<% end
+ end
+ end -%>
+
+<% end
+ end -%>
+
<% node["ossec"]["load_rules"].each_pair do |name, value|
if value -%>
@@ -82,36 +130,6 @@
<% end -%>
-<% node["ossec"]["email_alerts"].sort_by {|k,v| k}.each do |recipient,params|
- locations = []
- if params.has_key?('event_location_tag')
- locations = @ossec_agents.select{
- |n| n[:tags].include?(
- params[:event_location_tag]
- )
- }.map {|n2| n2.network.lanip || '172.172.172.172'}
- elsif params.has_key?('resolved_search')
- locations = params[:resolved_search]
- end
- locations.sort_by {|k| k}.each do |location| -%>
-
- <%= recipient %>
- <%= location %>
-<% params.sort_by {|k,v| k}.each do |key, value|
- unless key =~ /event_location_tag|event_location_search|resolved_search/
- if key.eql?('tags')
- value.sort_by {|k| k}.each do |tag| -%>
- <<%= tag %> />
-<% end
- else -%>
- <<%= key %>><%= value %><%= key %>>
-<% end
- end
- end -%>
-
-<% end
- end -%>
-
<%= node["ossec"]["syscheck"]["frequency"] %>