Initial commit for version 3.0.03.0.0

86 files changed, 3322 insertions, 0 deletions

diff --git a/security/ossec-hids-agent-config/Makefile b/security/ossec-hids-agent-config/Makefile
new file mode 100644
index 0000000..c72f8de
--- /dev/null
+++ b/security/ossec-hids-agent-config/Makefile
@@ -0,0 +1,7 @@
+# $FreeBSD$
+
+OSSEC_TYPE=	agent
+
+MASTERDIR=	${.CURDIR}/../ossec-hids-local-config
+
+.include "${MASTERDIR}/Makefile"
diff --git a/security/ossec-hids-agent/Makefile b/security/ossec-hids-agent/Makefile
new file mode 100644
index 0000000..1bcb1f1
--- /dev/null
+++ b/security/ossec-hids-agent/Makefile
@@ -0,0 +1,7 @@
+# $FreeBSD$
+
+OSSEC_TYPE=	agent
+
+MASTERDIR=	${.CURDIR}/../ossec-hids-local
+
+.include "${MASTERDIR}/Makefile"
diff --git a/security/ossec-hids-local-config/Makefile b/security/ossec-hids-local-config/Makefile
new file mode 100644
index 0000000..15f3ffc
--- /dev/null
+++ b/security/ossec-hids-local-config/Makefile
@@ -0,0 +1,446 @@
+# $FreeBSD$
+
+PORTNAME=	ossec-hids
+PORTVERSION=	3.0.0
+PORTREVISION=
+CATEGORIES=	security
+PKGNAMESUFFIX=	-${OSSEC_TYPE}-config
+
+MAINTAINER=	dominik.lisiak@bemsoft.pl
+COMMENT=	Configuration manager for ossec-hids
+
+LICENSE=	GPLv2
+
+OSSEC_TYPE?=	local
+
+MASTERDIR?=	${.CURDIR}
+
+.if ${OSSEC_TYPE} == local
+CONFLICTS_INSTALL=	ossec-hids-client-* \
+			ossec-hids-agent-* \
+			ossec-hids-server-*
+.elif ${OSSEC_TYPE} == agent
+CONFLICTS_INSTALL=	ossec-hids-client-* \
+			ossec-hids-local-* \
+			ossec-hids-server-*
+.elif ${OSSEC_TYPE} == server
+CONFLICTS_INSTALL=	ossec-hids-client-* \
+			ossec-hids-agent-* \
+			ossec-hids-local-*
+.endif
+
+.if !defined(MAINTAINER_MODE)
+RUN_DEPENDS=	ossec-hids-${OSSEC_TYPE}>=${PORTVERSION}:security/ossec-hids-${OSSEC_TYPE}
+.endif
+
+.if defined(MAINTAINER_MODE)
+USE_GITHUB=	yes
+GH_ACCOUNT=	ossec
+.else
+MASTER_SITES=	#
+DISTFILES=	#
+EXTRACT_ONLY=	#
+.endif
+NO_BUILD=	yes
+NO_ARCH=	yes
+
+OPTIONS_SUB=			yes
+
+OPTIONS_SINGLE=			FIREWALL
+OPTIONS_SINGLE_FIREWALL=	IPF IPFW PF
+
+OPTIONS_DEFAULT+=		IPF
+
+FIREWALL_DESC=		Active response firewall
+PF_DESC=		Packet Filter
+IPFW_DESC=		ipfirewall
+IPF_DESC=		ipfilter
+
+TEMPL_ENABLED_HEADER=		template-header-enabled.xml
+TEMPL_DISABLED_HEADER=		template-header-disabled.xml
+TEMPL_SAMPLE_HEADER=		template-header-sample.xml
+TEMPL_PUSHED_ENABLED_HEADER=	${TEMPL_ENABLED_HEADER}
+TEMPL_PUSHED_DISABLED_HEADER=	${TEMPL_DISABLED_HEADER}
+
+TEMPL_SAMPLE=		template-sample-${OSSEC_TYPE}.xml
+TEMPL_SAMPLE_DB=	template-sample-database.xml
+
+PF_VARS=		FW_DROP=pf.sh PKGMSG_FILES+=message-pf
+IPFW_VARS=		FW_DROP=ipfw.sh
+IPF_VARS=		FW_DROP=ipfilter.sh
+
+.if defined(MAINTAINER_MODE)
+OSSEC_HOME=		${PREFIX}/${PORTNAME}
+.else
+OSSEC_HOME?=		${PREFIX}/${PORTNAME}
+.endif
+OSSEC_RC=		${PREFIX}/etc/rc.d/ossec-hids
+TEMPL_TO_OSSEC=		${SCRIPTDIR}/template-to-ossec.sh ${OSSEC_TYPE} ${OSSEC_HOME}
+TEMPL_TO_AGENT=		${SCRIPTDIR}/template-to-agent.sh ${OSSEC_TYPE} ${OSSEC_HOME}
+
+OSSEC_DIR=		${STAGEDIR}${OSSEC_HOME}
+BIN_DIR=		${OSSEC_DIR}/bin
+CONF_BIN_DIR=		${BIN_DIR}/config
+OSSEC_CONF_BIN=		${CONF_BIN_DIR}/ossec-conf
+AGENT_CONF_BIN=		${CONF_BIN_DIR}/agent-conf
+COMMAND_BIN_DIR=	${BIN_DIR}/command
+
+AR_BIN_DIR=		${OSSEC_DIR}/active-response/bin
+MERGE_CONFIG_BIN=	${AR_BIN_DIR}/merge-config.sh
+
+ETC_DIR=		${OSSEC_DIR}/etc
+OSSEC_CONF_DIR=		${ETC_DIR}/ossec.conf.d
+AGENT_CONF_DIR=		${ETC_DIR}/agent.conf.d
+OSSEC_LOCAL_CONF_DIR=	${OSSEC_CONF_DIR}/disabled
+AGENT_LOCAL_CONF_DIR=	${AGENT_CONF_DIR}/disabled
+OSSEC_SAMPLE_CONF=	${OSSEC_CONF_DIR}/900.local.conf.sample
+COMMAND_CONF_DIR=	${ETC_DIR}
+COMMAND_CONF=		${COMMAND_CONF_DIR}/command.conf.sample
+RULES_DIR=		${OSSEC_DIR}/rules
+
+.if empty(USER)
+USER=$$(${ID} -un)
+.endif
+.if empty(GROUP)
+GROUP=$$(${ID} -gn)
+.endif
+
+OSSEC_USER=	ossec
+OSSEC_GROUP=	ossec
+
+SUB_LIST+=	PORTNAME=${PORTNAME} \
+		OSSEC_TYPE=${OSSEC_TYPE} \
+		OSSEC_HOME=${OSSEC_HOME} \
+		VERSION=${PORTVERSION} \
+		USER=${USER} \
+		OSSEC_USER=${OSSEC_USER} \
+		OSSEC_GROUP=${OSSEC_GROUP} \
+		OSSEC_RC=${OSSEC_RC} \
+		FW_DROP=${FW_DROP}
+SUB_FILES=	pkg-install \
+		pkg-deinstall \
+		${PKGMSG_FILES} \
+		${TEMPL_ENABLED_HEADER} \
+		${TEMPL_DISABLED_HEADER} \
+		${TEMPL_SAMPLE_HEADER} \
+		${TEMPL_PUSHED_ENABLED_HEADER} \
+		${TEMPL_PUSHED_DISABLED_HEADER} \
+		${TEMPL_SAMPLE} \
+		merge-config.sh \
+		ossec-conf \
+		command.conf
+.if ${OSSEC_TYPE} == server
+SUB_FILES+=	agent-conf
+.endif
+
+.if defined(MAINTAINER_MODE)
+PLIST_SUB=	OSSEC_HOME=${PORTNAME}
+.else
+PLIST_SUB=	OSSEC_HOME=${OSSEC_HOME}
+.endif
+PLIST=		${PKGDIR}/pkg-plist-${OSSEC_TYPE}
+PKGHELP=	${PKGDIR}/pkg-help-${OSSEC_TYPE}
+PKGMESSAGE=	${WRKDIR}/pkg-message
+PKGMSG_FILES=	message-ossec-conf
+.if ${OSSEC_TYPE} == server
+PKGMSG_FILES+=	message-agent-conf
+.endif
+
+CONF_GROUPS=	RULES AR ROOTCHECK SYSCHECK CMDOUT LOGS
+
+############################################################
+
+.for conf_group in ${CONF_GROUPS}
+. include "${MASTERDIR}/opt-${conf_group:tl}.mk"
+${conf_group}_INSTANCE_OPTIONS=
+${conf_group}_PUSHED_OPTIONS=
+. for option in ${${conf_group}_OPTIONS}
+.  if ${${option}_DEFINE:M${OSSEC_TYPE}}
+${conf_group}_INSTANCE_OPTIONS+=		${option}
+.  endif
+.  if ${OSSEC_TYPE} == server && ${${option}_DEFINE:Mpushed}
+${conf_group}_PUSHED_OPTIONS+=			${option}
+.  endif
+. endfor
+.endfor
+
+############################################################
+
+.for conf_group in ${CONF_GROUPS}
+. if !empty(${conf_group}_PROFILE)
+.  if ${OSSEC_TYPE} == agent
+.   if empty(CLIENT_PROFILES)
+CLIENT_PROFILES:=	${${conf_group}_PROFILE}
+.   else
+CLIENT_PROFILES:=	${CLIENT_PROFILES}, ${${conf_group}_PROFILE}
+.   endif
+.  endif
+SUB_LIST+=		${conf_group}_PROFILE=${${conf_group}_PROFILE}
+. endif
+. for option in ${${conf_group}_INSTANCE_OPTIONS}
+.  if !empty(${option}_PROFILE)
+.   if ${OSSEC_TYPE} == agent
+.    if empty(CLIENT_PROFILES)
+CLIENT_PROFILES:=	${${option}_PROFILE}
+.    else
+CLIENT_PROFILES:=	${CLIENT_PROFILES}, ${${option}_PROFILE}
+.    endif
+.   endif
+SUB_LIST+=		${option}_PROFILE=${${option}_PROFILE}
+.  endif
+. endfor
+.endfor
+
+SUB_LIST+=		CLIENT_PROFILES="${CLIENT_PROFILES}"
+
+############################################################
+
+.for conf_group in ${CONF_GROUPS}
+. for option in ${${conf_group}_INSTANCE_OPTIONS}
+.  if !defined(${option}_TEMPLATE)
+${option}_TEMPLATE=	template-${option:tl:S/_/-/g}.xml
+.  endif
+.  if !empty(${option}_TEMPLATE)
+SUB_FILES+=		${${option}_TEMPLATE}
+.  endif
+. endfor
+.endfor
+
+.for file_name in ${RULES_FILES}
+SUB_FILES+=		rules-${file_name}.xml
+.endfor
+
+.for file_name in ${CMDOUT_SCRIPTS}
+SUB_FILES+=		command-${file_name}.sh
+.endfor
+
+############################################################
+
+.for conf_group in ${CONF_GROUPS}
+. for option in ${${conf_group}_INSTANCE_OPTIONS}
+.  if !empty(${option}_DEPENDS) && !empty(${${option}_DEPENDS}_OPTION) && ${${${option}_DEPENDS:S/_/ /:[1]}_INSTANCE_OPTIONS:M${${option}_DEPENDS}}
+${${${option}_DEPENDS}_OPTION}_VARS+=		${conf_group}_INSTANCE_OPTIONS_ENABLED+=${option}
+${${${option}_DEPENDS}_OPTION}_VARS_OFF+=	${conf_group}_INSTANCE_OPTIONS_DISABLED+=${option}
+.  elif !empty(${option}_OPTION)
+OPTIONS_GROUP_G_${conf_group}+=			${${option}_OPTION}
+${${option}_OPTION}_DESC=			${${option}_DESC}
+.   if ${${option}_DEFAULT:M${OSSEC_TYPE}}
+OPTIONS_DEFAULT+=				${${option}_OPTION}
+.   endif
+${${option}_OPTION}_VARS+=			${conf_group}_INSTANCE_OPTIONS_ENABLED+=${option}
+${${option}_OPTION}_VARS_OFF+=			${conf_group}_INSTANCE_OPTIONS_DISABLED+=${option}
+.  endif
+. endfor
+. if !empty(OPTIONS_GROUP_G_${conf_group})
+OPTIONS_GROUP+=			G_${conf_group}
+G_${conf_group}_DESC=		${${conf_group}_DESC}
+. endif
+.endfor
+
+############################################################
+
+.for conf_group in ${CONF_GROUPS}
+. for option in ${${conf_group}_PUSHED_OPTIONS}
+.  if !empty(${option}_DEPENDS) && !empty(${${option}_DEPENDS}_OPTION) && ${${${option}_DEPENDS:S/_/ /:[1]}_PUSHED_OPTIONS:M${${option}_DEPENDS}}
+${${${option}_DEPENDS}_OPTION}_P_VARS+=		${conf_group}_PUSHED_OPTIONS_ENABLED+=${option}
+${${${option}_DEPENDS}_OPTION}_P_VARS_OFF+=	${conf_group}_PUSHED_OPTIONS_DISABLED+=${option}
+.  elif !empty(${option}_DEPENDS) && !empty(${${option}_DEPENDS}_OPTION) && ${${${option}_DEPENDS:S/_/ /:[1]}_INSTANCE_OPTIONS:M${${option}_DEPENDS}}
+${${${option}_DEPENDS}_OPTION}_VARS+=		${conf_group}_PUSHED_OPTIONS_ENABLED+=${option}
+${${${option}_DEPENDS}_OPTION}_VARS_OFF+=	${conf_group}_PUSHED_OPTIONS_DISABLED+=${option}
+.  elif !empty(${option}_OPTION)
+OPTIONS_GROUP_G_${conf_group}_P+=		${${option}_OPTION}_P
+${${option}_OPTION}_P_DESC=			${${option}_DESC}
+.   if !empty(${option}_PROFILE)
+${${option}_OPTION}_P_DESC+=			(profile: ${${option}_PROFILE})
+.   endif
+.   if ${${option}_DEFAULT:Mpushed}
+OPTIONS_DEFAULT+=				${${option}_OPTION}_P
+.   endif
+${${option}_OPTION}_P_VARS+=			${conf_group}_PUSHED_OPTIONS_ENABLED+=${option}
+${${option}_OPTION}_P_VARS_OFF+=		${conf_group}_PUSHED_OPTIONS_DISABLED+=${option}
+.  endif
+. endfor
+. if !empty(OPTIONS_GROUP_G_${conf_group}_P)
+OPTIONS_GROUP+=			G_${conf_group}_P
+G_${conf_group}_P_DESC=		Pushed ${${conf_group}_DESC}
+.  if !empty(${conf_group}_PROFILE)
+G_${conf_group}_P_DESC+=	(profile: ${${conf_group}_PROFILE})
+.  endif
+. endif
+.endfor
+
+############################################################
+
+.include <bsd.port.pre.mk>
+
+show-opts:
+.for conf_group in ${CONF_GROUPS}
+	@${ECHO_CMD} "${conf_group}: ${${conf_group}_DESC}"
+. for option in ${${conf_group}_INSTANCE_OPTIONS}
+	@${ECHO_CMD} "  ${option}: ${${option}_DESC}"
+.  if empty(${option}_TEMPLATE)
+	@${ECHO_CMD} "    Template: -"
+.  else
+	@${ECHO_CMD} "    Template: ${${option}_TEMPLATE}"
+.  endif
+.  if !empty(${conf_group}_INSTANCE_OPTIONS_ENABLED) && ${${conf_group}_INSTANCE_OPTIONS_ENABLED:M${option}}
+	@${ECHO_CMD} "    Enabled:  true"
+.  endif
+.  if !empty(${conf_group}_INSTANCE_OPTIONS_DISABLED) && ${${conf_group}_INSTANCE_OPTIONS_DISABLED:M${option}}
+	@${ECHO_CMD} "    Enabled:  false"
+.  endif
+.  if !empty(${conf_group}_PUSHED_OPTIONS_ENABLED) && ${${conf_group}_PUSHED_OPTIONS_ENABLED:M${option}}
+	@${ECHO_CMD} "    Pushed:   true"
+.  endif
+.  if !empty(${conf_group}_PUSHED_OPTIONS_DISABLED) && ${${conf_group}_PUSHED_OPTIONS_DISABLED:M${option}}
+	@${ECHO_CMD} "    Pushed:   false"
+.  endif
+. endfor
+.endfor
+
+pre-install:
+	@-${OSSEC_HOME}/bin/ossec-dbd -h 2>&1 | ${GREP} -q 'PostgreSQL' && \
+		${SED} -e 's|%%OSSEC_HOME%%|${OSSEC_HOME}|g' -e 's|%%DB_TYPE%%|postgresql|g' \
+		${FILESDIR}/${TEMPL_SAMPLE_DB}.in > ${WRKDIR}/${TEMPL_SAMPLE_DB}
+	@-${OSSEC_HOME}/bin/ossec-dbd -h 2>&1 | ${GREP} -q 'MySQL' && \
+		${SED} -e 's|%%OSSEC_HOME%%|${OSSEC_HOME}|g' -e 's|%%DB_TYPE%%|mysql|g' \
+		${FILESDIR}/${TEMPL_SAMPLE_DB}.in > ${WRKDIR}/${TEMPL_SAMPLE_DB}
+
+ossec-dirs:
+	@${MKDIR} -p ${CONF_BIN_DIR} ${COMMAND_BIN_DIR} ${AR_BIN_DIR} ${OSSEC_CONF_DIR} ${OSSEC_LOCAL_CONF_DIR} ${COMMAND_CONF_DIR}
+.if ${OSSEC_TYPE} != agent
+	@${MKDIR} -p ${RULES_DIR}
+.endif
+.if ${OSSEC_TYPE} == server
+	@${MKDIR} -p ${AGENT_CONF_DIR} ${AGENT_LOCAL_CONF_DIR}
+.endif
+
+ossec-scripts:
+	@${CP} -f ${WRKDIR}/ossec-conf ${OSSEC_CONF_BIN}
+.if ${OSSEC_TYPE} == server
+	@${CP} -f ${WRKDIR}/agent-conf ${AGENT_CONF_BIN}
+.endif
+.for file_name in ${CMDOUT_SCRIPTS}
+	@${CP} -f ${WRKDIR}/command-${file_name}.sh ${COMMAND_BIN_DIR}/${file_name}.sh
+.endfor
+	@${CP} -f ${WRKDIR}/command.conf ${COMMAND_CONF}
+	@${CP} -f ${WRKDIR}/merge-config.sh ${MERGE_CONFIG_BIN}
+
+ossec-rules:
+.if ${OSSEC_TYPE} != agent
+. for file_name in ${RULES_FILES}
+	@${SED} -e 's|<?xml.*?>||' ${WRKDIR}/rules-${file_name}.xml > ${RULES_DIR}/freebsd_${file_name}_rules.xml
+. endfor
+.endif
+
+ossec-conf-managed:
+.for conf_group in ${CONF_GROUPS}
+. if !empty(${conf_group}_INSTANCE_OPTIONS)
+	@${CAT} ${WRKDIR}/${TEMPL_ENABLED_HEADER} > ${OSSEC_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+.  if !empty(${conf_group}_INSTANCE_OPTIONS_ENABLED)
+.   for option in ${${conf_group}_INSTANCE_OPTIONS}
+.    if ${${conf_group}_INSTANCE_OPTIONS_ENABLED:M${option}}
+.     if !empty(${option}_TEMPLATE)
+	@${TEMPL_TO_OSSEC} ${WRKDIR}/${${option}_TEMPLATE} >> ${OSSEC_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+	@${ECHO_CMD} >> ${OSSEC_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+.     endif
+.    endif
+.   endfor
+.  endif
+. endif
+.endfor
+
+ossec-conf-local:
+.for conf_group in ${CONF_GROUPS}
+. if !empty(${conf_group}_INSTANCE_OPTIONS)
+	@${CAT} ${WRKDIR}/${TEMPL_DISABLED_HEADER} > ${OSSEC_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+.  if !empty(${conf_group}_INSTANCE_OPTIONS_DISABLED)
+.   for option in ${${conf_group}_INSTANCE_OPTIONS}
+.    if ${${conf_group}_INSTANCE_OPTIONS_DISABLED:M${option}}
+.     if !empty(${option}_TEMPLATE)
+	@${TEMPL_TO_OSSEC} ${WRKDIR}/${${option}_TEMPLATE} >> ${OSSEC_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+	@${ECHO_CMD} >> ${OSSEC_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+.     endif
+.    endif
+.   endfor
+.  endif
+. endif
+.endfor
+
+ossec-conf-sample:
+	@${CAT} ${WRKDIR}/${TEMPL_SAMPLE_HEADER} > ${OSSEC_SAMPLE_CONF}
+	@${ECHO_CMD} >> ${OSSEC_SAMPLE_CONF}
+	@${TEMPL_TO_OSSEC} ${WRKDIR}/${TEMPL_SAMPLE} >> ${OSSEC_SAMPLE_CONF}
+	@${ECHO_CMD} >> ${OSSEC_SAMPLE_CONF}
+	@-${TEST} -f ${WRKDIR}/${TEMPL_SAMPLE_DB} && \
+		${TEMPL_TO_OSSEC} ${WRKDIR}/${TEMPL_SAMPLE_DB} >> ${OSSEC_SAMPLE_CONF} && \
+		${ECHO_CMD} >> ${OSSEC_SAMPLE_CONF}
+
+agent-conf-managed:
+.for conf_group in ${CONF_GROUPS}
+. if !empty(${conf_group}_PUSHED_OPTIONS)
+	@${CAT} ${WRKDIR}/${TEMPL_PUSHED_ENABLED_HEADER} > ${AGENT_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+.  if !empty(${conf_group}_PUSHED_OPTIONS_ENABLED)
+.   for option in ${${conf_group}_PUSHED_OPTIONS}
+.    if ${${conf_group}_PUSHED_OPTIONS_ENABLED:M${option}}
+.     if !empty(${option}_TEMPLATE)
+	@${TEMPL_TO_AGENT} ${WRKDIR}/${${option}_TEMPLATE} >> ${AGENT_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+	@${ECHO_CMD} >> ${AGENT_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+.     endif
+.    endif
+.   endfor
+.  endif
+. endif
+.endfor
+
+agent-conf-local:
+.for conf_group in ${CONF_GROUPS}
+. if !empty(${conf_group}_PUSHED_OPTIONS)
+	@${CAT} ${WRKDIR}/${TEMPL_PUSHED_DISABLED_HEADER} > ${AGENT_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+.  if !empty(${conf_group}_PUSHED_OPTIONS_DISABLED)
+.   for option in ${${conf_group}_PUSHED_OPTIONS}
+.    if ${${conf_group}_PUSHED_OPTIONS_DISABLED:M${option}}
+.     if !empty(${option}_TEMPLATE)
+	@${TEMPL_TO_AGENT} ${WRKDIR}/${${option}_TEMPLATE} >> ${AGENT_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+	@${ECHO_CMD} >> ${AGENT_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+.     endif
+.    endif
+.   endfor
+.  endif
+. endif
+.endfor
+
+do-install: ossec-dirs ossec-scripts ossec-rules ossec-conf-managed ossec-conf-local ossec-conf-sample agent-conf-managed agent-conf-local
+
+ossec-permissions:
+	@${CHMOD} -R 550 ${OSSEC_DIR}
+	@${CHMOD} 640 ${COMMAND_CONF} ${OSSEC_CONF_DIR}/* ${OSSEC_LOCAL_CONF_DIR}/*
+	@${CHMOD} 550 ${OSSEC_CONF_DIR} ${OSSEC_LOCAL_CONF_DIR}
+.if ${OSSEC_TYPE} != agent
+	@${CHMOD} 640 ${RULES_DIR}/*
+.endif
+.if ${OSSEC_TYPE} == server
+	@${CHMOD} 640 ${AGENT_CONF_DIR}/* ${AGENT_LOCAL_CONF_DIR}/*
+	@${CHMOD} 550 ${AGENT_CONF_DIR} ${AGENT_LOCAL_CONF_DIR}
+.endif
+.if defined(MAINTAINER_MODE)
+	@${CHOWN} -R ${USER}:${OSSEC_GROUP} ${OSSEC_DIR}
+	@${CHOWN} -R ${USER}:${GROUP} ${BIN_DIR}
+.endif
+
+post-install: ossec-permissions
+	@${ECHO_CMD} -n > ${PKGMESSAGE}
+.for file_name in ${PKGMSG_FILES}
+	@${CAT} ${WRKDIR}/${file_name} >> ${PKGMESSAGE}
+	@${ECHO_CMD} >> ${PKGMESSAGE}
+.endfor
+
+.if defined(MAINTAINER_MODE)
+plist: makeplist
+	@${SCRIPTDIR}/plist.sh ${OSSEC_TYPE} ${OSSEC_HOME} ${PLIST} ${WRKDIR} ${STAGEDIR}
+
+rules: extract
+	@${SCRIPTDIR}/rules.sh ${FILESDIR}/${RULES_DEFAULT_TEMPLATE}.in ${WRKSRC}
+.endif
+
+.include <bsd.port.post.mk>
diff --git a/security/ossec-hids-local-config/distinfo b/security/ossec-hids-local-config/distinfo
new file mode 100644
index 0000000..22bce30
--- /dev/null
+++ b/security/ossec-hids-local-config/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1535297705
+SHA256 (ossec-ossec-hids-3.0.0_GH0.tar.gz) = a271d665ed502b3df4ff055a177159dfc0bc8a69dd44eab1f7c57fe8fff42a98
+SIZE (ossec-ossec-hids-3.0.0_GH0.tar.gz) = 1817324
diff --git a/security/ossec-hids-local-config/files/agent-conf.in b/security/ossec-hids-local-config/files/agent-conf.in
new file mode 100644
index 0000000..673d0f6
--- /dev/null
+++ b/security/ossec-hids-local-config/files/agent-conf.in
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+ossec_type="%%OSSEC_TYPE%%"
+ossec_home="%%OSSEC_HOME%%"
+
+agent_conf_dir="${ossec_home}/etc/agent.conf.d"
+agent_conf_files="${agent_conf_dir}/*.conf"
+
+select_elements() {
+    local element="$1"
+    sed -n "/<${element}.*>/,/<\/${element}>/p"
+}
+
+remove_comments() {
+    # Comments must be on separate lines i.e. not next to uncommented code
+    awk '/<!--/ {off=1} /-->/ {off=2} /([\s\S]*)/ {if (off==0) print; if (off==2) off=0}'
+}
+
+remove_empty_lines() {
+    sed '/^\s*$/d'
+}
+
+agent_conf() {
+
+    echo "<!-- OSSEC HIDS %%VERSION%% -->"
+    echo
+    echo "<!-- DO NOT EDIT - file generated automatically - edit \"agent.conf.d/900.local.conf\" instead -->"
+    echo
+
+    cat $@ | remove_comments | select_elements "agent_config" | remove_empty_lines
+}
+
+agent_conf "${agent_conf_files}"
diff --git a/security/ossec-hids-local-config/files/command-last-logins.sh.in b/security/ossec-hids-local-config/files/command-last-logins.sh.in
new file mode 100644
index 0000000..7bd8242
--- /dev/null
+++ b/security/ossec-hids-local-config/files/command-last-logins.sh.in
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+# This script is part of FreeBSD port - report any issues to the port MAINTAINER
+
+ossec_home="%%OSSEC_HOME%%"
+. "${ossec_home}/etc/command.conf"
+
+last -n ${last_logins}
diff --git a/security/ossec-hids-local-config/files/command-open-ports.sh.in b/security/ossec-hids-local-config/files/command-open-ports.sh.in
new file mode 100644
index 0000000..d5ba047
--- /dev/null
+++ b/security/ossec-hids-local-config/files/command-open-ports.sh.in
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# This script is part of FreeBSD port - report any issues to the port MAINTAINER
+
+family=$1
+protocol=$2
+ports=$3
+
+if [ -z "${ports}" ]; then
+    privileged_ports="1-$((`sysctl -n net.inet.ip.portrange.first` - 1))"
+
+    ossec_home="%%OSSEC_HOME%%"
+    . "${ossec_home}/etc/command.conf"
+
+    ports="privileged_${protocol}_ports"
+    eval ports=\$${ports}
+fi
+
+sockstat -l -${family} -P ${protocol} -p ${ports} | grep -Eo '[^[:space:]]+:[0-9]+' | sort -u
diff --git a/security/ossec-hids-local-config/files/command.conf.in b/security/ossec-hids-local-config/files/command.conf.in
new file mode 100644
index 0000000..b6ef2ad
--- /dev/null
+++ b/security/ossec-hids-local-config/files/command.conf.in
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+last_logins=5
+
+privileged_tcp_ports=${privileged_ports},10050-10051
+privileged_udp_ports=${privileged_ports}
diff --git a/security/ossec-hids-local-config/files/merge-config.sh.in b/security/ossec-hids-local-config/files/merge-config.sh.in
new file mode 100644
index 0000000..a7939f7
--- /dev/null
+++ b/security/ossec-hids-local-config/files/merge-config.sh.in
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+# This script is part of FreeBSD port - report any issues to the port MAINTAINER
+
+ossec_type="%%OSSEC_TYPE%%"
+ossec_home="%%OSSEC_HOME%%"
+ossec_rc="%%OSSEC_RC%%"
+
+ACTION=$1
+USER=$2
+IP=$3
+
+LOCAL=`dirname $0`;
+cd $LOCAL
+cd ../../tmp
+
+# Logging the call
+echo "`date` $0 $1 $2 $3 $4 $5" >> "${ossec_home}/logs/active-responses.log"
+
+case ${ACTION} in
+    add)
+        "${ossec_rc}" merge_config
+        exit 0
+        ;;
+    delete)
+        exit 0
+        ;;
+    *)
+        echo "$0: invalid action: ${ACTION}"
+        exit 1
+        ;;
+esac
diff --git a/security/ossec-hids-local-config/files/message-agent-conf.in b/security/ossec-hids-local-config/files/message-agent-conf.in
new file mode 100644
index 0000000..8d61c0d
--- /dev/null
+++ b/security/ossec-hids-local-config/files/message-agent-conf.in
@@ -0,0 +1,3 @@
+The "agent.conf" must no longer be used for configuration. It will be
+overwritten by merged "*.conf" files from the configuration directory:
+%%OSSEC_HOME%%/etc/agent.conf.d
diff --git a/security/ossec-hids-local-config/files/message-ossec-conf.in b/security/ossec-hids-local-config/files/message-ossec-conf.in
new file mode 100644
index 0000000..d6170ca
--- /dev/null
+++ b/security/ossec-hids-local-config/files/message-ossec-conf.in
@@ -0,0 +1,3 @@
+The "ossec.conf" must no longer be used for configuration. It will be
+overwritten by merged "*.conf" files from the configuration directory:
+%%OSSEC_HOME%%/etc/ossec.conf.d
diff --git a/security/ossec-hids-local-config/files/message-pf.in b/security/ossec-hids-local-config/files/message-pf.in
new file mode 100644
index 0000000..707e44b
--- /dev/null
+++ b/security/ossec-hids-local-config/files/message-pf.in
@@ -0,0 +1,4 @@
+Add the ossec_fwtable to /etc/pf.conf if using "firewall-drop" active response:
+  table <ossec_fwtable> persist
+  block in quick from <ossec_fwtable> to any
+  block out quick from any to <ossec_fwtable>
diff --git a/security/ossec-hids-local-config/files/ossec-conf.in b/security/ossec-hids-local-config/files/ossec-conf.in
new file mode 100644
index 0000000..d28d238
--- /dev/null
+++ b/security/ossec-hids-local-config/files/ossec-conf.in
@@ -0,0 +1,60 @@
+#!/bin/sh
+
+ossec_type="%%OSSEC_TYPE%%"
+ossec_home="%%OSSEC_HOME%%"
+
+ossec_conf_dir="${ossec_home}/etc/ossec.conf.d"
+ossec_conf_files="${ossec_conf_dir}/*.conf"
+
+select_elements_content() {
+    local element="$1"
+    sed -n "/<${element}>/,/<\/${element}>/{ /<${element}>/d; /<\/${element}>/d; p; }"
+}
+
+remove_elements() {
+    local element="$1"
+    sed -e "/<${element}>/,/<\/${element}>/d"
+}
+
+remove_comments() {
+    # Comments must be on separate lines i.e. not next to uncommented code
+    awk '/<!--/ {off=1} /-->/ {off=2} /([\s\S]*)/ {if (off==0) print; if (off==2) off=0}'
+}
+
+remove_empty_lines() {
+    sed '/^\s*$/d'
+}
+
+ossec_conf() {
+    echo "<!-- OSSEC HIDS %%VERSION%% -->"
+    echo
+    echo "<!-- DO NOT EDIT - file generated automatically - edit \"ossec.conf.d/900.local.conf\" instead -->"
+    echo
+    echo "<ossec_config>"
+
+    if [ "${ossec_type}" != "agent"  ]; then
+        if cat $@ | remove_comments | grep -q "<rules>"; then
+            echo "  <rules>"
+            cat $@ | remove_comments | select_elements_content "rules" | remove_empty_lines
+            echo "  </rules>"
+        fi
+    fi
+
+    if cat $@ | remove_comments | grep -q "<rootcheck>"; then
+        echo "  <rootcheck>"
+        cat $@ | remove_comments | select_elements_content "rootcheck" | remove_empty_lines
+        echo "  </rootcheck>"
+    fi
+
+    if cat $@ | remove_comments | grep -q "<syscheck>"; then
+        echo "  <syscheck>"
+        cat $@ | remove_comments | select_elements_content "syscheck" | remove_empty_lines
+        echo "  </syscheck>"
+    fi
+
+    cat $@ | remove_comments | select_elements_content "ossec_config" | remove_elements "rules" | remove_elements "rootcheck" |  remove_elements "syscheck" | remove_empty_lines
+
+    echo "</ossec_config>"
+}
+
+ossec_conf "${ossec_conf_files}"
diff --git a/security/ossec-hids-local-config/files/pkg-deinstall.in b/security/ossec-hids-local-config/files/pkg-deinstall.in
new file mode 100644
index 0000000..0de19bf
--- /dev/null
+++ b/security/ossec-hids-local-config/files/pkg-deinstall.in
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+ossec_home="%%OSSEC_HOME%%"
+ossec_conf="${ossec_home}/etc/ossec.conf"
+agent_conf="${ossec_home}/etc/shared/agent.conf"
+
+if [ "$2" == "DEINSTALL"  ]; then
+    rm -f "${ossec_conf}"
+    rm -f "${agent_conf}"
+fi
diff --git a/security/ossec-hids-local-config/files/pkg-install.in b/security/ossec-hids-local-config/files/pkg-install.in
new file mode 100644
index 0000000..f164b9c
--- /dev/null
+++ b/security/ossec-hids-local-config/files/pkg-install.in
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+ossec_home="%%OSSEC_HOME%%"
+ar_bin_dir="${ossec_home}/active-response/bin"
+ossec_conf="${ossec_home}/etc/ossec.conf"
+ossec_conf_bak="${ossec_conf}.bak"
+agent_conf="${ossec_home}/etc/shared/agent.conf"
+agent_conf_bak="${ossec_home}/etc/agent.conf.bak"
+
+if [ "$2" == "POST-INSTALL"  ]; then
+    ln -f "${ar_bin_dir}/%%FW_DROP%%" "${ar_bin_dir}/firewall-drop.sh"
+
+    if [ -e "${ossec_conf}" ]; then
+        mv -f "${ossec_conf}" "${ossec_conf_bak}"
+        echo
+        echo "WARNING:"
+        echo "  Existing \"${ossec_conf}\" has been saved to \"${ossec_conf_bak}\"."
+        echo
+    fi
+
+    case "$1" in
+        ossec-hids-server*)
+            if [ -e "${agent_conf}" ]; then
+                mv -f "${agent_conf}" "${agent_conf_bak}"
+                echo
+                echo "WARNING:"
+                echo "  Existing \"${agent_conf}\" has been saved to \"${agent_conf_bak}\"."
+                echo
+            fi
+            ;;
+    esac
+fi
diff --git a/security/ossec-hids-local-config/files/rules-cmdout.xml.in b/security/ossec-hids-local-config/files/rules-cmdout.xml.in
new file mode 100644
index 0000000..59e3f4b
--- /dev/null
+++ b/security/ossec-hids-local-config/files/rules-cmdout.xml.in
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<group name="ossec,">
+
+  <rule id="56041" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-last-logins'</match>
+    <check_diff />
+    <description>List of the last logged in users.</description> 
+  </rule>
+
+  <rule id="56042" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp4-all'</match>
+    <check_diff />
+    <description>Listening IPv4 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56043" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp4'</match>
+    <check_diff />
+    <description>Listening IPv4 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56044" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp6-all'</match>
+    <check_diff />
+    <description>Listening IPv6 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56045" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp6'</match>
+    <check_diff />
+    <description>Listening IPv6 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56046" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp4-all'</match>
+    <check_diff />
+    <description>Listening IPv4 UDP port opened or closed.</description>
+  </rule>
+
+  <rule id="56047" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp4'</match>
+    <check_diff />
+    <description>Listening IPv4 UDP port opened or closed.</description>
+  </rule>
+
+  <rule id="56048" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp6-all'</match>
+    <check_diff />
+    <description>Listening IPv6 UDP port opened or closed.</description>
+  </rule>
+
+  <rule id="56049" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp6'</match>
+    <check_diff />
+    <description>Listening IPv6 UDP port opened or closed.</description>
+  </rule>
+
+</group>
diff --git a/security/ossec-hids-local-config/files/rules-config.xml.in b/security/ossec-hids-local-config/files/rules-config.xml.in
new file mode 100644
index 0000000..2853c4a
--- /dev/null
+++ b/security/ossec-hids-local-config/files/rules-config.xml.in
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<group name="ossec,">
+
+  <rule id="56001" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>%%OSSEC_HOME%%/etc/ossec.conf.d</match>
+    <description>ossec.conf.d has been modified</description>
+  </rule>
+
+  <rule id="56002" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>%%OSSEC_HOME%%/etc/ossec.conf</match>
+    <description>ossec.conf has been modified</description>
+  </rule>
+
+  <rule id="56003" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>/var/ossec/etc/ossec.conf.d</match>
+    <description>ossec.conf.d has been modified</description>
+  </rule>
+
+  <rule id="56004" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>/var/ossec/etc/ossec.conf</match>
+    <description>ossec.conf has been modified</description>
+  </rule>
+
+  <rule id="56021" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>%%OSSEC_HOME%%/etc/agent.conf.d</match>
+    <description>agent.conf.d has been modified</description>
+  </rule>
+
+  <rule id="56022" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>%%OSSEC_HOME%%/etc/shared/agent.conf</match>
+    <description>agent.conf has been modified</description>
+  </rule>
+
+  <rule id="56023" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>/var/ossec/etc/agent.conf.d</match>
+    <description>agent.conf.d has been modified</description>
+  </rule>
+
+  <rule id="56024" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>/var/ossec/etc/shared/agent.conf</match>
+    <description>agent.conf has been modified</description>
+  </rule>
+
+</group>
diff --git a/security/ossec-hids-local-config/files/template-ar-cmds-default.xml.in b/security/ossec-hids-local-config/files/template-ar-cmds-default.xml.in
new file mode 100644
index 0000000..1e2dfaa
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-cmds-default.xml.in
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <command>
+    <name>host-deny</name>
+    <executable>host-deny.sh</executable>
+    <expect>srcip</expect>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <command>
+    <name>firewall-drop</name>
+    <executable>firewall-drop.sh</executable>
+    <expect>srcip</expect>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <command>
+    <name>disable-account</name>
+    <executable>disable-account.sh</executable>
+    <expect>user</expect>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <command>
+    <name>restart-ossec</name>
+    <executable>restart-ossec.sh</executable>
+    <expect></expect>
+  </command>
+
+  <command>
+    <name>route-null</name>
+    <executable>route-null.sh</executable>
+    <expect>srcip</expect>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-ar-cmds-merge.xml.in b/security/ossec-hids-local-config/files/template-ar-cmds-merge.xml.in
new file mode 100644
index 0000000..ec2ec7e
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-cmds-merge.xml.in
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <command>
+    <name>merge-config</name>
+    <executable>merge-config.sh</executable>
+    <expect></expect>
+  </command>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-ar-fwdrop.xml.in b/security/ossec-hids-local-config/files/template-ar-fwdrop.xml.in
new file mode 100644
index 0000000..415de6c
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-fwdrop.xml.in
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <active-response>
+    <!-- Block the IP on the firewall. -->
+    <!-- See: http://www.ossec.net/docs/syntax/head_ossec_config.active-response.html#active-response-options -->
+    <command>firewall-drop</command>
+    <location>local</location>
+    <level>6</level>
+    <timeout>600</timeout>
+  </active-response>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-ar-hostdeny.xml.in b/security/ossec-hids-local-config/files/template-ar-hostdeny.xml.in
new file mode 100644
index 0000000..59b3488
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-hostdeny.xml.in
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <active-response>
+    <!-- Deny the IP in "/etc/hosts.allow" or "/etc/hosts.deny". -->
+    <command>host-deny</command>
+    <location>local</location>
+    <level>6</level>
+    <timeout>600</timeout>
+  </active-response>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-ar-merge.xml.in b/security/ossec-hids-local-config/files/template-ar-merge.xml.in
new file mode 100644
index 0000000..f38d226
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-merge.xml.in
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <active-response>
+    <!-- Create "ossec.conf" and "agent.conf" if "ossec.conf.d/*" or "agent.conf.d/*" files change. -->
+    <command>merge-config</command>
+    <location>local</location>
+    <rules_id>56001,56003,56021,56023</rules_id>
+  </active-response>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-ar-restart.xml.in b/security/ossec-hids-local-config/files/template-ar-restart.xml.in
new file mode 100644
index 0000000..064167e
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-restart.xml.in
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <active-response>
+    <!-- Restart OSSEC if "ossec.conf" or "agent.conf" changes. -->
+    <command>restart-ossec</command>
+    <location>local</location>
+    <rules_id>56002,56004,56022,56024</rules_id>
+  </active-response>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-cmdout-last-logins.xml.in b/security/ossec-hids-local-config/files/template-cmdout-last-logins.xml.in
new file mode 100644
index 0000000..88975ca
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-cmdout-last-logins.xml.in
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/last-logins.sh</command>
+    <alias>freebsd-last-logins</alias>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-cmdout-open-ports-tcp.xml.in b/security/ossec-hids-local-config/files/template-cmdout-open-ports-tcp.xml.in
new file mode 100644
index 0000000..c602821
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-cmdout-open-ports-tcp.xml.in
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 4 tcp 1-65535</command>
+    <alias>freebsd-open-ports-tcp4-all</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 4 tcp</command>
+    <alias>freebsd-open-ports-tcp4</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 6 tcp 1-65535</command>
+    <alias>freebsd-open-ports-tcp6-all</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 6 tcp</command>
+    <alias>freebsd-open-ports-tcp6</alias>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-cmdout-open-ports-udp.xml.in b/security/ossec-hids-local-config/files/template-cmdout-open-ports-udp.xml.in
new file mode 100644
index 0000000..d5c3fc8
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-cmdout-open-ports-udp.xml.in
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 4 udp 1-65535</command>
+    <alias>freebsd-open-ports-udp4-all</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 4 udp</command>
+    <alias>freebsd-open-ports-udp4</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 6 udp 1-65535</command>
+    <alias>freebsd-open-ports-udp6-all</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 6 udp</command>
+    <alias>freebsd-open-ports-udp6</alias>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-header-disabled.xml.in b/security/ossec-hids-local-config/files/template-header-disabled.xml.in
new file mode 100644
index 0000000..627fa27
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-header-disabled.xml.in
@@ -0,0 +1,10 @@
+<!-- OSSEC HIDS %%VERSION%% -->
+
+<!-- DO NOT EDIT - file generated automatically using disabled port options -->
+
+<!--
+    You can indirectly edit this file by copying it to the parent directory.
+    The copied file will not be deleted or modified during port removal or
+    upgrades.
+-->
+
diff --git a/security/ossec-hids-local-config/files/template-header-enabled.xml.in b/security/ossec-hids-local-config/files/template-header-enabled.xml.in
new file mode 100644
index 0000000..224916b
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-header-enabled.xml.in
@@ -0,0 +1,4 @@
+<!-- OSSEC HIDS %%VERSION%% -->
+
+<!-- DO NOT EDIT - file generated automatically using enabled port options -->
+
diff --git a/security/ossec-hids-local-config/files/template-header-sample.xml.in b/security/ossec-hids-local-config/files/template-header-sample.xml.in
new file mode 100644
index 0000000..e0772c3
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-header-sample.xml.in
@@ -0,0 +1 @@
+<!-- Place customized configuration here - it will not be overwritten during upgrades. -->
diff --git a/security/ossec-hids-local-config/files/template-logs-apache.xml.in b/security/ossec-hids-local-config/files/template-logs-apache.xml.in
new file mode 100644
index 0000000..b88ed1a
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-apache.xml.in
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_APACHE_PROFILE%%">
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/httpd-error.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/httpd-access.log</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_APACHE_PROFILE%%">
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/apache2/error.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/apache2/access.log</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-logs-default.xml.in b/security/ossec-hids-local-config/files/template-logs-default.xml.in
new file mode 100644
index 0000000..47b9a77
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-default.xml.in
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_DEFAULT_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/auth.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/maillog</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/messages</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/security</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/userlog</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/xferlog</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_DEFAULT_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/auth.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/dpkg.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/kern.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/mail.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/messages</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/syslog</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-logs-nginx.xml.in b/security/ossec-hids-local-config/files/template-logs-nginx.xml.in
new file mode 100644
index 0000000..7d25cf8
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-nginx.xml.in
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_NGINX_PROFILE%%">
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/nginx/error.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/nginx/access.log</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_NGINX_PROFILE%%">
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/nginx/error.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/nginx/access.log</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-logs-radius.xml.in b/security/ossec-hids-local-config/files/template-logs-radius.xml.in
new file mode 100644
index 0000000..0b10c4b
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-radius.xml.in
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_RADIUS_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/radius.log</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_RADIUS_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/freeradius/radius.log</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-logs-response.xml.in b/security/ossec-hids-local-config/files/template-logs-response.xml.in
new file mode 100644
index 0000000..17828ea
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-response.xml.in
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_RESPONSE_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>%%OSSEC_HOME%%/logs/active-responses.log</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_RESPONSE_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/ossec/logs/active-responses.log</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-logs-vsftpd.xml.in b/security/ossec-hids-local-config/files/template-logs-vsftpd.xml.in
new file mode 100644
index 0000000..9f63a21
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-vsftpd.xml.in
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_VSFTPD_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/vsftpd.log</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_VSFTPD_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/vsftpd.log</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-rootcheck-default.xml.in b/security/ossec-hids-local-config/files/template-rootcheck-default.xml.in
new file mode 100644
index 0000000..63e5f1e
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-rootcheck-default.xml.in
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%ROOTCHECK_PROFILE%%">
+
+  <rootcheck>
+    <rootkit_files>%%OSSEC_HOME%%/etc/shared/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>%%OSSEC_HOME%%/etc/shared/rootkit_trojans.txt</rootkit_trojans>
+    <system_audit>%%OSSEC_HOME%%/etc/shared/system_audit_rcl.txt</system_audit>
+    <system_audit>%%OSSEC_HOME%%/etc/shared/system_audit_ssh.txt</system_audit>
+  </rootcheck>
+
+</template_config>
+
+<template_config os="Linux" profile="%%ROOTCHECK_PROFILE%%">
+
+  <rootcheck>
+    <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
+    <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
+    <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
+    <system_audit>/var/ossec/etc/shared/cis_debian_linux_rcl.txt</system_audit>
+  </rootcheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-rules-cmdout.xml.in b/security/ossec-hids-local-config/files/template-rules-cmdout.xml.in
new file mode 100644
index 0000000..482efd6
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-rules-cmdout.xml.in
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <rules>
+    <include>freebsd_cmdout_rules.xml</include>
+  </rules>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-rules-config.xml.in b/security/ossec-hids-local-config/files/template-rules-config.xml.in
new file mode 100644
index 0000000..2e9102f
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-rules-config.xml.in
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <rules>
+    <include>freebsd_config_rules.xml</include>
+  </rules>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-rules-default.xml.in b/security/ossec-hids-local-config/files/template-rules-default.xml.in
new file mode 100644
index 0000000..e7c18be
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-rules-default.xml.in
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <rules>
+    <include>rules_config.xml</include>
+    <include>ossec_rules.xml</include>
+    <include>syslog_rules.xml</include>
+    <include>sendmail_rules.xml</include>
+    <include>postfix_rules.xml</include>
+    <include>spamd_rules.xml</include>
+    <include>imapd_rules.xml</include>
+    <include>mailscanner_rules.xml</include>
+    <include>ms-exchange_rules.xml</include>
+    <include>courier_rules.xml</include>
+    <include>firewall_rules.xml</include>
+    <include>pix_rules.xml</include>
+    <include>netscreenfw_rules.xml</include>
+    <include>cisco-ios_rules.xml</include>
+    <include>sonicwall_rules.xml</include>
+    <include>pam_rules.xml</include>
+    <include>telnetd_rules.xml</include>
+    <include>sshd_rules.xml</include>
+    <include>solaris_bsm_rules.xml</include>
+    <include>asterisk_rules.xml</include>
+    <include>ms_dhcp_rules.xml</include>
+    <include>arpwatch_rules.xml</include>
+    <include>symantec-av_rules.xml</include>
+    <include>symantec-ws_rules.xml</include>
+    <include>trend-osce_rules.xml</include>
+    <include>hordeimp_rules.xml</include>
+    <include>roundcube_rules.xml</include>
+    <include>wordpress_rules.xml</include>
+    <include>cimserver_rules.xml</include>
+    <include>dovecot_rules.xml</include>
+    <include>vmpop3d_rules.xml</include>
+    <include>vpopmail_rules.xml</include>
+    <include>ftpd_rules.xml</include>
+    <include>proftpd_rules.xml</include>
+    <include>pure-ftpd_rules.xml</include>
+    <include>vsftpd_rules.xml</include>
+    <include>ms_ftpd_rules.xml</include>
+    <include>named_rules.xml</include>
+    <include>exim_rules.xml</include>
+    <include>smbd_rules.xml</include>
+    <include>racoon_rules.xml</include>
+    <include>vpn_concentrator_rules.xml</include>
+    <include>msauth_rules.xml</include>
+    <include>mcafee_av_rules.xml</include>
+    <include>ms-se_rules.xml</include>
+    <include>vmware_rules.xml</include>
+    <include>ids_rules.xml</include>
+    <include>apache_rules.xml</include>
+    <include>web_rules.xml</include>
+    <include>zeus_rules.xml</include>
+    <include>nginx_rules.xml</include>
+    <include>php_rules.xml</include>
+    <include>web_appsec_rules.xml</include>
+    <include>squid_rules.xml</include>
+    <include>attack_rules.xml</include>
+    <include>systemd_rules.xml</include>
+    <include>firewalld_rules.xml</include>
+    <include>mysql_rules.xml</include>
+    <include>postgresql_rules.xml</include>
+    <include>dropbear_rules.xml</include>
+    <include>openbsd_rules.xml</include>
+    <include>apparmor_rules.xml</include>
+    <include>clam_av_rules.xml</include>
+    <include>openbsd-dhcpd_rules.xml</include>
+    <include>nsd_rules.xml</include>
+    <include>owncloud_rules.xml</include>
+    <include>proxmox-ve_rules.xml</include>
+    <include>opensmtpd_rules.xml</include>
+    <include>psad_rules.xml</include>
+    <include>sysmon_rules.xml</include>
+    <include>unbound_rules.xml</include>
+    <include>local_rules.xml</include>
+
+    <!-- Files not included by default -->
+    <!--<include>policy_rules.xml</include>-->
+  </rules>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-sample-agent.xml.in b/security/ossec-hids-local-config/files/template-sample-agent.xml.in
new file mode 100644
index 0000000..8a2fa7b
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-sample-agent.xml.in
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <client>
+    <!-- Specify the IP address of the %%PORTNAME%% server. -->
+    <server-ip>1.2.3.4</server-ip>
+    <!-- Alternatively, specify the hostname of the %%PORTNAME%% server. -->
+    <!-- <server-hostname>example.com</server-hostname> -->
+
+    <!-- Specifies the agent.conf profiles to be used by the agent. Multiple profiles can be included, separated by a comma and a space. -->
+    <!-- <config-profile>%%CLIENT_PROFILES%%</config-profile> -->
+  </client>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-sample-database.xml.in b/security/ossec-hids-local-config/files/template-sample-database.xml.in
new file mode 100644
index 0000000..80f156f
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-sample-database.xml.in
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+  <!-- Run "%%OSSEC_HOME%%/bin/ossec-control enable database" to enable ossec-dbd. -->
+  <database_output>
+    <hostname>localhost</hostname>
+    <username>ossec</username>
+    <password>secret</password>
+    <database>ossec</database>
+    <type>%%DB_TYPE%%</type>
+  </database_output>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-sample-local.xml.in b/security/ossec-hids-local-config/files/template-sample-local.xml.in
new file mode 100644
index 0000000..bf1ec5c
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-sample-local.xml.in
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <global>
+    <!-- Uncomment to enable email notifications. -->
+    <!--
+    <email_notification>yes</email_notification>
+    <email_to>example@example.com</email_to>
+    <smtp_server>smtp.example.com</smtp_server>
+    <email_from>ossecm@example.com</email_from>
+    -->
+
+    <!-- List of IP addresses that should never be blocked by the active response (one per element). -->
+    <white_list>127.0.0.1</white_list>
+  </global>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-sample-server.xml.in b/security/ossec-hids-local-config/files/template-sample-server.xml.in
new file mode 100644
index 0000000..d4efd19
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-sample-server.xml.in
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <remote>
+    <connection>secure</connection>
+    <!-- Because of a bug, setting the address is mandatory for IPv4. -->
+    <local_ip>1.2.3.4</local_ip>
+  </remote>
+
+  <global>
+    <!-- Uncomment to enable email notifications. -->
+    <!--
+    <email_notification>yes</email_notification>
+    <email_to>example@example.com</email_to>
+    <smtp_server>smtp.example.com</smtp_server>
+    <email_from>ossecm@example.com</email_from>
+    -->
+
+    <!-- List of IP addresses that should never be blocked by the active response (one per element). -->
+    <white_list>127.0.0.1</white_list>
+  </global>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-syscheck-default.xml.in b/security/ossec-hids-local-config/files/template-syscheck-default.xml.in
new file mode 100644
index 0000000..78ae8f8
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-syscheck-default.xml.in
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%SYSCHECK_PROFILE%%">
+
+  <syscheck>
+    <directories realtime="yes" check_all="yes">/bin,/sbin,/usr/bin,/usr/sbin,%%PREFIX%%/bin,%%PREFIX%%/sbin</directories>
+    <directories realtime="yes" check_all="yes">/etc,%%PREFIX%%/etc</directories>
+  </syscheck>
+
+</template_config>
+
+<template_config os="Linux" profile="%%SYSCHECK_PROFILE%%">
+
+  <syscheck>
+    <directories realtime="yes" check_all="yes">/bin,/sbin,/usr/bin,/usr/sbin,/usr/local/bin,/usr/local/sbin</directories>
+    <directories realtime="yes" check_all="yes">/etc,/usr/local/etc</directories>
+  </syscheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-syscheck-hostdeny.xml.in b/security/ossec-hids-local-config/files/template-syscheck-hostdeny.xml.in
new file mode 100644
index 0000000..f35f4d5
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-syscheck-hostdeny.xml.in
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%SYSCHECK_PROFILE%%">
+
+  <syscheck>
+    <ignore>/etc/hosts.allow</ignore>
+  </syscheck>
+
+</template_config>
+
+<template_config os="Linux" profile="%%SYSCHECK_PROFILE%%">
+
+  <syscheck>
+    <ignore>/etc/hosts.deny</ignore>
+  </syscheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-syscheck-newfiles.xml.in b/security/ossec-hids-local-config/files/template-syscheck-newfiles.xml.in
new file mode 100644
index 0000000..7a303e5
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-syscheck-newfiles.xml.in
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%SYSCHECK_PROFILE%%">
+
+  <syscheck>
+    <alert_new_files>yes</alert_new_files>
+  </syscheck>
+
+</template_config>
+
+<template_config os="Linux" profile="%%SYSCHECK_PROFILE%%">
+
+  <syscheck>
+    <alert_new_files>yes</alert_new_files>
+  </syscheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-syscheck-noauto.xml.in b/security/ossec-hids-local-config/files/template-syscheck-noauto.xml.in
new file mode 100644
index 0000000..03f5943
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-syscheck-noauto.xml.in
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%SYSCHECK_PROFILE%%">
+
+  <syscheck>
+    <auto_ignore>no</auto_ignore>
+  </syscheck>
+
+</template_config>
+
+<template_config os="Linux" profile="%%SYSCHECK_PROFILE%%">
+
+  <syscheck>
+    <auto_ignore>no</auto_ignore>
+  </syscheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-syscheck-ossec.xml.in b/security/ossec-hids-local-config/files/template-syscheck-ossec.xml.in
new file mode 100644
index 0000000..8342f63
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-syscheck-ossec.xml.in
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%SYSCHECK_PROFILE%%">
+
+  <syscheck>
+    <directories realtime="yes" check_all="yes">%%OSSEC_SYSCHECK_BIN_DIRS%%</directories>
+    <directories realtime="yes" check_all="yes">%%OSSEC_SYSCHECK_ETC_DIRS%%</directories>
+  </syscheck>
+
+</template_config>
+
+<template_config os="Linux" profile="%%SYSCHECK_PROFILE%%">
+
+  <syscheck>
+    <directories realtime="yes" check_all="yes">/var/ossec/bin,/var/ossec/active-response,/var/ossec/agentless</directories>
+    <directories realtime="yes" check_all="yes">/var/ossec/etc,/var/ossec/rules</directories>
+  </syscheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/opt-ar.mk b/security/ossec-hids-local-config/opt-ar.mk
new file mode 100644
index 0000000..bfe9f19
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-ar.mk
@@ -0,0 +1,46 @@
+AR_MANAGED_CONF=	110.active-response.conf
+AR_LOCAL_CONF=		510.active-response.local.conf
+
+AR_DESC=		Active Response
+
+# Default commands
+AR_CMDS_DEFAULT_OPTION=	DEFAULT_C
+AR_CMDS_DEFAULT_DESC=	Commands provided by OSSEC
+AR_CMDS_DEFAULT_DEFINE=	server local
+AR_CMDS_DEFAULT_DEFAULT=server local
+AR_OPTIONS+=		AR_CMDS_DEFAULT
+
+# Config merge commands
+AR_CMDS_MERGE_OPTION=	MERGE_C
+AR_CMDS_MERGE_DESC=	Command to merge configuration files
+AR_CMDS_MERGE_DEFINE=	server local
+AR_CMDS_MERGE_DEFAULT=	server local
+AR_OPTIONS+=		AR_CMDS_MERGE
+
+# Config merge active response
+AR_MERGE_OPTION=	MERGE_AR
+AR_MERGE_DESC=		Merge configuration files when they change
+AR_MERGE_DEFINE=	server local
+AR_MERGE_DEFAULT=	server local
+AR_OPTIONS+=		AR_MERGE
+
+# OSSEC restart active response
+AR_RESTART_OPTION=	RESTART_AR
+AR_RESTART_DESC=	Restart OSSEC when main configuration files change
+AR_RESTART_DEFINE=	server local
+AR_RESTART_DEFAULT=	server local
+AR_OPTIONS+=		AR_RESTART
+
+# Host deny active response
+AR_HOSTDENY_OPTION=	HOSTDENY_AR
+AR_HOSTDENY_DESC=	Block the attacker's IP using access control files
+AR_HOSTDENY_DEFINE=	server local
+AR_HOSTDENY_DEFAULT=
+AR_OPTIONS+=		AR_HOSTDENY
+
+# Firewall drop active response
+AR_FWDROP_OPTION=	FWDROP_AR
+AR_FWDROP_DESC=		Block the attacker's IP on the firewall
+AR_FWDROP_DEFINE=	server local
+AR_FWDROP_DEFAULT=
+AR_OPTIONS+=		AR_FWDROP
diff --git a/security/ossec-hids-local-config/opt-cmdout.mk b/security/ossec-hids-local-config/opt-cmdout.mk
new file mode 100644
index 0000000..98da6dd
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-cmdout.mk
@@ -0,0 +1,27 @@
+CMDOUT_MANAGED_CONF=		140.command-output.conf
+CMDOUT_LOCAL_CONF=		540.command-output.local.conf
+
+CMDOUT_DESC=			Command Output Monitoring
+
+CMDOUT_SCRIPTS=			last-logins open-ports
+
+# Last logins
+CMDOUT_LAST_LOGINS_OPTION=	LOGINS
+CMDOUT_LAST_LOGINS_DESC=	Last logins
+CMDOUT_LAST_LOGINS_DEFINE=	server local agent
+CMDOUT_LAST_LOGINS_DEFAULT=	server local agent
+CMDOUT_OPTIONS+=		CMDOUT_LAST_LOGINS
+
+# Open TCP ports
+CMDOUT_OPEN_PORTS_TCP_OPTION=	PORTS_TCP
+CMDOUT_OPEN_PORTS_TCP_DESC=	Open TCP ports
+CMDOUT_OPEN_PORTS_TCP_DEFINE=	server local agent
+CMDOUT_OPEN_PORTS_TCP_DEFAULT=	server local agent
+CMDOUT_OPTIONS+=		CMDOUT_OPEN_PORTS_TCP
+
+# Open UDP ports
+CMDOUT_OPEN_PORTS_UDP_OPTION=	PORTS_UDP
+CMDOUT_OPEN_PORTS_UDP_DESC=	Open UDP ports
+CMDOUT_OPEN_PORTS_UDP_DEFINE=	server local agent
+CMDOUT_OPEN_PORTS_UDP_DEFAULT=	server local agent
+CMDOUT_OPTIONS+=		CMDOUT_OPEN_PORTS_UDP
diff --git a/security/ossec-hids-local-config/opt-logs.mk b/security/ossec-hids-local-config/opt-logs.mk
new file mode 100644
index 0000000..8352b0b
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-logs.mk
@@ -0,0 +1,52 @@
+LOGS_MANAGED_CONF=	150.logs.conf
+LOGS_LOCAL_CONF=	550.logs.local.conf
+
+LOGS_DESC=		Log Monitoring
+
+# Default logs support
+LOGS_DEFAULT_OPTION=	DEFAULT
+LOGS_DEFAULT_PROFILE=	system-log
+LOGS_DEFAULT_DESC=	Default system logs
+LOGS_DEFAULT_DEFINE=	server local agent pushed
+LOGS_DEFAULT_DEFAULT=	server local pushed
+LOGS_OPTIONS+=		LOGS_DEFAULT
+
+# Active response log support
+LOGS_RESPONSE_OPTION=	RESPONSE
+LOGS_RESPONSE_PROFILE=	active-response-log
+LOGS_RESPONSE_DESC=	Active response log
+LOGS_RESPONSE_DEFINE=	server local agent pushed
+LOGS_RESPONSE_DEFAULT=	server local pushed
+LOGS_OPTIONS+=		LOGS_RESPONSE
+
+# Apache logs support
+LOGS_APACHE_OPTION=	APACHE
+LOGS_APACHE_PROFILE=	apache-log
+LOGS_APACHE_DESC=	Apache logs
+LOGS_APACHE_DEFINE=	server local agent pushed
+LOGS_APACHE_DEFAULT=	pushed
+LOGS_OPTIONS+=		LOGS_APACHE
+
+# Nginx logs support
+LOGS_NGINX_OPTION=	NGINX
+LOGS_NGINX_PROFILE=	nginx-log
+LOGS_NGINX_DESC=	Nginx logs
+LOGS_NGINX_DEFINE=	server local agent pushed
+LOGS_NGINX_DEFAULT=	pushed
+LOGS_OPTIONS+=		LOGS_NGINX
+
+# Radius logs support
+LOGS_RADIUS_OPTION=	RADIUS
+LOGS_RADIUS_PROFILE=	radius-log
+LOGS_RADIUS_DESC=	FreeRADIUS logs
+LOGS_RADIUS_DEFINE=	server local agent pushed
+LOGS_RADIUS_DEFAULT=	pushed
+LOGS_OPTIONS+=		LOGS_RADIUS
+
+# Vsftpd logs support
+LOGS_VSFTPD_OPTION=	VSFTPD
+LOGS_VSFTPD_PROFILE=	vsftpd-log
+LOGS_VSFTPD_DESC=	Vsftpd logs
+LOGS_VSFTPD_DEFINE=	server local agent pushed
+LOGS_VSFTPD_DEFAULT=	pushed
+LOGS_OPTIONS+=		LOGS_VSFTPD
diff --git a/security/ossec-hids-local-config/opt-rootcheck.mk b/security/ossec-hids-local-config/opt-rootcheck.mk
new file mode 100644
index 0000000..3da90af
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-rootcheck.mk
@@ -0,0 +1,12 @@
+ROOTCHECK_MANAGED_CONF=		120.rootcheck.conf
+ROOTCHECK_LOCAL_CONF=		520.rootcheck.local.conf
+
+ROOTCHECK_PROFILE=		rootcheck
+ROOTCHECK_DESC=			System Audit and Rootkit Detection
+
+# Default
+ROOTCHECK_DEFAULT_OPTION=	DEFAULT_RC
+ROOTCHECK_DEFAULT_DESC=		System audit and rootkit detection provided by OSSEC
+ROOTCHECK_DEFAULT_DEFINE=	server local agent pushed
+ROOTCHECK_DEFAULT_DEFAULT=	server local pushed
+ROOTCHECK_OPTIONS+=		ROOTCHECK_DEFAULT
diff --git a/security/ossec-hids-local-config/opt-rules.mk b/security/ossec-hids-local-config/opt-rules.mk
new file mode 100644
index 0000000..c8db7a2
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-rules.mk
@@ -0,0 +1,27 @@
+RULES_MANAGED_CONF=	100.rules.conf
+RULES_LOCAL_CONF=	500.rules.local.conf
+
+RULES_DESC=		Alerting Rules
+
+RULES_FILES=		config cmdout
+
+# Default rules
+RULES_DEFAULT_OPTION=	DEFAULT_R
+RULES_DEFAULT_DESC=	Default rules provided by OSSEC
+RULES_DEFAULT_DEFINE=	server local
+RULES_DEFAULT_DEFAULT=	server local
+RULES_OPTIONS+=		RULES_DEFAULT
+
+# Config rules
+RULES_CONFIG_OPTION=	CONFIG_R
+RULES_CONFIG_DESC=	Alert changes of the OSSEC main configuration files
+RULES_CONFIG_DEFINE=	server local
+RULES_CONFIG_DEFAULT=	server local
+RULES_OPTIONS+=		RULES_CONFIG
+
+# Command output rules
+RULES_CMDOUT_OPTION=	CMDOUT_R
+RULES_CMDOUT_DESC=	Alert changes of output of the monitored commands
+RULES_CMDOUT_DEFINE=	server local
+RULES_CMDOUT_DEFAULT=	server local
+RULES_OPTIONS+=		RULES_CMDOUT
diff --git a/security/ossec-hids-local-config/opt-syscheck.mk b/security/ossec-hids-local-config/opt-syscheck.mk
new file mode 100644
index 0000000..2c1210d
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-syscheck.mk
@@ -0,0 +1,41 @@
+SYSCHECK_MANAGED_CONF=		130.syscheck.conf
+SYSCHECK_LOCAL_CONF=		530.syscheck.local.conf
+
+SYSCHECK_PROFILE=		syscheck
+SYSCHECK_DESC=			File Integrity Checking
+
+# Default direcotries
+SYSCHECK_DEFAULT_OPTION=	DEFAULT_SC
+SYSCHECK_DEFAULT_DESC=		Check "bin", "sbin" and "etc" directories
+SYSCHECK_DEFAULT_DEFINE=	server local agent pushed
+SYSCHECK_DEFAULT_DEFAULT=	server local pushed
+SYSCHECK_OPTIONS+=		SYSCHECK_DEFAULT
+
+# OSSEC directories
+SYSCHECK_OSSEC_OPTION=		OSSEC_SC
+SYSCHECK_OSSEC_DESC=		Check OSSEC directories
+SYSCHECK_OSSEC_DEFINE=		server local agent pushed
+SYSCHECK_OSSEC_DEFAULT=		server local pushed
+SYSCHECK_OPTIONS+=		SYSCHECK_OSSEC
+
+# Alert new files
+SYSCHECK_NEWFILES_OPTION=	NEWFILES_SC
+SYSCHECK_NEWFILES_DESC=		Alert on new files created
+SYSCHECK_NEWFILES_DEFINE=	server local
+SYSCHECK_NEWFILES_DEFAULT=	server local
+SYSCHECK_OPTIONS+=		SYSCHECK_NEWFILES
+
+# Disable auto_ignore
+SYSCHECK_NOAUTO_OPTION=		NOAUTO_SC
+SYSCHECK_NOAUTO_DESC=		Disable auto_ignore feature
+SYSCHECK_NOAUTO_DEFINE=		server local
+SYSCHECK_NOAUTO_DEFAULT=	server local
+SYSCHECK_OPTIONS+=		SYSCHECK_NOAUTO
+
+# Ignore /etc/hosts.allow
+SYSCHECK_HOSTDENY_DEPENDS=	AR_HOSTDENY
+SYSCHECK_HOSTDENY_OPTION=	HOSTDENY_SC
+SYSCHECK_HOSTDENY_DESC=		Ignore access control files
+SYSCHECK_HOSTDENY_DEFINE=	server local agent pushed
+SYSCHECK_HOSTDENY_DEFAULT=	server local pushed
+SYSCHECK_OPTIONS+=		SYSCHECK_HOSTDENY
diff --git a/security/ossec-hids-local-config/pkg-descr b/security/ossec-hids-local-config/pkg-descr
new file mode 100644
index 0000000..0b039e5
--- /dev/null
+++ b/security/ossec-hids-local-config/pkg-descr
@@ -0,0 +1,9 @@
+OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection
+System (HIDS). It has a powerful correlation and analysis engine, integrating
+log analysis, file integrity checking, Windows registry monitoring, centralized
+policy enforcement, rootkit detection, real-time alerting and active response.
+
+This package adds the configuration overlay with samples, additional rules,
+commands, scripts and support for multiple configuration files.
+
+WWW: https://ossec.github.io
diff --git a/security/ossec-hids-local-config/pkg-plist-agent b/security/ossec-hids-local-config/pkg-plist-agent
new file mode 100644
index 0000000..b999785
--- /dev/null
+++ b/security/ossec-hids-local-config/pkg-plist-agent
@@ -0,0 +1,23 @@
+@dir(,ossec,550) %%OSSEC_HOME%%
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response/bin
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/merge-config.sh
+@dir(,,550) %%OSSEC_HOME%%/bin
+@dir(,,550) %%OSSEC_HOME%%/bin/command
+@(,,550) %%OSSEC_HOME%%/bin/command/last-logins.sh
+@(,,550) %%OSSEC_HOME%%/bin/command/open-ports.sh
+@dir(,,550) %%OSSEC_HOME%%/bin/config
+@(,,550) %%OSSEC_HOME%%/bin/config/ossec-conf
+@dir(,ossec,550) %%OSSEC_HOME%%/etc
+@sample(,ossec,640) %%OSSEC_HOME%%/etc/command.conf.sample
+@dir(,ossec,550) %%OSSEC_HOME%%/etc/ossec.conf.d
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/120.rootcheck.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/130.syscheck.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/140.command-output.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/150.logs.conf
+@sample(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/900.local.conf.sample
+@dir(,ossec,550) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/520.rootcheck.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/530.syscheck.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/540.command-output.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/550.logs.local.conf
diff --git a/security/ossec-hids-local-config/pkg-plist-local b/security/ossec-hids-local-config/pkg-plist-local
new file mode 100644
index 0000000..cf90641
--- /dev/null
+++ b/security/ossec-hids-local-config/pkg-plist-local
@@ -0,0 +1,30 @@
+@dir(,ossec,550) %%OSSEC_HOME%%
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response/bin
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/merge-config.sh
+@dir(,,550) %%OSSEC_HOME%%/bin
+@dir(,,550) %%OSSEC_HOME%%/bin/command
+@(,,550) %%OSSEC_HOME%%/bin/command/last-logins.sh
+@(,,550) %%OSSEC_HOME%%/bin/command/open-ports.sh
+@dir(,,550) %%OSSEC_HOME%%/bin/config
+@(,,550) %%OSSEC_HOME%%/bin/config/ossec-conf
+@dir(,ossec,550) %%OSSEC_HOME%%/etc
+@sample(,ossec,640) %%OSSEC_HOME%%/etc/command.conf.sample
+@dir(,ossec,550) %%OSSEC_HOME%%/etc/ossec.conf.d
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/100.rules.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/110.active-response.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/120.rootcheck.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/130.syscheck.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/140.command-output.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/150.logs.conf
+@sample(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/900.local.conf.sample
+@dir(,ossec,550) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/500.rules.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/510.active-response.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/520.rootcheck.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/530.syscheck.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/540.command-output.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/550.logs.local.conf
+@dir(,ossec,550) %%OSSEC_HOME%%/rules
+@(,ossec,640) %%OSSEC_HOME%%/rules/freebsd_cmdout_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/freebsd_config_rules.xml
diff --git a/security/ossec-hids-local-config/pkg-plist-server b/security/ossec-hids-local-config/pkg-plist-server
new file mode 100644
index 0000000..a398f4f
--- /dev/null
+++ b/security/ossec-hids-local-config/pkg-plist-server
@@ -0,0 +1,39 @@
+@dir(,ossec,550) %%OSSEC_HOME%%
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response/bin
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/merge-config.sh
+@dir(,,550) %%OSSEC_HOME%%/bin
+@dir(,,550) %%OSSEC_HOME%%/bin/command
+@(,,550) %%OSSEC_HOME%%/bin/command/last-logins.sh
+@(,,550) %%OSSEC_HOME%%/bin/command/open-ports.sh
+@dir(,,550) %%OSSEC_HOME%%/bin/config
+@(,,550) %%OSSEC_HOME%%/bin/config/agent-conf
+@(,,550) %%OSSEC_HOME%%/bin/config/ossec-conf
+@dir(,ossec,550) %%OSSEC_HOME%%/etc
+@dir(,ossec,550) %%OSSEC_HOME%%/etc/agent.conf.d
+@(,ossec,640) %%OSSEC_HOME%%/etc/agent.conf.d/120.rootcheck.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/agent.conf.d/130.syscheck.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/agent.conf.d/150.logs.conf
+@dir(,ossec,550) %%OSSEC_HOME%%/etc/agent.conf.d/disabled
+@(,ossec,640) %%OSSEC_HOME%%/etc/agent.conf.d/disabled/520.rootcheck.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/agent.conf.d/disabled/530.syscheck.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/agent.conf.d/disabled/550.logs.local.conf
+@sample(,ossec,640) %%OSSEC_HOME%%/etc/command.conf.sample
+@dir(,ossec,550) %%OSSEC_HOME%%/etc/ossec.conf.d
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/100.rules.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/110.active-response.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/120.rootcheck.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/130.syscheck.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/140.command-output.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/150.logs.conf
+@sample(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/900.local.conf.sample
+@dir(,ossec,550) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/500.rules.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/510.active-response.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/520.rootcheck.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/530.syscheck.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/540.command-output.local.conf
+@(,ossec,640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/550.logs.local.conf
+@dir(,ossec,550) %%OSSEC_HOME%%/rules
+@(,ossec,640) %%OSSEC_HOME%%/rules/freebsd_cmdout_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/freebsd_config_rules.xml
diff --git a/security/ossec-hids-local-config/scripts/plist.sh b/security/ossec-hids-local-config/scripts/plist.sh
new file mode 100755
index 0000000..8c7df63
--- /dev/null
+++ b/security/ossec-hids-local-config/scripts/plist.sh
@@ -0,0 +1,113 @@
+#!/bin/sh
+
+# Script generates entries for pkg-plist.
+# Do not use it directly. Use the following command instead:
+#
+# make MAINTAINER_MODE=yes clean plist
+
+OSSEC_TYPE=$1
+OSSEC_HOME=$2
+PLIST=$3
+WORKDIR=$4
+STAGEDIR=$5
+
+staged_plist="${WORKDIR}/.staged-plist"
+fixed_lines=""
+skip_lines=""
+skip_paths=""
+sample_paths="/etc/command.conf.sample /etc/ossec.conf.d/900.local.conf.sample /etc/agent.conf.d/900.local.conf.sample"
+
+print_path() {
+    local path="$1"
+    local command="$2"
+    local full_path="${STAGEDIR}${OSSEC_HOME}${path}"
+    if [ -z "${command}" ]; then
+        command="@"
+        if [ -d "${full_path}" ]; then
+            command="@dir"
+        fi
+    fi
+    local user=`stat -f "%Su" "${full_path}"`
+    if [ "${user}" == "${USER}" ]; then
+        user=""
+    fi
+    local group=`stat -f "%Sg" "${full_path}"`
+    if [ "${group}" == "${GROUP}" ]; then
+        group=""
+    fi
+    local mode=`stat -f "%p" "${full_path}" | tail -c 4`
+    echo -e "${command}(${user},${group},${mode}) %%OSSEC_HOME%%${path}" >> "${PLIST}"
+}
+
+echo -n > "${PLIST}"
+
+print_path
+
+done_paths=""
+while read line; do
+    skip_line=""
+    for e in ${skip_lines}; do
+        if [ "${e}" == "${line}" ]; then
+            skip_line="${e}"
+            break
+        fi
+    done
+    if [ -z "${skip_line}" ]; then
+        path=""
+        case $line in
+            "@dir %%OSSEC_HOME%%"*)
+                path=`echo "${line}" | sed -e "s|@dir %%OSSEC_HOME%%||g"`
+                ;;
+            "%%OSSEC_HOME%%"*)
+                path=`echo "${line}" | sed -e "s|%%OSSEC_HOME%%||g"`
+                ;;
+            "%%"*)
+                unchanged_lines="${unchanged_lines} ${line}"
+                ;;
+        esac
+        if [ -n "${path}" ]; then
+            segments=`echo "${path}" | tr "/" "\n"`
+            path=""
+            for segment in ${segments}; do
+                path="${path}/${segment}"
+                skip_path=""
+                for e in ${skip_paths}; do
+                    if [ "${e}" == "${path}" ]; then
+                        skip_path="${e}"
+                        break
+                    fi
+                done
+                if [ -n "${skip_path}" ]; then
+                    break
+                fi
+                done_path=""
+                for e in ${done_paths}; do
+                    if [ "${e}" == "${path}" ]; then
+                        done_path="${e}"
+                        break
+                    fi
+                done
+                if [ -z "${done_path}" ]; then
+                    done_paths="${done_paths} ${path}"
+                    sample_path=""
+                    for e in ${sample_paths}; do
+                        if [ "${e}" == "${path}" ]; then
+                            sample_path="${e}"
+                            break
+                        fi
+                    done
+                    if [ -n "${sample_path}" ]; then
+                        print_path "${path}" @sample
+                    else
+                        print_path "${path}"
+                    fi
+                fi
+            done
+        fi
+    fi
+done < "${staged_plist}"
+
+unchanged_lines="${unchanged_lines} ${fixed_lines}"
+for line in ${unchanged_lines}; do
+    echo "${line}" >> "${PLIST}"
+done
diff --git a/security/ossec-hids-local-config/scripts/rules.sh b/security/ossec-hids-local-config/scripts/rules.sh
new file mode 100755
index 0000000..65e28e2
--- /dev/null
+++ b/security/ossec-hids-local-config/scripts/rules.sh
@@ -0,0 +1,89 @@
+#!/bin/sh
+
+# Script generates entries for template-rules-default.xml.in.
+# Do not use it directly. Use the following command instead:
+#
+# make MAINTAINER_MODE=yes rules
+
+rules_template=$1
+src_dir=$2
+
+skip_files="policy_rules.xml local_rules.xml"
+append_files="local_rules.xml"
+
+rules=""
+for file in `find "${src_dir}/etc/rules" -depth 1 -name "*.xml"`; do
+    file_name="${file##*/}"
+    skip_file=""
+    for e in ${skip_files}; do
+        if [ "${e}" == "${file_name}" ]; then
+            skip_file="${e}"
+            break
+        fi
+    done
+    if [ -z "${skip_file}" ]; then
+        rule_ids=`sed -Ene 's|^.*<rule[[:space:]]+id="([0-9]+)".*$|\1|p' "${file}"`
+        if [ -n "${rule_ids}" ]; then
+            min_rule_id=`echo "${rule_ids}" | sort -n | head -n 1`
+            ref_rule_ids=`sed -Ene 's|^.*<if_sid>([0-9,]+)</if_sid>.*$|\1|p' "${file}" | tr ',' '\n'`
+            for ref_rule_id in ${ref_rule_ids}; do
+                found_rule_id=""
+                for rule_id in ${rule_ids}; do
+                    if [ "${ref_rule_id}" = "${rule_id}" ]; then
+                        found_rule_id="${rule_id}"
+                        break
+                    fi
+                done
+                if [ -z "${found_rule_id}" ]; then
+                    # The referenced rule id is not present in this file so it must come from another
+                    if [ ${ref_rule_id} -gt ${min_rule_id} ]; then
+                        # Ordering by referenced rule id doesn't need to give proper results, but let's hope it does
+                        min_rule_id=$((ref_rule_id + 1))
+                    fi
+                fi
+            done
+
+            rules="${rules}${min_rule_id} ${file_name}
+"
+        fi
+    fi
+done
+
+echo -n "${rules}" | sort -n
+
+if [ -n "${rules_template}" ]; then
+    rules=`echo -n "${rules}" | sort -n | cut -d' ' -f2`
+    for file_name in ${append_files}; do
+        rules="${rules}
+${file_name}"
+    done
+
+    echo '<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <rules>' > "${rules_template}"
+
+    for rule in ${rules}; do
+        echo "    <include>${rule}</include>" >> "${rules_template}"
+    done
+
+    echo '
+    <!-- Files not included by default -->' >> "${rules_template}"
+
+    for skip_file in ${skip_files}; do
+        append_file=""
+        for e in ${append_files}; do
+            if [ "${e}" == "${skip_file}" ]; then
+                append_file="${e}"
+                break
+            fi
+        done
+        if [ -z "${append_file}" ]; then
+            echo "    <!--<include>${skip_file}</include>-->" >> "${rules_template}"
+        fi
+    done
+
+    echo '  </rules>
+
+</template_config>' >> "${rules_template}"
+fi
diff --git a/security/ossec-hids-local-config/scripts/template-to-agent.sh b/security/ossec-hids-local-config/scripts/template-to-agent.sh
new file mode 100755
index 0000000..3034b1f
--- /dev/null
+++ b/security/ossec-hids-local-config/scripts/template-to-agent.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+if [ $# -lt 3 ]; then
+    echo "Too few arguments"
+    echo "Usage: `basename $0` <ossec_type> <ossec_prefix> <ossec_file>"
+    exit 1
+fi
+
+ossec_type="$1"
+ossec_prefix="$2"
+ossec_file="$3"
+
+if [ ! -f "${ossec_file}" ]; then
+    echo "File \"${ossec_file}\" does not exist"
+    exit 1
+fi
+
+ossec_syscheck_bin_dirs="${ossec_prefix}/bin,${ossec_prefix}/active-response"
+ossec_syscheck_etc_dirs="${ossec_prefix}/etc"
+
+replace() {
+    sed -e 's|<template_config \(.*\)>|<agent_config \1>|' \
+        -e 's|</template_config>|</agent_config>|' \
+        -e "s|%%OSSEC_SYSCHECK_BIN_DIRS%%|${ossec_syscheck_bin_dirs}|" \
+        -e "s|%%OSSEC_SYSCHECK_ETC_DIRS%%|${ossec_syscheck_etc_dirs}|" \
+        "${ossec_file}"
+}
+
+extract() {
+    sed -n '/^<agent_config .*>$/,/^<\/agent_config>$/p'
+}
+
+replace | extract
diff --git a/security/ossec-hids-local-config/scripts/template-to-ossec.sh b/security/ossec-hids-local-config/scripts/template-to-ossec.sh
new file mode 100755
index 0000000..3933446
--- /dev/null
+++ b/security/ossec-hids-local-config/scripts/template-to-ossec.sh
@@ -0,0 +1,45 @@
+#!/bin/sh
+
+if [ $# -lt 3 ]; then
+    echo "Too few arguments"
+    echo "Usage: `basename $0` <ossec_type> <ossec_prefix> <ossec_file>"
+    exit 1
+fi
+
+ossec_type="$1"
+ossec_prefix="$2"
+ossec_file="$3"
+
+if [ ! -f "${ossec_file}" ]; then
+    echo "File \"${ossec_file}\" does not exist"
+    exit 1
+fi
+
+ossec_syscheck_bin_dirs="${ossec_prefix}/bin,${ossec_prefix}/active-response"
+ossec_syscheck_etc_dirs="${ossec_prefix}/etc"
+if [ "${ossec_type}" != "agent" ]; then
+    ossec_syscheck_bin_dirs="${ossec_syscheck_bin_dirs},${ossec_prefix}/agentless"
+    ossec_syscheck_etc_dirs="${ossec_syscheck_etc_dirs},${ossec_prefix}/rules"
+fi
+
+replace() {
+    if grep -q "<template_config>" "${ossec_file}"; then
+        sed -e 's|<template_config>|<ossec_config>|' \
+            -e 's|</template_config>|</ossec_config>|' \
+            -e "s|%%OSSEC_SYSCHECK_BIN_DIRS%%|${ossec_syscheck_bin_dirs}|" \
+            -e "s|%%OSSEC_SYSCHECK_ETC_DIRS%%|${ossec_syscheck_etc_dirs}|" \
+            "${ossec_file}"
+    else
+        sed -e 's|<template_config .*os="FreeBSD".*>|<ossec_config>|' \
+            -e 's|</template_config>|</ossec_config>|' \
+            -e "s|%%OSSEC_SYSCHECK_BIN_DIRS%%|${ossec_syscheck_bin_dirs}|" \
+            -e "s|%%OSSEC_SYSCHECK_ETC_DIRS%%|${ossec_syscheck_etc_dirs}|" \
+            "${ossec_file}"
+    fi
+}
+
+extract() {
+    sed -n '/^<ossec_config.*>$/,/^<\/ossec_config>$/p'
+}
+
+replace | extract
diff --git a/security/ossec-hids-local/Makefile b/security/ossec-hids-local/Makefile
new file mode 100644
index 0000000..2cc888e
--- /dev/null
+++ b/security/ossec-hids-local/Makefile
@@ -0,0 +1,247 @@
+# $FreeBSD$
+
+PORTNAME=	ossec-hids
+PORTVERSION=	3.0.0
+PORTREVISION=
+CATEGORIES=	security
+PKGNAMESUFFIX=	-${OSSEC_TYPE}
+
+MAINTAINER=	dominik.lisiak@bemsoft.pl
+COMMENT=	Security tool to monitor and check logs and intrusions
+
+LICENSE=	GPLv2
+LICENSE_FILE=	${WRKSRC}/LICENSE
+
+OSSEC_TYPE?=	local
+
+.if ${OSSEC_TYPE} == local
+CONFLICTS_INSTALL=	ossec-hids-client-* \
+			ossec-hids-agent-* \
+			ossec-hids-server-*
+.elif ${OSSEC_TYPE} == agent
+CONFLICTS_INSTALL=	ossec-hids-client-* \
+			ossec-hids-local-* \
+			ossec-hids-server-*
+.elif ${OSSEC_TYPE} == server
+CONFLICTS_INSTALL=	ossec-hids-client-* \
+			ossec-hids-agent-* \
+			ossec-hids-local-*
+.endif
+
+.if ${OSSEC_TYPE} != agent
+RUN_DEPENDS=	expect:lang/expect
+.endif
+
+GEOIP_LIB_DEPENDS=	libGeoIP.so:net/GeoIP
+INOTIFY_LIB_DEPENDS=	libinotify.so:devel/libinotify
+PRELUDE_LIB_DEPENDS=	libprelude.so:security/libprelude
+ZEROMQ_LIB_DEPENDS=	libczmq.so:net/czmq
+
+USES=		gmake readline ssl
+MYSQL_USE=	mysql
+PGSQL_USES=	pgsql
+
+USE_GITHUB=	yes
+GH_ACCOUNT=	ossec
+USE_RC_SUBR=	ossec-hids
+
+.if ${OSSEC_TYPE} != agent
+USES+=		shebangfix
+SHEBANG_LANG=	expect
+expect_OLD_CMD=	"/usr/bin/env expect"
+expect_CMD=	${LOCALBASE}/bin/expect
+SHEBANG_FILES=	src/agentlessd/scripts/main.exp \
+		src/agentlessd/scripts/ssh.exp \
+		src/agentlessd/scripts/ssh_asa-fwsmconfig_diff \
+		src/agentlessd/scripts/ssh_foundry_diff \
+		src/agentlessd/scripts/ssh_generic_diff \
+		src/agentlessd/scripts/ssh_integrity_check_bsd \
+		src/agentlessd/scripts/ssh_integrity_check_linux \
+		src/agentlessd/scripts/ssh_nopass.exp \
+		src/agentlessd/scripts/ssh_pixconfig_diff \
+		src/agentlessd/scripts/sshlogin.exp \
+		src/agentlessd/scripts/su.exp
+.endif
+
+OPTIONS_SUB=			yes
+OPTIONS_DEFINE=			DOCS INOTIFY
+
+.if ${OSSEC_TYPE} != agent
+OPTIONS_DEFINE+=		GEOIP PRELUDE ZEROMQ
+
+OPTIONS_RADIO=			DATABASE
+OPTIONS_RADIO_DATABASE=		MYSQL PGSQL
+.endif
+
+OPTIONS_DEFAULT=		INOTIFY
+
+INOTIFY_DESC=		Kevent based real time monitoring
+PRELUDE_DESC=		Sensor support from Prelude SIEM
+ZEROMQ_DESC=		ZeroMQ support (experimental)
+DATABASE_DESC=		Database output
+
+GEOIP_VARS=	OSSEC_ARGS+=USE_GEOIP=yes
+INOTIFY_VARS=	OSSEC_ARGS+=USE_INOTIFY=yes
+PRELUDE_VARS=	OSSEC_ARGS+=USE_PRELUDE=yes
+ZEROMQ_VARS=	OSSEC_ARGS+=USE_ZEROMQ=yes
+MYSQL_VARS=	OSSEC_ARGS+=DATABASE=mysql PKGMSG_FILES+=message-database DB_TYPE=mysql DB_SCHEMA=mysql.schema
+PGSQL_VARS=	OSSEC_ARGS+=DATABASE=pgsql PKGMSG_FILES+=message-database DB_TYPE=postgresql DB_SCHEMA=postgresql.schema
+
+OSSEC_ARGS+=	TARGET=${OSSEC_TYPE}
+.if ${OSSEC_TYPE} == agent
+STRIP_FILES=	agent-auth \
+		manage_agents \
+		ossec-agentd \
+		ossec-execd \
+		ossec-logcollector \
+		ossec-lua \
+		ossec-luac \
+		ossec-syscheckd
+.else
+STRIP_FILES=	agent_control \
+		clear_stats \
+		list_agents \
+		manage_agents \
+		ossec-agentlessd \
+		ossec-analysisd \
+		ossec-authd \
+		ossec-csyslogd \
+		ossec-dbd \
+		ossec-execd \
+		ossec-logcollector \
+		ossec-logtest \
+		ossec-lua \
+		ossec-luac \
+		ossec-maild \
+		ossec-makelists \
+		ossec-monitord \
+		ossec-regex \
+		ossec-remoted \
+		ossec-reportd \
+		ossec-syscheckd \
+		rootcheck_control \
+		syscheck_control \
+		syscheck_update \
+		verify-agent-conf
+.endif
+.if defined(MAINTAINER_MODE)
+OSSEC_HOME=		${PREFIX}/${PORTNAME}
+.else
+OSSEC_HOME?=		${PREFIX}/${PORTNAME}
+.endif
+OSSEC_RC=		${PREFIX}/etc/rc.d/ossec-hids
+FIREWALL_DROP_BIN=	${OSSEC_HOME}/active-response/bin/firewall-drop.sh
+IPFILTER_BIN=		${OSSEC_HOME}/active-response/bin/ipfilter.sh
+RESTART_OSSEC_BIN=	${OSSEC_HOME}/active-response/bin/restart-ossec.sh
+SHARED_DIR=		${OSSEC_HOME}/etc/shared
+INTERNAL_OPTS_CONF=	${OSSEC_HOME}/etc/local_internal_options.conf
+
+.if empty(USER)
+USER=$$(${ID} -un)
+.endif
+.if empty(GROUP)
+GROUP=$$(${ID} -gn)
+.endif
+
+.if !defined(MAINTAINER_MODE)
+USER_ARGS+=	OSSEC_GROUP=${GROUP} \
+		OSSEC_USER=${USER} \
+		OSSEC_USER_MAIL=${USER} \
+		OSSEC_USER_REM=${USER}
+.endif
+OSSEC_USER=	ossec
+OSSEC_GROUP=	ossec
+USERS=		${OSSEC_USER} ossecm ossecr
+GROUPS=		${OSSEC_GROUP}
+
+SUB_LIST+=	PORTNAME=${PORTNAME} \
+		CATEGORY=${CATEGORIES:[1]} \
+		OSSEC_TYPE=${OSSEC_TYPE} \
+		OSSEC_HOME=${OSSEC_HOME} \
+		VERSION=${PORTVERSION} \
+		DB_TYPE=${DB_TYPE} \
+		DB_SCHEMA=${DOCSDIR}/${DB_SCHEMA} \
+		USER=${USER} \
+		OSSEC_USER=${OSSEC_USER} \
+		OSSEC_GROUP=${OSSEC_GROUP} \
+		OSSEC_RC=${OSSEC_RC}
+SUB_FILES=	pkg-install \
+		pkg-deinstall \
+		${PKGMSG_FILES} \
+		restart-ossec.sh
+
+.if defined(MAINTAINER_MODE)
+PLIST_SUB=	OSSEC_HOME=${PORTNAME}
+.else
+PLIST_SUB=	OSSEC_HOME=${OSSEC_HOME}
+.endif
+PLIST=		${PKGDIR}/pkg-plist-${OSSEC_TYPE}
+DOCSFILES=	BUGS CHANGELOG CONTRIBUTORS LICENSE README.md SUPPORT.md
+PKGHELP=	${PKGDIR}/pkg-help-${OSSEC_TYPE}
+PKGMESSAGE=	${WRKDIR}/pkg-message
+PKGMSG_FILES=	message-header
+
+CFLAGS+=	-I${LOCALBASE}/include
+
+BUILD_ARGS+=	${MAKE_ARGS} ${OSSEC_ARGS} PREFIX=${OSSEC_HOME}
+INSTALL_ARGS+=	${USER_ARGS} ${OSSEC_ARGS} PREFIX=${STAGEDIR}${OSSEC_HOME}
+
+.include <bsd.port.pre.mk>
+
+PKGMSG_FILES+=	message-firewall message-config
+
+post-patch:
+	@${REINPLACE_CMD} -e 's|-DLUA_USE_LINUX|& ${CPPFLAGS}|' \
+		-e 's|-lreadline|& ${LDFLAGS}|' \
+		${WRKSRC}/src/external/lua/src/Makefile
+
+do-build:
+	@cd ${WRKSRC}/src; ${SETENV} ${MAKE_ENV} ${MAKE_CMD} ${BUILD_ARGS} build
+
+do-install:
+	@cd ${WRKSRC}/src; ${SETENV} ${MAKE_ENV} ${MAKE_CMD} ${INSTALL_ARGS} install
+
+post-install:
+	@${MV} -f ${STAGEDIR}${INTERNAL_OPTS_CONF} ${STAGEDIR}${INTERNAL_OPTS_CONF}.sample
+	@${MV} -f ${STAGEDIR}${FIREWALL_DROP_BIN} ${STAGEDIR}${IPFILTER_BIN}
+	@${CP} -f ${WRKDIR}/restart-ossec.sh ${STAGEDIR}${RESTART_OSSEC_BIN}
+	@${CHMOD} 550 ${STAGEDIR}${RESTART_OSSEC_BIN}
+.if defined(MAINTAINER_MODE)
+	@${CHOWN} ${USER}:${OSSEC_GROUP} ${STAGEDIR}${RESTART_OSSEC_BIN}
+.endif
+	
+.if ${OSSEC_TYPE} == agent
+.if defined(MAINTAINER_MODE)
+	@for file_name in $$(find "${STAGEDIR}${SHARED_DIR}" -type f); do ${CHMOD} 0644 $${file_name}; ${CHOWN} ${OSSEC_USER}:${OSSEC_GROUP} $${file_name}; done
+.else
+	@for file_name in $$(find "${STAGEDIR}${SHARED_DIR}" -type f); do ${CHMOD} 0644 $${file_name}; done
+.endif
+.endif
+	@${ECHO_CMD} -n > ${PKGMESSAGE}
+.for file_name in ${PKGMSG_FILES}
+	@${CAT} ${WRKDIR}/${file_name} >> ${PKGMESSAGE}
+	@${ECHO_CMD} >> ${PKGMESSAGE}
+.endfor
+.for file_name in ${STRIP_FILES}
+	@${STRIP_CMD} ${STAGEDIR}${OSSEC_HOME}/bin/${file_name}
+.endfor
+
+.if defined(MAINTAINER_MODE)
+plist: makeplist
+	@${SCRIPTDIR}/plist.sh ${OSSEC_TYPE} ${OSSEC_HOME} ${PLIST} ${WRKDIR} ${STAGEDIR}
+.endif
+
+post-install-DOCS-on:
+	@${MKDIR} ${STAGEDIR}${DOCSDIR}
+	@cd ${WRKSRC} && ${INSTALL_DATA} ${DOCSFILES} ${STAGEDIR}${DOCSDIR}
+	@cd ${WRKSRC} && ${INSTALL_DATA} etc/ossec-${OSSEC_TYPE}.conf ${STAGEDIR}${DOCSDIR}/ossec.conf.sample
+
+post-install-MYSQL-on:
+	@${MKDIR} ${STAGEDIR}${DOCSDIR}
+	@cd ${WRKSRC} && ${INSTALL_DATA} src/os_dbd/${DB_SCHEMA} ${STAGEDIR}${DOCSDIR}
+
+post-install-PGSQL-on:
+	@${MKDIR} ${STAGEDIR}${DOCSDIR}
+	@cd ${WRKSRC} && ${INSTALL_DATA} src/os_dbd/${DB_SCHEMA} ${STAGEDIR}${DOCSDIR}
+
+.include <bsd.port.post.mk>
diff --git a/security/ossec-hids-local/distinfo b/security/ossec-hids-local/distinfo
new file mode 100644
index 0000000..bd846f2
--- /dev/null
+++ b/security/ossec-hids-local/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1532285963
+SHA256 (ossec-ossec-hids-3.0.0_GH0.tar.gz) = a271d665ed502b3df4ff055a177159dfc0bc8a69dd44eab1f7c57fe8fff42a98
+SIZE (ossec-ossec-hids-3.0.0_GH0.tar.gz) = 1817324
diff --git a/security/ossec-hids-local/files/message-config.in b/security/ossec-hids-local/files/message-config.in
new file mode 100644
index 0000000..f3a13b3
--- /dev/null
+++ b/security/ossec-hids-local/files/message-config.in
@@ -0,0 +1,2 @@
+Consider installing "%%CATEGORY%%/%%PORTNAME%%-%%OSSEC_TYPE%%-config" to ease
+OSSEC configuration.
diff --git a/security/ossec-hids-local/files/message-database.in b/security/ossec-hids-local/files/message-database.in
new file mode 100644
index 0000000..6115a16
--- /dev/null
+++ b/security/ossec-hids-local/files/message-database.in
@@ -0,0 +1,8 @@
+The database schema file:
+%%DB_SCHEMA%%
+
+To enable database output execute:
+# %%OSSEC_HOME%%/bin/ossec-control enable database
+
+For further steps see the documentation:
+https://www.ossec.net/docs/syntax/head_ossec_config.database_output.html
diff --git a/security/ossec-hids-local/files/message-firewall.in b/security/ossec-hids-local/files/message-firewall.in
new file mode 100644
index 0000000..9e066e6
--- /dev/null
+++ b/security/ossec-hids-local/files/message-firewall.in
@@ -0,0 +1,12 @@
+If you intend to use "firewall-drop" active response on this OSSEC instance
+create the script:
+%%OSSEC_HOME%%/active-response/bin/firewall-drop.sh
+
+You can copy or hard link (symbolic link is not supported) one of the scripts
+already provided by OSSEC:
+%%OSSEC_HOME%%/active-response/bin/ipfilter.sh
+%%OSSEC_HOME%%/active-response/bin/ipfw.sh
+%%OSSEC_HOME%%/active-response/bin/pf.sh
+
+For further steps see the documentation:
+https://www.ossec.net/docs/syntax/head_ossec_config.active-response.html
diff --git a/security/ossec-hids-local/files/message-header.in b/security/ossec-hids-local/files/message-header.in
new file mode 100644
index 0000000..d05e6d8
--- /dev/null
+++ b/security/ossec-hids-local/files/message-header.in
@@ -0,0 +1,10 @@
+All the files related to OSSEC have been installed in:
+%%OSSEC_HOME%%
+
+You need to create main configuration file:
+%%OSSEC_HOME%%/etc/ossec.conf
+
+For information on proper configuration see:
+https://www.ossec.net/docs/syntax/ossec_config.html
+
+To enable the startup script add ossec_hids_enable="YES" to /etc/rc.conf.
diff --git a/security/ossec-hids-local/files/ossec-hids.in b/security/ossec-hids-local/files/ossec-hids.in
new file mode 100644
index 0000000..08efa1d
--- /dev/null
+++ b/security/ossec-hids-local/files/ossec-hids.in
@@ -0,0 +1,264 @@
+#!/bin/sh
+#
+# PROVIDE: ossec_hids
+# REQUIRE: DAEMON
+# BEFORE:  LOGIN
+# KEYWORD: shutdown
+
+# ossec_hids_enable (bool):         Set it to YES to enable %%PORTNAME%%.
+#                                   Default: NO
+# ossec_hids_clear_log (bool):      Set it to YES to clear ossec.log before %%PORTNAME%% startup.
+#                                   Default: NO
+# ossec_hids_clear_ar_log (bool):   Set it to YES to clear active-responses.log before %%PORTNAME%% startup.
+#                                   Default: NO
+# ossec_hids_fetch_time (int):      Time in seconds to wait for the shared configuration to be downloaded from the server.
+#                                   Used only by agent installation.
+#                                   Default: 60
+
+. /etc/rc.subr
+
+name="ossec_hids"
+rcvar=ossec_hids_enable
+
+load_rc_config $name
+
+: ${ossec_hids_enable="NO"}
+: ${ossec_hids_clear_log="NO"}
+: ${ossec_hids_clear_ar_log="NO"}
+: ${ossec_hids_fetch_time=60}
+
+ossec_type="%%OSSEC_TYPE%%"
+ossec_home="%%OSSEC_HOME%%"
+
+ossec_conf="${ossec_home}/etc/ossec.conf"
+ossec_conf_dir="${ossec_home}/etc/ossec.conf.d"
+ossec_conf_bin="${ossec_home}/bin/config/ossec-conf"
+
+agent_conf="${ossec_home}/etc/shared/agent.conf"
+agent_conf_dir="${ossec_home}/etc/agent.conf.d"
+agent_conf_bin="${ossec_home}/bin/config/agent-conf"
+
+ossec_client_keys="${ossec_home}/etc/client.keys"
+ossec_ar_tmp="${ossec_home}/active-response"
+ossec_log="${ossec_home}/logs/ossec.log"
+ossec_ar_log="${ossec_home}/logs/active-responses.log"
+ossec_merged="${ossec_home}/etc/shared/merged.mg"
+
+ossec_local_time="/etc/localtime"
+
+ossec_fts_queue="${ossec_home}/queue/fts/fts-queue"
+ossec_ig_queue="${ossec_home}/queue/fts/ig-queue"
+
+extra_commands="reload ossec_conf"
+case ${ossec_type} in
+    server)
+        extra_commands="${extra_commands} agent_conf"
+        ;;
+    agent)
+        extra_commands="${extra_commands} fetch_config"
+        ;;
+esac
+if [ -x "${ossec_conf_bin}" ]; then
+    extra_commands="${extra_commands} merge_config"
+fi
+
+start_cmd="ossec_hids_command start"
+stop_cmd="ossec_hids_command stop"
+restart_cmd="ossec_hids_command restart"
+status_cmd="ossec_hids_command status"
+reload_cmd="ossec_hids_command reload"
+fetch_config_cmd="ossec_hids_command restart"
+merge_config_cmd="ossec_hids_create_configs force"
+ossec_conf_cmd="ossec_hids_ossec_conf"
+agent_conf_cmd="ossec_hids_agent_conf"
+
+start_precmd="ossec_hids_prepare"
+restart_precmd="ossec_hids_prepare"
+reload_precmd="ossec_hids_prepare"
+fetch_config_precmd="ossec_hids_prepare"
+
+ossec_hids_create_file() {
+    local path=$1
+    local owner=$2
+    local mode=$3
+
+    if [ ! -e "${path}" ]; then
+        touch "${path}" && chown ${owner} "${path}" && chmod ${mode} "${path}"
+    fi
+}
+
+ossec_hids_check() {
+    case ${ossec_type} in
+        server)
+            if [ ! -s "${ossec_client_keys}" ]; then
+                echo "WARNING: There are no client keys created - remote connections will be disabled"
+            fi
+            ;;
+        agent)
+            if [ ! -s "${ossec_client_keys}" ]; then
+                echo "WARNING: There are is no client key imported - connection to server not possible"
+            fi
+            ;;
+    esac
+
+    return 0
+}
+
+ossec_hids_config_is_outdated() {
+    dst_file="$1"
+    src_dir="$2"
+
+    if [ ! -e "${dst_file}" ]; then
+        return 0
+    fi
+
+    for src_file in $(find "${src_dir}" -maxdepth 1 -type f -name "*.conf"); do
+        if [ "${src_file}" -nt "${dst_file}" ]; then
+            return 0
+        fi
+    done
+
+    return 1
+}
+
+ossec_hids_create_configs() {
+    case ${ossec_type} in
+        server)
+            if [ -x "${agent_conf_bin}" ]; then
+                # Merge agent.conf.d files into agent.conf
+                if [ "$1" == "force" ] || ossec_hids_config_is_outdated "${agent_conf}" "${agent_conf_dir}"; then
+                    ossec_hids_create_file "${agent_conf}" %%USER%%:%%OSSEC_GROUP%% 0640
+                    "${agent_conf_bin}" > "${agent_conf}"
+                fi
+            fi
+            ;;
+        agent)
+            # Touch agent.conf so the agent daemons won't complain if it doesn't exist
+            ossec_hids_create_file "${agent_conf}" %%OSSEC_USER%%:%%OSSEC_GROUP%% 0644
+            ;;
+    esac
+
+    if [ -x "${ossec_conf_bin}" ]; then
+        # Merge ossec.conf.d files into ossec.conf
+        if [ "$1" == "force" ] || ossec_hids_config_is_outdated "${ossec_conf}" "${ossec_conf_dir}"; then
+            ossec_hids_create_file "${ossec_conf}" %%USER%%:%%OSSEC_GROUP%% 0640
+            "${ossec_conf_bin}" > "${ossec_conf}"
+        fi
+    fi
+
+    return 0
+}
+
+ossec_hids_create_logs() {
+    # Create required log files if they don't exist
+    ossec_hids_create_file "${ossec_log}" %%OSSEC_USER%%:%%OSSEC_GROUP%% 0660
+    ossec_hids_create_file "${ossec_ar_log}" %%OSSEC_USER%%:%%OSSEC_GROUP%% 0660
+
+    return 0
+}
+
+ossec_hids_create_env() {
+    # Copy required files from outside of home directory
+    if [ ! -e "${ossec_local_time}" ]; then
+        echo "Missing \"${ossec_local_time}\". Run command \"tzsetup\"."
+        return 1
+    fi
+    install -o %%USER%% -g %%OSSEC_GROUP%% -m 0440 "${ossec_local_time}" "${ossec_home}${ossec_local_time}"
+
+    # Install missing files
+    case ${ossec_type} in
+        server)
+            ossec_hids_create_file "${ossec_fts_queue}" %%OSSEC_USER%%:%%OSSEC_GROUP%% 0640
+            ossec_hids_create_file "${ossec_ig_queue}" %%OSSEC_USER%%:%%OSSEC_GROUP%% 0640
+            ;;
+    esac
+
+    return 0
+}
+
+ossec_hids_clean() {
+    if [ "${ossec_type}" == "server" ]; then
+        rm -f "${ossec_merged}"
+    fi
+
+    if checkyesno ossec_hids_clear_log; then
+        echo -n > "${ossec_log}"
+    fi
+
+    if checkyesno ossec_hids_clear_ar_log; then
+        echo -n > "${ossec_ar_log}"
+    fi
+
+    return 0
+}
+
+ossec_hids_fetch_configs() {
+    case ${ossec_type} in
+        agent)
+            rm -f "${ossec_merged}"
+            ossec_hids_command stop
+            sleep 1
+            ossec_hids_command start
+            echo "Waiting ${ossec_hids_fetch_time} seconds for the shared configuration to be downloaded from the OSSEC server"
+            sleep ${ossec_hids_fetch_time}
+            if [ ! -s "${ossec_merged}" ]; then
+                echo "Failed to download shared configuration from the OSSEC server"
+                return 1
+            fi
+            ;;
+        *)
+            echo "Shared configuration is only available for agent installations"
+            return 1
+            ;;
+    esac
+
+    return 0
+}
+
+ossec_hids_prepare() {
+    case ${rc_arg} in
+        start|restart)
+            ossec_hids_create_logs && \
+            ossec_hids_create_env && \
+            ossec_hids_create_configs && \
+            ossec_hids_clean && \
+            ossec_hids_check || return 1
+            ;;
+        fetch_config)
+            ossec_hids_create_logs && \
+            ossec_hids_create_env && \
+            ossec_hids_create_configs && \
+            ossec_hids_clean && \
+            ossec_hids_fetch_configs && \
+            ossec_hids_check || return 1
+            ;;
+        reload)
+            ossec_hids_create_env && \
+            ossec_hids_create_configs || return 1
+            ;;
+    esac
+
+    return 0
+}
+
+ossec_hids_ossec_conf() {
+    if [ -x "${ossec_conf_bin}" ]; then
+        "${ossec_conf_bin}"
+    elif [ -f "${ossec_conf}" ]; then
+        cat "${ossec_conf}"
+    fi
+}
+
+ossec_hids_agent_conf() {
+    if [ -x "${agent_conf_bin}" ]; then
+        "${agent_conf_bin}"
+    elif [ -f "${agent_conf}" ]; then
+        cat "${agent_conf}"
+    fi
+}
+
+ossec_hids_command() {
+    "${ossec_home}/bin/ossec-control" "$1"
+}
+
+run_rc_command "$1"
diff --git a/security/ossec-hids-local/files/patch-active-response_host-deny.sh b/security/ossec-hids-local/files/patch-active-response_host-deny.sh
new file mode 100644
index 0000000..aff6243
--- /dev/null
+++ b/security/ossec-hids-local/files/patch-active-response_host-deny.sh
@@ -0,0 +1,15 @@
+--- active-response/host-deny.sh.orig	2018-06-26 12:15:38 UTC
++++ active-response/host-deny.sh
+@@ -126,10 +126,10 @@ if [ "x${ACTION}" = "xadd" ]; then
+ # Deleting from hosts.deny
+ elif [ "x${ACTION}" = "xdelete" ]; then
+    lock;
+-   TMP_FILE=`mktemp /var/ossec/ossec-hosts.XXXXXXXXXX`
++   TMP_FILE=`mktemp ${PWD}/ossec-hosts.XXXXXXXXXX`
+    if [ "X${TMP_FILE}" = "X" ]; then
+      # Cheap fake tmpfile, but should be harder then no random data
+-     TMP_FILE="/var/ossec/ossec-hosts.`cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -1 `"
++     TMP_FILE="${PWD}/ossec-hosts.`cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -1 `"
+    fi
+    echo "${IP}" | grep "\:" > /dev/null 2>&1
+    if [ $? = 0 ]; then
diff --git a/security/ossec-hids-local/files/patch-src_Makefile b/security/ossec-hids-local/files/patch-src_Makefile
new file mode 100644
index 0000000..06cd53c
--- /dev/null
+++ b/security/ossec-hids-local/files/patch-src_Makefile
@@ -0,0 +1,19 @@
+--- src/Makefile.orig	2018-06-26 12:15:38 UTC
++++ src/Makefile
+@@ -397,7 +397,6 @@ endif
+ 	install -d -m 0750 -o ${OSSEC_USER} -g ${OSSEC_GROUP} ${PREFIX}/queue/diff
+ 
+ 	install -d -m 0550 -o root -g ${OSSEC_GROUP} ${PREFIX}/etc
+-	install -m 0440 -o root -g ${OSSEC_GROUP} /etc/localtime ${PREFIX}/etc
+ 
+ 	install -d -m 1550 -o root -g ${OSSEC_GROUP} ${PREFIX}/tmp
+ 
+@@ -425,7 +424,7 @@ endif
+ endif
+ 
+ 	install -d -m 0770 -o root -g ${OSSEC_GROUP} ${PREFIX}/etc/shared
+-	install -m 0640 -o ossec -g ${OSSEC_GROUP} rootcheck/db/*.txt ${PREFIX}/etc/shared/
++	install -m 0640 -o ${OSSEC_USER} -g ${OSSEC_GROUP} rootcheck/db/*.txt ${PREFIX}/etc/shared/
+ 
+ 	install -d -m 0550 -o root -g ${OSSEC_GROUP} ${PREFIX}/active-response
+ 	install -d -m 0550 -o root -g ${OSSEC_GROUP} ${PREFIX}/active-response/bin
diff --git a/security/ossec-hids-local/files/patch-src_init_adduser.sh b/security/ossec-hids-local/files/patch-src_init_adduser.sh
new file mode 100644
index 0000000..21c0d0b
--- /dev/null
+++ b/security/ossec-hids-local/files/patch-src_init_adduser.sh
@@ -0,0 +1,11 @@
+--- src/init/adduser.sh.orig	2018-06-26 12:15:38 UTC
++++ src/init/adduser.sh
+@@ -69,7 +69,7 @@ else
+     fi
+ 
+     if [ -x /usr/bin/getent ]; then
+-        if [ `getent group ossec | wc -l` -lt 1 ]; then
++        if [ `getent group "${GROUP}" | wc -l` -lt 1 ]; then
+             ${GROUPADD} "${GROUP}"
+         fi
+     elif ! grep "^${GROUP}" /etc/group > /dev/null 2>&1; then
diff --git a/security/ossec-hids-local/files/patch-src_os__net_os__net.c b/security/ossec-hids-local/files/patch-src_os__net_os__net.c
new file mode 100644
index 0000000..fe99e5c
--- /dev/null
+++ b/security/ossec-hids-local/files/patch-src_os__net_os__net.c
@@ -0,0 +1,24 @@
+--- src/os_net/os_net.c.orig	2017-12-19 21:30:31 UTC
++++ src/os_net/os_net.c
+@@ -48,16 +48,16 @@ int OS_Bindport(char *_port, unsigned in
+ 
+ 
+     memset(&hints, 0, sizeof(struct addrinfo));
+-#ifdef AI_V4MAPPED
+-    hints.ai_family = AF_INET6;    /* Allow IPv4 and IPv6 */
+-    hints.ai_flags = AI_PASSIVE | AI_ADDRCONFIG | AI_V4MAPPED;
+-#else
++//#ifdef AI_V4MAPPED
++//    hints.ai_family = AF_INET6;    /* Allow IPv4 and IPv6 */
++//    hints.ai_flags = AI_PASSIVE | AI_ADDRCONFIG | AI_V4MAPPED;
++//#else
+     /* Certain *BSD OS (eg. OpenBSD) do not allow binding to a
+        single-socket for both IPv4 and IPv6 per RFC 3493.  This will 
+        allow one or the other based on _ip. */
+     hints.ai_family = AF_UNSPEC;    /* Allow IPv4 or IPv6 */
+     hints.ai_flags = AI_PASSIVE;
+-#endif
++//#endif
+     hints.ai_protocol = _proto;
+     if (_proto == IPPROTO_UDP) {
+         hints.ai_socktype = SOCK_DGRAM;
diff --git a/security/ossec-hids-local/files/patch-src_rootcheck_db_system__audit__rcl.txt b/security/ossec-hids-local/files/patch-src_rootcheck_db_system__audit__rcl.txt
new file mode 100644
index 0000000..424c10e
--- /dev/null
+++ b/security/ossec-hids-local/files/patch-src_rootcheck_db_system__audit__rcl.txt
@@ -0,0 +1,11 @@
+--- src/rootcheck/db/system_audit_rcl.txt.orig	2017-12-19 21:30:31 UTC
++++ src/rootcheck/db/system_audit_rcl.txt
+@@ -25,7 +25,7 @@
+ # Multiple patterns can be specified by using " && " between them.
+ # (All of them must match for it to return true).
+ 
+-$php.ini=/etc/php.ini,/var/www/conf/php.ini,/etc/php5/apache2/php.ini;
++$php.ini=/etc/php.ini,/var/www/conf/php.ini,/etc/php5/apache2/php.ini,/usr/local/etc/php.ini;
+ $web_dirs=/var/www,/var/htdocs,/home/httpd,/usr/local/apache,/usr/local/apache2,/usr/local/www;
+ 
+ # PHP checks
diff --git a/security/ossec-hids-local/files/pkg-deinstall.in b/security/ossec-hids-local/files/pkg-deinstall.in
new file mode 100644
index 0000000..d081d40
--- /dev/null
+++ b/security/ossec-hids-local/files/pkg-deinstall.in
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+ossec_home="%%OSSEC_HOME%%"
+ar_conf="${ossec_home}/etc/shared/ar.conf"
+merged_mg="${ossec_home}/etc/shared/merged.mg"
+client_keys="${ossec_home}/etc/client.keys"
+firewall_drop="${ossec_home}/active-response/bin/firewall-drop.sh"
+local_time="${ossec_home}/etc/localtime"
+
+if [ "$2" == "DEINSTALL"  ]; then
+    rm -f "${ar_conf}"
+    rm -f "${merged_mg}"
+    if [ ! -s "${client_keys}" ]; then
+        rm -f "${client_keys}"
+    fi
+    rm -f "${firewall_drop}"
+    rm -f "${local_time}"
+fi
diff --git a/security/ossec-hids-local/files/pkg-install.in b/security/ossec-hids-local/files/pkg-install.in
new file mode 100644
index 0000000..d819e70
--- /dev/null
+++ b/security/ossec-hids-local/files/pkg-install.in
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+ossec_home="%%OSSEC_HOME%%"
+client_keys="${ossec_home}/etc/client.keys"
+
+create_file() {
+    local path=$1
+    local owner=$2
+    local mode=$3
+
+    if [ ! -e "${path}" ]; then
+        touch "${path}" && chown ${owner} "${path}" && chmod ${mode} "${path}"
+    fi
+}
+
+if [ "$2" == "POST-INSTALL"  ]; then
+    pw usermod %%OSSEC_USER%% -d "${ossec_home}"
+    pw usermod ossecm -d "${ossec_home}"
+    pw usermod ossecr -d "${ossec_home}"
+    chown %%USER%%:%%OSSEC_GROUP%% "${ossec_home}"
+
+    create_file "${client_keys}" root:ossec 0640
+fi
diff --git a/security/ossec-hids-local/files/restart-ossec.sh.in b/security/ossec-hids-local/files/restart-ossec.sh.in
new file mode 100644
index 0000000..9b8a649
--- /dev/null
+++ b/security/ossec-hids-local/files/restart-ossec.sh.in
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+# This script is part of FreeBSD port - report any issues to the port MAINTAINER
+
+ossec_type="%%OSSEC_TYPE%%"
+ossec_home="%%OSSEC_HOME%%"
+ossec_rc="%%OSSEC_RC%%"
+
+ACTION=$1
+USER=$2
+IP=$3
+
+LOCAL=`dirname $0`;
+cd $LOCAL
+cd ../../tmp
+
+# Logging the call
+echo "`date` $0 $1 $2 $3 $4 $5" >> "${ossec_home}/logs/active-responses.log"
+
+case ${ACTION} in
+    add)
+        "${ossec_rc}" restart
+        exit 0
+        ;;
+    delete)
+        exit 0
+        ;;
+    *)
+        echo "$0: invalid action: ${ACTION}"
+        exit 1
+        ;;
+esac
diff --git a/security/ossec-hids-local/pkg-descr b/security/ossec-hids-local/pkg-descr
new file mode 100644
index 0000000..3156a70
--- /dev/null
+++ b/security/ossec-hids-local/pkg-descr
@@ -0,0 +1,6 @@
+OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection
+System (HIDS). It has a powerful correlation and analysis engine, integrating
+log analysis, file integrity checking, Windows registry monitoring, centralized
+policy enforcement, rootkit detection, real-time alerting and active response.
+
+WWW: https://ossec.github.io
diff --git a/security/ossec-hids-local/pkg-plist-agent b/security/ossec-hids-local/pkg-plist-agent
new file mode 100644
index 0000000..01ddca8
--- /dev/null
+++ b/security/ossec-hids-local/pkg-plist-agent
@@ -0,0 +1,70 @@
+@dir(,ossec,550) %%OSSEC_HOME%%
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response/bin
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/disable-account.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/firewalld-drop.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/host-deny.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ip-customblock.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ipfilter.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ipfw.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ipfw_mac.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/npf.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ossec-pagerduty.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ossec-slack.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ossec-tweeter.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/pf.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/restart-ossec.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/route-null.sh
+@dir(,,550) %%OSSEC_HOME%%/bin
+@(,,550) %%OSSEC_HOME%%/bin/agent-auth
+@(,,550) %%OSSEC_HOME%%/bin/manage_agents
+@(,,550) %%OSSEC_HOME%%/bin/ossec-agentd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-control
+@(,,550) %%OSSEC_HOME%%/bin/ossec-execd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-logcollector
+@(,,550) %%OSSEC_HOME%%/bin/ossec-lua
+@(,,550) %%OSSEC_HOME%%/bin/ossec-luac
+@(,,550) %%OSSEC_HOME%%/bin/ossec-syscheckd
+@(,,550) %%OSSEC_HOME%%/bin/util.sh
+@dir(,ossec,550) %%OSSEC_HOME%%/etc
+@(,ossec,640) %%OSSEC_HOME%%/etc/internal_options.conf
+@sample(,ossec,640) %%OSSEC_HOME%%/etc/local_internal_options.conf.sample
+@dir(,ossec,770) %%OSSEC_HOME%%/etc/shared
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_apache2224_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_debian_linux_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_mysql5-6_community_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_mysql5-6_enterprise_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_rhel5_linux_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_rhel6_linux_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_rhel7_linux_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_rhel_linux_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_sles11_linux_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_sles12_linux_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_domainL1_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_domainL2_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_memberL1_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_memberL2_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/rootkit_files.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/rootkit_trojans.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/system_audit_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/system_audit_ssh.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/win_applications_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/win_audit_rcl.txt
+@(ossec,ossec,644) %%OSSEC_HOME%%/etc/shared/win_malware_rcl.txt
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/logs
+@dir(,ossec,550) %%OSSEC_HOME%%/queue
+@dir(ossec,ossec,770) %%OSSEC_HOME%%/queue/alerts
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/diff
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/ossec
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/rids
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/syscheck
+@dir(,ossec,550) %%OSSEC_HOME%%/tmp
+@dir(,ossec,550) %%OSSEC_HOME%%/var
+@dir(,ossec,770) %%OSSEC_HOME%%/var/run
+%%PORTDOCS%%%%DOCSDIR%%/BUGS
+%%PORTDOCS%%%%DOCSDIR%%/CHANGELOG
+%%PORTDOCS%%%%DOCSDIR%%/CONTRIBUTORS
+%%PORTDOCS%%%%DOCSDIR%%/LICENSE
+%%PORTDOCS%%%%DOCSDIR%%/README.md
+%%PORTDOCS%%%%DOCSDIR%%/SUPPORT.md
+%%PORTDOCS%%%%DOCSDIR%%/ossec.conf.sample
diff --git a/security/ossec-hids-local/pkg-plist-local b/security/ossec-hids-local/pkg-plist-local
new file mode 100644
index 0000000..21e358e
--- /dev/null
+++ b/security/ossec-hids-local/pkg-plist-local
@@ -0,0 +1,185 @@
+@dir(,ossec,550) %%OSSEC_HOME%%
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response/bin
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/disable-account.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/firewalld-drop.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/host-deny.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ip-customblock.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ipfilter.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ipfw.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ipfw_mac.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/npf.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ossec-pagerduty.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ossec-slack.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ossec-tweeter.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/pf.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/restart-ossec.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/route-null.sh
+@dir(,ossec,550) %%OSSEC_HOME%%/agentless
+@(,ossec,550) %%OSSEC_HOME%%/agentless/main.exp
+@(,ossec,550) %%OSSEC_HOME%%/agentless/register_host.sh
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh.exp
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_asa-fwsmconfig_diff
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_foundry_diff
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_generic_diff
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_integrity_check_bsd
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_integrity_check_linux
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_nopass.exp
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_pixconfig_diff
+@(,ossec,550) %%OSSEC_HOME%%/agentless/sshlogin.exp
+@(,ossec,550) %%OSSEC_HOME%%/agentless/su.exp
+@dir(,,550) %%OSSEC_HOME%%/bin
+@(,,550) %%OSSEC_HOME%%/bin/agent_control
+@(,,550) %%OSSEC_HOME%%/bin/clear_stats
+@(,,550) %%OSSEC_HOME%%/bin/list_agents
+@(,,550) %%OSSEC_HOME%%/bin/manage_agents
+@(,,550) %%OSSEC_HOME%%/bin/ossec-agentlessd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-analysisd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-authd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-control
+@(,,550) %%OSSEC_HOME%%/bin/ossec-csyslogd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-dbd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-execd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-logcollector
+@(,,550) %%OSSEC_HOME%%/bin/ossec-logtest
+@(,,550) %%OSSEC_HOME%%/bin/ossec-lua
+@(,,550) %%OSSEC_HOME%%/bin/ossec-luac
+@(,,550) %%OSSEC_HOME%%/bin/ossec-maild
+@(,,550) %%OSSEC_HOME%%/bin/ossec-makelists
+@(,,550) %%OSSEC_HOME%%/bin/ossec-monitord
+@(,,550) %%OSSEC_HOME%%/bin/ossec-regex
+@(,,550) %%OSSEC_HOME%%/bin/ossec-remoted
+@(,,550) %%OSSEC_HOME%%/bin/ossec-reportd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-syscheckd
+@(,,550) %%OSSEC_HOME%%/bin/rootcheck_control
+@(,,550) %%OSSEC_HOME%%/bin/syscheck_control
+@(,,550) %%OSSEC_HOME%%/bin/syscheck_update
+@(,,550) %%OSSEC_HOME%%/bin/util.sh
+@(,,550) %%OSSEC_HOME%%/bin/verify-agent-conf
+@dir(,ossec,550) %%OSSEC_HOME%%/etc
+@(,ossec,640) %%OSSEC_HOME%%/etc/decoder.xml
+@(,ossec,640) %%OSSEC_HOME%%/etc/internal_options.conf
+@sample(,ossec,640) %%OSSEC_HOME%%/etc/local_internal_options.conf.sample
+@dir(,ossec,770) %%OSSEC_HOME%%/etc/shared
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_apache2224_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_debian_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_mysql5-6_community_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_mysql5-6_enterprise_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_rhel5_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_rhel6_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_rhel7_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_rhel_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_sles11_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_sles12_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_domainL1_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_domainL2_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_memberL1_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_memberL2_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/rootkit_files.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/rootkit_trojans.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/system_audit_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/system_audit_ssh.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/win_applications_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/win_audit_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/win_malware_rcl.txt
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/logs
+@dir(,ossec,550) %%OSSEC_HOME%%/rules
+@(,ossec,640) %%OSSEC_HOME%%/rules/apache_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/apparmor_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/arpwatch_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/asterisk_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/attack_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/cimserver_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/cisco-ios_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/clam_av_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/courier_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/dovecot_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/dropbear_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/exim_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/firewall_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/firewalld_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ftpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/hordeimp_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ids_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/imapd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/local_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/mailscanner_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/mcafee_av_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ms-exchange_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ms-se_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ms_dhcp_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ms_ftpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/msauth_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/mysql_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/named_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/netscreenfw_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/nginx_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/nsd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/openbsd-dhcpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/openbsd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/opensmtpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ossec_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/owncloud_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/pam_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/php_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/pix_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/policy_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/postfix_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/postgresql_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/proftpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/proxmox-ve_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/psad_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/pure-ftpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/racoon_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/roundcube_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/rules_config.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/sendmail_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/smbd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/solaris_bsm_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/sonicwall_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/spamd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/squid_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/sshd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/symantec-av_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/symantec-ws_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/syslog_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/sysmon_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/systemd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/telnetd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/trend-osce_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/unbound_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/vmpop3d_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/vmware_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/vpn_concentrator_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/vpopmail_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/vsftpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/web_appsec_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/web_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/wordpress_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/zeus_rules.xml
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/logs/alerts
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/logs/archives
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/logs/firewall
+@dir(,ossec,550) %%OSSEC_HOME%%/queue
+@dir(ossecr,ossec,750) %%OSSEC_HOME%%/queue/agent-info
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/agentless
+@dir(ossec,ossec,770) %%OSSEC_HOME%%/queue/alerts
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/diff
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/fts
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/ossec
+@dir(ossecr,ossec,750) %%OSSEC_HOME%%/queue/rids
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/rootcheck
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/syscheck
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/stats
+@dir(,ossec,550) %%OSSEC_HOME%%/tmp
+@dir(,ossec,550) %%OSSEC_HOME%%/var
+@dir(,ossec,770) %%OSSEC_HOME%%/var/run
+%%PORTDOCS%%%%DOCSDIR%%/BUGS
+%%PORTDOCS%%%%DOCSDIR%%/CHANGELOG
+%%PORTDOCS%%%%DOCSDIR%%/CONTRIBUTORS
+%%PORTDOCS%%%%DOCSDIR%%/LICENSE
+%%PORTDOCS%%%%DOCSDIR%%/README.md
+%%PORTDOCS%%%%DOCSDIR%%/SUPPORT.md
+%%PORTDOCS%%%%DOCSDIR%%/ossec.conf.sample
+%%MYSQL%%%%DOCSDIR%%/mysql.schema
+%%PGSQL%%%%DOCSDIR%%/postgresql.schema
diff --git a/security/ossec-hids-local/pkg-plist-server b/security/ossec-hids-local/pkg-plist-server
new file mode 100644
index 0000000..21e358e
--- /dev/null
+++ b/security/ossec-hids-local/pkg-plist-server
@@ -0,0 +1,185 @@
+@dir(,ossec,550) %%OSSEC_HOME%%
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response
+@dir(,ossec,550) %%OSSEC_HOME%%/active-response/bin
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/disable-account.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/firewalld-drop.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/host-deny.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ip-customblock.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ipfilter.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ipfw.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ipfw_mac.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/npf.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ossec-pagerduty.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ossec-slack.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/ossec-tweeter.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/pf.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/restart-ossec.sh
+@(,ossec,550) %%OSSEC_HOME%%/active-response/bin/route-null.sh
+@dir(,ossec,550) %%OSSEC_HOME%%/agentless
+@(,ossec,550) %%OSSEC_HOME%%/agentless/main.exp
+@(,ossec,550) %%OSSEC_HOME%%/agentless/register_host.sh
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh.exp
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_asa-fwsmconfig_diff
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_foundry_diff
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_generic_diff
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_integrity_check_bsd
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_integrity_check_linux
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_nopass.exp
+@(,ossec,550) %%OSSEC_HOME%%/agentless/ssh_pixconfig_diff
+@(,ossec,550) %%OSSEC_HOME%%/agentless/sshlogin.exp
+@(,ossec,550) %%OSSEC_HOME%%/agentless/su.exp
+@dir(,,550) %%OSSEC_HOME%%/bin
+@(,,550) %%OSSEC_HOME%%/bin/agent_control
+@(,,550) %%OSSEC_HOME%%/bin/clear_stats
+@(,,550) %%OSSEC_HOME%%/bin/list_agents
+@(,,550) %%OSSEC_HOME%%/bin/manage_agents
+@(,,550) %%OSSEC_HOME%%/bin/ossec-agentlessd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-analysisd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-authd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-control
+@(,,550) %%OSSEC_HOME%%/bin/ossec-csyslogd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-dbd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-execd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-logcollector
+@(,,550) %%OSSEC_HOME%%/bin/ossec-logtest
+@(,,550) %%OSSEC_HOME%%/bin/ossec-lua
+@(,,550) %%OSSEC_HOME%%/bin/ossec-luac
+@(,,550) %%OSSEC_HOME%%/bin/ossec-maild
+@(,,550) %%OSSEC_HOME%%/bin/ossec-makelists
+@(,,550) %%OSSEC_HOME%%/bin/ossec-monitord
+@(,,550) %%OSSEC_HOME%%/bin/ossec-regex
+@(,,550) %%OSSEC_HOME%%/bin/ossec-remoted
+@(,,550) %%OSSEC_HOME%%/bin/ossec-reportd
+@(,,550) %%OSSEC_HOME%%/bin/ossec-syscheckd
+@(,,550) %%OSSEC_HOME%%/bin/rootcheck_control
+@(,,550) %%OSSEC_HOME%%/bin/syscheck_control
+@(,,550) %%OSSEC_HOME%%/bin/syscheck_update
+@(,,550) %%OSSEC_HOME%%/bin/util.sh
+@(,,550) %%OSSEC_HOME%%/bin/verify-agent-conf
+@dir(,ossec,550) %%OSSEC_HOME%%/etc
+@(,ossec,640) %%OSSEC_HOME%%/etc/decoder.xml
+@(,ossec,640) %%OSSEC_HOME%%/etc/internal_options.conf
+@sample(,ossec,640) %%OSSEC_HOME%%/etc/local_internal_options.conf.sample
+@dir(,ossec,770) %%OSSEC_HOME%%/etc/shared
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_apache2224_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_debian_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_mysql5-6_community_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_mysql5-6_enterprise_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_rhel5_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_rhel6_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_rhel7_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_rhel_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_sles11_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_sles12_linux_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_domainL1_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_domainL2_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_memberL1_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/cis_win2012r2_memberL2_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/rootkit_files.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/rootkit_trojans.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/system_audit_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/system_audit_ssh.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/win_applications_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/win_audit_rcl.txt
+@(ossec,ossec,640) %%OSSEC_HOME%%/etc/shared/win_malware_rcl.txt
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/logs
+@dir(,ossec,550) %%OSSEC_HOME%%/rules
+@(,ossec,640) %%OSSEC_HOME%%/rules/apache_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/apparmor_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/arpwatch_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/asterisk_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/attack_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/cimserver_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/cisco-ios_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/clam_av_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/courier_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/dovecot_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/dropbear_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/exim_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/firewall_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/firewalld_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ftpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/hordeimp_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ids_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/imapd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/local_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/mailscanner_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/mcafee_av_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ms-exchange_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ms-se_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ms_dhcp_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ms_ftpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/msauth_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/mysql_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/named_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/netscreenfw_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/nginx_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/nsd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/openbsd-dhcpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/openbsd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/opensmtpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/ossec_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/owncloud_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/pam_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/php_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/pix_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/policy_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/postfix_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/postgresql_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/proftpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/proxmox-ve_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/psad_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/pure-ftpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/racoon_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/roundcube_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/rules_config.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/sendmail_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/smbd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/solaris_bsm_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/sonicwall_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/spamd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/squid_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/sshd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/symantec-av_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/symantec-ws_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/syslog_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/sysmon_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/systemd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/telnetd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/trend-osce_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/unbound_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/vmpop3d_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/vmware_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/vpn_concentrator_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/vpopmail_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/vsftpd_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/web_appsec_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/web_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/wordpress_rules.xml
+@(,ossec,640) %%OSSEC_HOME%%/rules/zeus_rules.xml
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/logs/alerts
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/logs/archives
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/logs/firewall
+@dir(,ossec,550) %%OSSEC_HOME%%/queue
+@dir(ossecr,ossec,750) %%OSSEC_HOME%%/queue/agent-info
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/agentless
+@dir(ossec,ossec,770) %%OSSEC_HOME%%/queue/alerts
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/diff
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/fts
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/ossec
+@dir(ossecr,ossec,750) %%OSSEC_HOME%%/queue/rids
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/rootcheck
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/queue/syscheck
+@dir(ossec,ossec,750) %%OSSEC_HOME%%/stats
+@dir(,ossec,550) %%OSSEC_HOME%%/tmp
+@dir(,ossec,550) %%OSSEC_HOME%%/var
+@dir(,ossec,770) %%OSSEC_HOME%%/var/run
+%%PORTDOCS%%%%DOCSDIR%%/BUGS
+%%PORTDOCS%%%%DOCSDIR%%/CHANGELOG
+%%PORTDOCS%%%%DOCSDIR%%/CONTRIBUTORS
+%%PORTDOCS%%%%DOCSDIR%%/LICENSE
+%%PORTDOCS%%%%DOCSDIR%%/README.md
+%%PORTDOCS%%%%DOCSDIR%%/SUPPORT.md
+%%PORTDOCS%%%%DOCSDIR%%/ossec.conf.sample
+%%MYSQL%%%%DOCSDIR%%/mysql.schema
+%%PGSQL%%%%DOCSDIR%%/postgresql.schema
diff --git a/security/ossec-hids-local/scripts/plist.sh b/security/ossec-hids-local/scripts/plist.sh
new file mode 100755
index 0000000..8a3dfcd
--- /dev/null
+++ b/security/ossec-hids-local/scripts/plist.sh
@@ -0,0 +1,119 @@
+#!/bin/sh
+
+# Script generates entries for pkg-plist.
+# Do not use it directly. Use the following command instead:
+#
+# make MAINTAINER_MODE=yes clean plist
+
+OSSEC_TYPE=$1
+OSSEC_HOME=$2
+PLIST=$3
+WORKDIR=$4
+STAGEDIR=$5
+
+staged_plist="${WORKDIR}/.staged-plist"
+fixed_lines=""
+if [ "${OSSEC_TYPE}" != "agent" ]; then
+    fixed_lines="${fixed_lines} %%MYSQL%%%%DOCSDIR%%/mysql.schema %%PGSQL%%%%DOCSDIR%%/postgresql.schema"
+fi
+skip_lines="%%PORTDOCS%%%%DOCSDIR%%/mysql.schema %%PORTDOCS%%%%DOCSDIR%%/postgresql.schema"
+skip_paths="/etc/ossec.conf /etc/client.keys /logs/active-responses.log /logs/ossec.log /lua /.ssh"
+sample_paths="/etc/local_internal_options.conf.sample"
+if [ "${OSSEC_TYPE}" == "agent" ]; then
+    skip_paths="${skip_paths} /rules /agentless"
+fi
+
+print_path() {
+    local path="$1"
+    local command="$2"
+    local full_path="${STAGEDIR}${OSSEC_HOME}${path}"
+    if [ -z "${command}" ]; then
+        command="@"
+        if [ -d "${full_path}" ]; then
+            command="@dir"
+        fi
+    fi
+    local user=`stat -f "%Su" "${full_path}"`
+    if [ "${user}" == "${USER}" ]; then
+        user=""
+    fi
+    local group=`stat -f "%Sg" "${full_path}"`
+    if [ "${group}" == "${GROUP}" ]; then
+        group=""
+    fi
+    local mode=`stat -f "%p" "${full_path}" | tail -c 4`
+    echo -e "${command}(${user},${group},${mode}) %%OSSEC_HOME%%${path}" >> "${PLIST}"
+}
+
+echo -n > "${PLIST}"
+
+print_path
+
+done_paths=""
+while read line; do
+    skip_line=""
+    for e in ${skip_lines}; do
+        if [ "${e}" == "${line}" ]; then
+            skip_line="${e}"
+            break
+        fi
+    done
+    if [ -z "${skip_line}" ]; then
+        path=""
+        case $line in
+            "@dir %%OSSEC_HOME%%"*)
+                path=`echo "${line}" | sed -e "s|@dir %%OSSEC_HOME%%||g"`
+                ;;
+            "%%OSSEC_HOME%%"*)
+                path=`echo "${line}" | sed -e "s|%%OSSEC_HOME%%||g"`
+                ;;
+            "%%"*)
+                unchanged_lines="${unchanged_lines} ${line}"
+                ;;
+        esac
+        if [ -n "${path}" ]; then
+            segments=`echo "${path}" | tr "/" "\n"`
+            path=""
+            for segment in ${segments}; do
+                path="${path}/${segment}"
+                skip_path=""
+                for e in ${skip_paths}; do
+                    if [ "${e}" == "${path}" ]; then
+                        skip_path="${e}"
+                        break
+                    fi
+                done
+                if [ -n "${skip_path}" ]; then
+                    break
+                fi
+                done_path=""
+                for e in ${done_paths}; do
+                    if [ "${e}" == "${path}" ]; then
+                        done_path="${e}"
+                        break
+                    fi
+                done
+                if [ -z "${done_path}" ]; then
+                    done_paths="${done_paths} ${path}"
+                    sample_path=""
+                    for e in ${sample_paths}; do
+                        if [ "${e}" == "${path}" ]; then
+                            sample_path="${e}"
+                            break
+                        fi
+                    done
+                    if [ -n "${sample_path}" ]; then
+                        print_path "${path}" @sample
+                    else
+                        print_path "${path}"
+                    fi
+                fi
+            done
+        fi
+    fi
+done < "${staged_plist}"
+
+unchanged_lines="${unchanged_lines} ${fixed_lines}"
+for line in ${unchanged_lines}; do
+    echo "${line}" >> "${PLIST}"
+done
diff --git a/security/ossec-hids-server-config/Makefile b/security/ossec-hids-server-config/Makefile
new file mode 100644
index 0000000..e48b24c
--- /dev/null
+++ b/security/ossec-hids-server-config/Makefile
@@ -0,0 +1,7 @@
+# $FreeBSD$
+
+OSSEC_TYPE=	server
+
+MASTERDIR=	${.CURDIR}/../ossec-hids-local-config
+
+.include "${MASTERDIR}/Makefile"
diff --git a/security/ossec-hids-server/Makefile b/security/ossec-hids-server/Makefile
new file mode 100644
index 0000000..6018efa
--- /dev/null
+++ b/security/ossec-hids-server/Makefile
@@ -0,0 +1,7 @@
+# $FreeBSD$
+
+OSSEC_TYPE=	server
+
+MASTERDIR=	${.CURDIR}/../ossec-hids-local
+
+.include "${MASTERDIR}/Makefile"
diff --git a/security/ossec-hids/Makefile b/security/ossec-hids/Makefile
new file mode 100644
index 0000000..b797b75
--- /dev/null
+++ b/security/ossec-hids/Makefile
@@ -0,0 +1,35 @@
+# $FreeBSD$
+
+PORTNAME=	ossec-hids
+PORTVERSION=	3.0.0
+PORTREVISION=
+CATEGORIES=	security
+
+MAINTAINER=	dominik.lisiak@bemsoft.pl
+COMMENT=	Security tool to monitor and check logs and intrusions
+
+LICENSE=	GPLv2
+
+RUN_DEPENDS=	ossec-hids-${OSSEC_TYPE}>=${PORTVERSION}:security/ossec-hids-${OSSEC_TYPE}
+
+USES=		metaport
+
+OPTIONS_DEFINE=		CONFIG
+
+OPTIONS_SINGLE=		G_TYPE
+OPTIONS_SINGLE_G_TYPE=	LOCAL AGENT SERVER
+
+OPTIONS_DEFAULT=	CONFIG LOCAL
+
+CONFIG_DESC=		Install configuration manager and samples
+G_TYPE_DESC=		Installation type
+LOCAL_DESC=		Analizes local data only (standalone)
+AGENT_DESC=		Sends local data to the server for analysis
+SERVER_DESC=		Analizes local data and data received from multiple agents
+
+CONFIG_VARS=		RUN_DEPENDS+=ossec-hids-${OSSEC_TYPE}-config>=${PORTVERSION}:security/ossec-hids-${OSSEC_TYPE}-config
+LOCAL_VARS=		OSSEC_TYPE=local
+AGENT_VARS=		OSSEC_TYPE=agent
+SERVER_VARS=		OSSEC_TYPE=server
+
+.include <bsd.port.mk>
diff --git a/security/ossec-hids/pkg-descr b/security/ossec-hids/pkg-descr
new file mode 100644
index 0000000..3156a70
--- /dev/null
+++ b/security/ossec-hids/pkg-descr
@@ -0,0 +1,6 @@
+OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection
+System (HIDS). It has a powerful correlation and analysis engine, integrating
+log analysis, file integrity checking, Windows registry monitoring, centralized
+policy enforcement, rootkit detection, real-time alerting and active response.
+
+WWW: https://ossec.github.io