66 files changed, 2165 insertions, 0 deletions

diff --git a/security/ossec-hids-local-config/Makefile b/security/ossec-hids-local-config/Makefile
new file mode 100644
index 000000000000..9a8b11fc901a
--- /dev/null
+++ b/security/ossec-hids-local-config/Makefile
@@ -0,0 +1,460 @@
+# $FreeBSD$
+
+PORTNAME=	ossec-hids
+PORTVERSION=	3.1.0
+PORTREVISION=
+CATEGORIES=	security
+PKGNAMESUFFIX=	-${OSSEC_TYPE}-config
+
+MAINTAINER=	dominik.lisiak@bemsoft.pl
+COMMENT=	Configuration manager for ossec-hids
+
+LICENSE=	GPLv2
+
+OSSEC_TYPE?=	local
+
+MASTERDIR?=	${.CURDIR}
+
+.if ${OSSEC_TYPE} == local
+CONFLICTS_INSTALL=	ossec-hids-client-* \
+			ossec-hids-agent-* \
+			ossec-hids-server-*
+.elif ${OSSEC_TYPE} == agent
+CONFLICTS_INSTALL=	ossec-hids-client-* \
+			ossec-hids-local-* \
+			ossec-hids-server-*
+.elif ${OSSEC_TYPE} == server
+CONFLICTS_INSTALL=	ossec-hids-client-* \
+			ossec-hids-agent-* \
+			ossec-hids-local-*
+.endif
+
+.if !defined(MAINTAINER_MODE)
+RUN_DEPENDS=	ossec-hids-${OSSEC_TYPE}>=${PORTVERSION}:security/ossec-hids-${OSSEC_TYPE}
+.endif
+
+.if defined(MAINTAINER_MODE)
+USE_GITHUB=	yes
+GH_ACCOUNT=	ossec
+.else
+MASTER_SITES=	#
+DISTFILES=	#
+EXTRACT_ONLY=	#
+.endif
+NO_BUILD=	yes
+NO_ARCH=	yes
+
+OPTIONS_SUB=			yes
+
+OPTIONS_SINGLE=			FIREWALL
+OPTIONS_SINGLE_FIREWALL=	IPF IPFW PF
+
+OPTIONS_DEFAULT+=		IPF
+
+FIREWALL_DESC=		Active Response Firewall
+PF_DESC=		Packet Filter
+IPFW_DESC=		ipfirewall
+IPF_DESC=		ipfilter
+
+TEMPL_ENABLED_HEADER=		template-header-enabled.xml
+TEMPL_DISABLED_HEADER=		template-header-disabled.xml
+TEMPL_SAMPLE_HEADER=		template-header-sample.xml
+TEMPL_PUSHED_ENABLED_HEADER=	${TEMPL_ENABLED_HEADER}
+TEMPL_PUSHED_DISABLED_HEADER=	${TEMPL_DISABLED_HEADER}
+
+TEMPL_SAMPLE=		template-sample-${OSSEC_TYPE}.xml
+TEMPL_SAMPLE_DB=	template-sample-database.xml
+
+PF_VARS=		FW_DROP=pf.sh PKGMSG_FILES+=message-pf
+IPFW_VARS=		FW_DROP=ipfw.sh
+IPF_VARS=		FW_DROP=ipfilter.sh
+
+.if defined(MAINTAINER_MODE)
+OSSEC_HOME=		${PREFIX}/${PORTNAME}
+.else
+OSSEC_HOME?=		${PREFIX}/${PORTNAME}
+.endif
+OSSEC_RC=		${PREFIX}/etc/rc.d/ossec-hids
+TEMPL_TO_OSSEC=		${SCRIPTDIR}/template-to-ossec.sh ${OSSEC_TYPE} ${OSSEC_HOME}
+TEMPL_TO_AGENT=		${SCRIPTDIR}/template-to-agent.sh ${OSSEC_TYPE} ${OSSEC_HOME}
+
+OSSEC_DIR=		${STAGEDIR}${OSSEC_HOME}
+BIN_DIR=		${OSSEC_DIR}/bin
+CONF_BIN_DIR=		${BIN_DIR}/config
+OSSEC_CONF_BIN=		${CONF_BIN_DIR}/ossec-conf
+AGENT_CONF_BIN=		${CONF_BIN_DIR}/agent-conf
+COMMAND_BIN_DIR=	${BIN_DIR}/command
+
+AR_BIN_DIR=		${OSSEC_DIR}/active-response/bin
+MERGE_CONFIG_BIN=	${AR_BIN_DIR}/merge-config.sh
+
+ETC_DIR=		${OSSEC_DIR}/etc
+OSSEC_CONF_DIR=		${ETC_DIR}/ossec.conf.d
+AGENT_CONF_DIR=		${ETC_DIR}/agent.conf.d
+OSSEC_LOCAL_CONF_DIR=	${OSSEC_CONF_DIR}/disabled
+AGENT_LOCAL_CONF_DIR=	${AGENT_CONF_DIR}/disabled
+OSSEC_SAMPLE_CONF=	${OSSEC_CONF_DIR}/900.local.conf.sample
+COMMAND_CONF_DIR=	${ETC_DIR}
+COMMAND_CONF=		${COMMAND_CONF_DIR}/command.conf.sample
+RULES_DIR=		${OSSEC_DIR}/rules
+
+.if empty(USER)
+USER=$$(${ID} -un)
+.endif
+.if empty(GROUP)
+GROUP=$$(${ID} -gn)
+.endif
+
+OSSEC_USER=	ossec
+OSSEC_GROUP=	ossec
+
+SUB_LIST+=	PORTNAME=${PORTNAME} \
+		OSSEC_TYPE=${OSSEC_TYPE} \
+		OSSEC_HOME=${OSSEC_HOME} \
+		VERSION=${PORTVERSION} \
+		USER=${USER} \
+		OSSEC_USER=${OSSEC_USER} \
+		OSSEC_GROUP=${OSSEC_GROUP} \
+		OSSEC_RC=${OSSEC_RC} \
+		FW_DROP=${FW_DROP}
+SUB_FILES=	pkg-install \
+		pkg-deinstall \
+		${PKGMSG_FILES} \
+		${TEMPL_ENABLED_HEADER} \
+		${TEMPL_DISABLED_HEADER} \
+		${TEMPL_SAMPLE_HEADER} \
+		${TEMPL_PUSHED_ENABLED_HEADER} \
+		${TEMPL_PUSHED_DISABLED_HEADER} \
+		${TEMPL_SAMPLE} \
+		merge-config.sh \
+		ossec-conf \
+		command.conf
+.if ${OSSEC_TYPE} == server
+SUB_FILES+=	agent-conf
+.endif
+
+.if defined(MAINTAINER_MODE)
+PLIST_SUB=	OSSEC_HOME=${PORTNAME}
+.else
+PLIST_SUB=	OSSEC_HOME=${OSSEC_HOME}
+.endif
+PLIST=		${PKGDIR}/pkg-plist-${OSSEC_TYPE}
+PKGHELP=	${PKGDIR}/pkg-help-${OSSEC_TYPE}
+PKGMESSAGE=	${WRKDIR}/pkg-message
+PKGMSG_FILES=	message-ossec-conf
+.if ${OSSEC_TYPE} == server
+PKGMSG_FILES+=	message-agent-conf
+.endif
+
+CONF_GROUPS=	RULES AR ROOTCHECK SYSCHECK CMDOUT LOGS
+
+############################################################
+
+.for conf_group in ${CONF_GROUPS}
+. include "${MASTERDIR}/opt-${conf_group:tl}.mk"
+${conf_group}_INSTANCE_OPTIONS=
+${conf_group}_PUSHED_OPTIONS=
+. for option in ${${conf_group}_OPTIONS}
+.  if ${${option}_DEFINE:M${OSSEC_TYPE}}
+${conf_group}_INSTANCE_OPTIONS+=		${option}
+${conf_group}_ALL_OPTIONS+=			${option}
+.  endif
+.  if ${${option}_DEFINE:Mpushed}
+.   if ${OSSEC_TYPE} == server
+${conf_group}_PUSHED_OPTIONS+=			${option}
+.   endif
+.   if !${${conf_group}_ALL_OPTIONS:M${option}}
+${conf_group}_ALL_OPTIONS+=			${option}
+.   endif
+.  endif
+. endfor
+.endfor
+
+############################################################
+
+CONFIG_PROFILES=
+.for conf_group in ${CONF_GROUPS}
+. if !empty(${conf_group}_PROFILE)
+.  if ${OSSEC_TYPE} == agent
+.   if !${CONFIG_PROFILES:M${${conf_group}_PROFILE}}
+CONFIG_PROFILES+=	${${conf_group}_PROFILE}
+.   endif
+.  endif
+SUB_LIST+=		${conf_group}_PROFILE=${${conf_group}_PROFILE}
+. endif
+. for option in ${${conf_group}_ALL_OPTIONS}
+.  if !empty(${option}_PROFILE)
+.   if ${OSSEC_TYPE} == agent
+.    if !${CONFIG_PROFILES:M${${option}_PROFILE}}
+CONFIG_PROFILES+=	${${option}_PROFILE}
+.    endif
+.   endif
+SUB_LIST+=		${option}_PROFILE=${${option}_PROFILE}
+.  endif
+. endfor
+.endfor
+
+.for profile in ${CONFIG_PROFILES}
+. if empty(CONFIG_PROFILE_VALUE)
+CONFIG_PROFILE_VALUE:=	${profile}
+. else
+CONFIG_PROFILE_VALUE:=	${CONFIG_PROFILE_VALUE}, ${profile}
+. endif
+.endfor
+SUB_LIST+=		CONFIG_PROFILES="${CONFIG_PROFILE_VALUE}"
+
+############################################################
+
+.for conf_group in ${CONF_GROUPS}
+. for option in ${${conf_group}_ALL_OPTIONS}
+.  if !defined(${option}_TEMPLATE)
+${option}_TEMPLATE=	template-${option:tl:S/_/-/g}.xml
+.  endif
+.  if !empty(${option}_TEMPLATE) && !${SUB_FILES:M${${option}_TEMPLATE}}
+SUB_FILES+=		${${option}_TEMPLATE}
+.  endif
+. endfor
+.endfor
+
+.for file_name in ${RULES_FILES}
+SUB_FILES+=		rules-${file_name}.xml
+.endfor
+
+.for file_name in ${CMDOUT_SCRIPTS}
+SUB_FILES+=		command-${file_name}.sh
+.endfor
+
+############################################################
+
+.for conf_group in ${CONF_GROUPS}
+. for option in ${${conf_group}_INSTANCE_OPTIONS}
+.  if !empty(${option}_DEPENDS) && !empty(${${option}_DEPENDS}_OPTION) && ${${${option}_DEPENDS:S/_/ /:[1]}_INSTANCE_OPTIONS:M${${option}_DEPENDS}}
+${${${option}_DEPENDS}_OPTION}_VARS+=		${conf_group}_INSTANCE_OPTIONS_ENABLED+=${option}
+${${${option}_DEPENDS}_OPTION}_VARS_OFF+=	${conf_group}_INSTANCE_OPTIONS_DISABLED+=${option}
+.  elif !empty(${option}_OPTION)
+OPTIONS_GROUP_G_${conf_group}+=			${${option}_OPTION}
+${${option}_OPTION}_DESC=			${${option}_DESC}
+.   if ${${option}_DEFAULT:M${OSSEC_TYPE}}
+OPTIONS_DEFAULT+=				${${option}_OPTION}
+.   endif
+${${option}_OPTION}_VARS+=			${conf_group}_INSTANCE_OPTIONS_ENABLED+=${option}
+${${option}_OPTION}_VARS_OFF+=			${conf_group}_INSTANCE_OPTIONS_DISABLED+=${option}
+.  endif
+. endfor
+. if !empty(OPTIONS_GROUP_G_${conf_group})
+OPTIONS_GROUP+=			G_${conf_group}
+G_${conf_group}_DESC=		${${conf_group}_DESC}
+. endif
+.endfor
+
+############################################################
+
+.for conf_group in ${CONF_GROUPS}
+. for option in ${${conf_group}_PUSHED_OPTIONS}
+.  if !empty(${option}_DEPENDS) && !empty(${${option}_DEPENDS}_OPTION) && ${${${option}_DEPENDS:S/_/ /:[1]}_PUSHED_OPTIONS:M${${option}_DEPENDS}}
+${${${option}_DEPENDS}_OPTION}_P_VARS+=		${conf_group}_PUSHED_OPTIONS_ENABLED+=${option}
+${${${option}_DEPENDS}_OPTION}_P_VARS_OFF+=	${conf_group}_PUSHED_OPTIONS_DISABLED+=${option}
+.  elif !empty(${option}_DEPENDS) && !empty(${${option}_DEPENDS}_OPTION) && ${${${option}_DEPENDS:S/_/ /:[1]}_INSTANCE_OPTIONS:M${${option}_DEPENDS}}
+${${${option}_DEPENDS}_OPTION}_VARS+=		${conf_group}_PUSHED_OPTIONS_ENABLED+=${option}
+${${${option}_DEPENDS}_OPTION}_VARS_OFF+=	${conf_group}_PUSHED_OPTIONS_DISABLED+=${option}
+.  elif !empty(${option}_OPTION)
+OPTIONS_GROUP_G_${conf_group}_P+=		${${option}_OPTION}_P
+${${option}_OPTION}_P_DESC=			${${option}_DESC}
+.   if !empty(${option}_PROFILE)
+${${option}_OPTION}_P_DESC+=			(profile: ${${option}_PROFILE})
+.   endif
+.   if ${${option}_DEFAULT:Mpushed}
+OPTIONS_DEFAULT+=				${${option}_OPTION}_P
+.   endif
+${${option}_OPTION}_P_VARS+=			${conf_group}_PUSHED_OPTIONS_ENABLED+=${option}
+${${option}_OPTION}_P_VARS_OFF+=		${conf_group}_PUSHED_OPTIONS_DISABLED+=${option}
+.  endif
+. endfor
+. if !empty(OPTIONS_GROUP_G_${conf_group}_P)
+OPTIONS_GROUP+=			G_${conf_group}_P
+G_${conf_group}_P_DESC=		Pushed ${${conf_group}_DESC}
+.  if !empty(${conf_group}_PROFILE)
+G_${conf_group}_P_DESC+=	(profile: ${${conf_group}_PROFILE})
+.  endif
+. endif
+.endfor
+
+############################################################
+
+.include <bsd.port.pre.mk>
+
+show-opts:
+.for conf_group in ${CONF_GROUPS}
+	@${ECHO_CMD} "${conf_group}: ${${conf_group}_DESC}"
+. for option in ${${conf_group}_INSTANCE_OPTIONS}
+	@${ECHO_CMD} "  ${option}: ${${option}_DESC}"
+.  if empty(${option}_TEMPLATE)
+	@${ECHO_CMD} "    Template: -"
+.  else
+	@${ECHO_CMD} "    Template: ${${option}_TEMPLATE}"
+.  endif
+.  if !empty(${conf_group}_INSTANCE_OPTIONS_ENABLED) && ${${conf_group}_INSTANCE_OPTIONS_ENABLED:M${option}}
+	@${ECHO_CMD} "    Enabled:  true"
+.  endif
+.  if !empty(${conf_group}_INSTANCE_OPTIONS_DISABLED) && ${${conf_group}_INSTANCE_OPTIONS_DISABLED:M${option}}
+	@${ECHO_CMD} "    Enabled:  false"
+.  endif
+.  if !empty(${conf_group}_PUSHED_OPTIONS_ENABLED) && ${${conf_group}_PUSHED_OPTIONS_ENABLED:M${option}}
+	@${ECHO_CMD} "    Pushed:   true"
+.  endif
+.  if !empty(${conf_group}_PUSHED_OPTIONS_DISABLED) && ${${conf_group}_PUSHED_OPTIONS_DISABLED:M${option}}
+	@${ECHO_CMD} "    Pushed:   false"
+.  endif
+. endfor
+.endfor
+
+pre-install:
+	@-${OSSEC_HOME}/bin/ossec-dbd -h 2>&1 | ${GREP} -q 'PostgreSQL' && \
+		${SED} -e 's|%%OSSEC_HOME%%|${OSSEC_HOME}|g' -e 's|%%DB_TYPE%%|postgresql|g' \
+		${FILESDIR}/${TEMPL_SAMPLE_DB}.in > ${WRKDIR}/${TEMPL_SAMPLE_DB}
+	@-${OSSEC_HOME}/bin/ossec-dbd -h 2>&1 | ${GREP} -q 'MySQL' && \
+		${SED} -e 's|%%OSSEC_HOME%%|${OSSEC_HOME}|g' -e 's|%%DB_TYPE%%|mysql|g' \
+		${FILESDIR}/${TEMPL_SAMPLE_DB}.in > ${WRKDIR}/${TEMPL_SAMPLE_DB}
+
+ossec-dirs:
+	@${MKDIR} ${CONF_BIN_DIR} ${COMMAND_BIN_DIR} ${AR_BIN_DIR} ${OSSEC_CONF_DIR} ${OSSEC_LOCAL_CONF_DIR} ${COMMAND_CONF_DIR}
+.if ${OSSEC_TYPE} != agent
+	@${MKDIR} ${RULES_DIR}
+.endif
+.if ${OSSEC_TYPE} == server
+	@${MKDIR} ${AGENT_CONF_DIR} ${AGENT_LOCAL_CONF_DIR}
+.endif
+
+ossec-scripts:
+	@${CP} ${WRKDIR}/ossec-conf ${OSSEC_CONF_BIN}
+.if ${OSSEC_TYPE} == server
+	@${CP} ${WRKDIR}/agent-conf ${AGENT_CONF_BIN}
+.endif
+.for file_name in ${CMDOUT_SCRIPTS}
+	@${CP} ${WRKDIR}/command-${file_name}.sh ${COMMAND_BIN_DIR}/${file_name}.sh
+.endfor
+	@${CP} ${WRKDIR}/command.conf ${COMMAND_CONF}
+	@${CP} ${WRKDIR}/merge-config.sh ${MERGE_CONFIG_BIN}
+
+ossec-rules:
+.if ${OSSEC_TYPE} != agent
+. for file_name in ${RULES_FILES}
+	@${SED} -e 's|<?xml.*?>||' ${WRKDIR}/rules-${file_name}.xml > ${RULES_DIR}/freebsd_${file_name}_rules.xml
+. endfor
+.endif
+
+ossec-conf-managed:
+.for conf_group in ${CONF_GROUPS}
+. if !empty(${conf_group}_INSTANCE_OPTIONS)
+	@${CAT} ${WRKDIR}/${TEMPL_ENABLED_HEADER} > ${OSSEC_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+.  if !empty(${conf_group}_INSTANCE_OPTIONS_ENABLED)
+.   for option in ${${conf_group}_INSTANCE_OPTIONS}
+.    if ${${conf_group}_INSTANCE_OPTIONS_ENABLED:M${option}}
+.     if !empty(${option}_TEMPLATE)
+	@${ECHO_CMD} "<!-- Enabled ${${option}_OPTION} -->" >> ${OSSEC_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+	@${SH} ${TEMPL_TO_OSSEC} ${WRKDIR}/${${option}_TEMPLATE} >> ${OSSEC_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+	@${ECHO_CMD} >> ${OSSEC_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+.     endif
+.    endif
+.   endfor
+.  endif
+. endif
+.endfor
+
+ossec-conf-local:
+.for conf_group in ${CONF_GROUPS}
+. if !empty(${conf_group}_INSTANCE_OPTIONS)
+	@${CAT} ${WRKDIR}/${TEMPL_DISABLED_HEADER} > ${OSSEC_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+.  if !empty(${conf_group}_INSTANCE_OPTIONS_DISABLED)
+.   for option in ${${conf_group}_INSTANCE_OPTIONS}
+.    if ${${conf_group}_INSTANCE_OPTIONS_DISABLED:M${option}}
+.     if !empty(${option}_TEMPLATE)
+	@${ECHO_CMD} "<!-- Disabled ${${option}_OPTION} -->" >> ${OSSEC_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+	@${SH} ${TEMPL_TO_OSSEC} ${WRKDIR}/${${option}_TEMPLATE} >> ${OSSEC_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+	@${ECHO_CMD} >> ${OSSEC_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+.     endif
+.    endif
+.   endfor
+.  endif
+. endif
+.endfor
+
+ossec-conf-sample:
+	@${CAT} ${WRKDIR}/${TEMPL_SAMPLE_HEADER} > ${OSSEC_SAMPLE_CONF}
+	@${ECHO_CMD} >> ${OSSEC_SAMPLE_CONF}
+	@${SH} ${TEMPL_TO_OSSEC} ${WRKDIR}/${TEMPL_SAMPLE} >> ${OSSEC_SAMPLE_CONF}
+	@${ECHO_CMD} >> ${OSSEC_SAMPLE_CONF}
+	@-${TEST} -f ${WRKDIR}/${TEMPL_SAMPLE_DB} && \
+		${SH} ${TEMPL_TO_OSSEC} ${WRKDIR}/${TEMPL_SAMPLE_DB} >> ${OSSEC_SAMPLE_CONF} && \
+		${ECHO_CMD} >> ${OSSEC_SAMPLE_CONF}
+
+agent-conf-managed:
+.for conf_group in ${CONF_GROUPS}
+. if !empty(${conf_group}_PUSHED_OPTIONS)
+	@${CAT} ${WRKDIR}/${TEMPL_PUSHED_ENABLED_HEADER} > ${AGENT_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+.  if !empty(${conf_group}_PUSHED_OPTIONS_ENABLED)
+.   for option in ${${conf_group}_PUSHED_OPTIONS}
+.    if ${${conf_group}_PUSHED_OPTIONS_ENABLED:M${option}}
+.     if !empty(${option}_TEMPLATE)
+	@${ECHO_CMD} "<!-- Enabled ${${option}_OPTION}_P -->" >> ${AGENT_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+	@${SH} ${TEMPL_TO_AGENT} ${WRKDIR}/${${option}_TEMPLATE} >> ${AGENT_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+	@${ECHO_CMD} >> ${AGENT_CONF_DIR}/${${conf_group}_MANAGED_CONF}
+.     endif
+.    endif
+.   endfor
+.  endif
+. endif
+.endfor
+
+agent-conf-local:
+.for conf_group in ${CONF_GROUPS}
+. if !empty(${conf_group}_PUSHED_OPTIONS)
+	@${CAT} ${WRKDIR}/${TEMPL_PUSHED_DISABLED_HEADER} > ${AGENT_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+.  if !empty(${conf_group}_PUSHED_OPTIONS_DISABLED)
+.   for option in ${${conf_group}_PUSHED_OPTIONS}
+.    if ${${conf_group}_PUSHED_OPTIONS_DISABLED:M${option}}
+.     if !empty(${option}_TEMPLATE)
+	@${ECHO_CMD} "<!-- Disabled ${${option}_OPTION}_P -->" >> ${AGENT_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+	@${SH} ${TEMPL_TO_AGENT} ${WRKDIR}/${${option}_TEMPLATE} >> ${AGENT_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+	@${ECHO_CMD} >> ${AGENT_LOCAL_CONF_DIR}/${${conf_group}_LOCAL_CONF}
+.     endif
+.    endif
+.   endfor
+.  endif
+. endif
+.endfor
+
+do-install: ossec-dirs ossec-scripts ossec-rules ossec-conf-managed ossec-conf-local ossec-conf-sample agent-conf-managed agent-conf-local
+
+ossec-permissions:
+	@${CHMOD} -R 550 ${OSSEC_DIR}
+	@${CHMOD} 640 ${COMMAND_CONF} ${OSSEC_CONF_DIR}/* ${OSSEC_LOCAL_CONF_DIR}/*
+	@${CHMOD} 550 ${OSSEC_CONF_DIR} ${OSSEC_LOCAL_CONF_DIR}
+.if ${OSSEC_TYPE} != agent
+	@${CHMOD} 640 ${RULES_DIR}/*
+.endif
+.if ${OSSEC_TYPE} == server
+	@${CHMOD} 640 ${AGENT_CONF_DIR}/* ${AGENT_LOCAL_CONF_DIR}/*
+	@${CHMOD} 550 ${AGENT_CONF_DIR} ${AGENT_LOCAL_CONF_DIR}
+.endif
+.if defined(MAINTAINER_MODE)
+	@${CHOWN} -R ${USER}:${OSSEC_GROUP} ${OSSEC_DIR}
+	@${CHOWN} -R ${USER}:${GROUP} ${BIN_DIR}
+.endif
+
+post-install: ossec-permissions
+	@${ECHO_CMD} -n > ${PKGMESSAGE}
+.for file_name in ${PKGMSG_FILES}
+	@${CAT} ${WRKDIR}/${file_name} >> ${PKGMESSAGE}
+	@${ECHO_CMD} >> ${PKGMESSAGE}
+.endfor
+
+.if defined(MAINTAINER_MODE)
+plist: makeplist
+	@${SCRIPTDIR}/plist.sh ${OSSEC_TYPE} ${OSSEC_HOME} ${PLIST} ${WRKDIR} ${STAGEDIR}
+
+rules: extract
+	@${SCRIPTDIR}/rules.sh ${FILESDIR}/${RULES_DEFAULT_TEMPLATE}.in ${WRKSRC}
+.endif
+
+.include <bsd.port.post.mk>
diff --git a/security/ossec-hids-local-config/distinfo b/security/ossec-hids-local-config/distinfo
new file mode 100644
index 000000000000..38a6c3c18fc7
--- /dev/null
+++ b/security/ossec-hids-local-config/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1539459620
+SHA256 (ossec-ossec-hids-3.1.0_GH0.tar.gz) = e0e2987751badb95c2bf618531c7853b2289c910f796da85ff394c0faea43f50
+SIZE (ossec-ossec-hids-3.1.0_GH0.tar.gz) = 1886469
diff --git a/security/ossec-hids-local-config/files/agent-conf.in b/security/ossec-hids-local-config/files/agent-conf.in
new file mode 100644
index 000000000000..673d0f668631
--- /dev/null
+++ b/security/ossec-hids-local-config/files/agent-conf.in
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+ossec_type="%%OSSEC_TYPE%%"
+ossec_home="%%OSSEC_HOME%%"
+
+agent_conf_dir="${ossec_home}/etc/agent.conf.d"
+agent_conf_files="${agent_conf_dir}/*.conf"
+
+select_elements() {
+    local element="$1"
+    sed -n "/<${element}.*>/,/<\/${element}>/p"
+}
+
+remove_comments() {
+    # Comments must be on separate lines i.e. not next to uncommented code
+    awk '/<!--/ {off=1} /-->/ {off=2} /([\s\S]*)/ {if (off==0) print; if (off==2) off=0}'
+}
+
+remove_empty_lines() {
+    sed '/^\s*$/d'
+}
+
+agent_conf() {
+
+    echo "<!-- OSSEC HIDS %%VERSION%% -->"
+    echo
+    echo "<!-- DO NOT EDIT - file generated automatically - edit \"agent.conf.d/900.local.conf\" instead -->"
+    echo
+
+    cat $@ | remove_comments | select_elements "agent_config" | remove_empty_lines
+}
+
+agent_conf "${agent_conf_files}"
diff --git a/security/ossec-hids-local-config/files/command-last-logins.sh.in b/security/ossec-hids-local-config/files/command-last-logins.sh.in
new file mode 100644
index 000000000000..7bd82426ce61
--- /dev/null
+++ b/security/ossec-hids-local-config/files/command-last-logins.sh.in
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+# This script is part of FreeBSD port - report any issues to the port MAINTAINER
+
+ossec_home="%%OSSEC_HOME%%"
+. "${ossec_home}/etc/command.conf"
+
+last -n ${last_logins}
diff --git a/security/ossec-hids-local-config/files/command-open-ports.sh.in b/security/ossec-hids-local-config/files/command-open-ports.sh.in
new file mode 100644
index 000000000000..d5ba04799922
--- /dev/null
+++ b/security/ossec-hids-local-config/files/command-open-ports.sh.in
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# This script is part of FreeBSD port - report any issues to the port MAINTAINER
+
+family=$1
+protocol=$2
+ports=$3
+
+if [ -z "${ports}" ]; then
+    privileged_ports="1-$((`sysctl -n net.inet.ip.portrange.first` - 1))"
+
+    ossec_home="%%OSSEC_HOME%%"
+    . "${ossec_home}/etc/command.conf"
+
+    ports="privileged_${protocol}_ports"
+    eval ports=\$${ports}
+fi
+
+sockstat -l -${family} -P ${protocol} -p ${ports} | grep -Eo '[^[:space:]]+:[0-9]+' | sort -u
diff --git a/security/ossec-hids-local-config/files/command.conf.in b/security/ossec-hids-local-config/files/command.conf.in
new file mode 100644
index 000000000000..b6ef2ad40f50
--- /dev/null
+++ b/security/ossec-hids-local-config/files/command.conf.in
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+last_logins=5
+
+privileged_tcp_ports=${privileged_ports},10050-10051
+privileged_udp_ports=${privileged_ports}
diff --git a/security/ossec-hids-local-config/files/merge-config.sh.in b/security/ossec-hids-local-config/files/merge-config.sh.in
new file mode 100644
index 000000000000..a7939f7d4bee
--- /dev/null
+++ b/security/ossec-hids-local-config/files/merge-config.sh.in
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+# This script is part of FreeBSD port - report any issues to the port MAINTAINER
+
+ossec_type="%%OSSEC_TYPE%%"
+ossec_home="%%OSSEC_HOME%%"
+ossec_rc="%%OSSEC_RC%%"
+
+ACTION=$1
+USER=$2
+IP=$3
+
+LOCAL=`dirname $0`;
+cd $LOCAL
+cd ../../tmp
+
+# Logging the call
+echo "`date` $0 $1 $2 $3 $4 $5" >> "${ossec_home}/logs/active-responses.log"
+
+case ${ACTION} in
+    add)
+        "${ossec_rc}" merge_config
+        exit 0
+        ;;
+    delete)
+        exit 0
+        ;;
+    *)
+        echo "$0: invalid action: ${ACTION}"
+        exit 1
+        ;;
+esac
diff --git a/security/ossec-hids-local-config/files/message-agent-conf.in b/security/ossec-hids-local-config/files/message-agent-conf.in
new file mode 100644
index 000000000000..8d61c0d2e6c9
--- /dev/null
+++ b/security/ossec-hids-local-config/files/message-agent-conf.in
@@ -0,0 +1,3 @@
+The "agent.conf" must no longer be used for configuration. It will be
+overwritten by merged "*.conf" files from the configuration directory:
+%%OSSEC_HOME%%/etc/agent.conf.d
diff --git a/security/ossec-hids-local-config/files/message-ossec-conf.in b/security/ossec-hids-local-config/files/message-ossec-conf.in
new file mode 100644
index 000000000000..d6170ca46130
--- /dev/null
+++ b/security/ossec-hids-local-config/files/message-ossec-conf.in
@@ -0,0 +1,3 @@
+The "ossec.conf" must no longer be used for configuration. It will be
+overwritten by merged "*.conf" files from the configuration directory:
+%%OSSEC_HOME%%/etc/ossec.conf.d
diff --git a/security/ossec-hids-local-config/files/message-pf.in b/security/ossec-hids-local-config/files/message-pf.in
new file mode 100644
index 000000000000..707e44bdc938
--- /dev/null
+++ b/security/ossec-hids-local-config/files/message-pf.in
@@ -0,0 +1,4 @@
+Add the ossec_fwtable to /etc/pf.conf if using "firewall-drop" active response:
+  table <ossec_fwtable> persist
+  block in quick from <ossec_fwtable> to any
+  block out quick from any to <ossec_fwtable>
diff --git a/security/ossec-hids-local-config/files/ossec-conf.in b/security/ossec-hids-local-config/files/ossec-conf.in
new file mode 100644
index 000000000000..d28d238bc212
--- /dev/null
+++ b/security/ossec-hids-local-config/files/ossec-conf.in
@@ -0,0 +1,60 @@
+#!/bin/sh
+
+ossec_type="%%OSSEC_TYPE%%"
+ossec_home="%%OSSEC_HOME%%"
+
+ossec_conf_dir="${ossec_home}/etc/ossec.conf.d"
+ossec_conf_files="${ossec_conf_dir}/*.conf"
+
+select_elements_content() {
+    local element="$1"
+    sed -n "/<${element}>/,/<\/${element}>/{ /<${element}>/d; /<\/${element}>/d; p; }"
+}
+
+remove_elements() {
+    local element="$1"
+    sed -e "/<${element}>/,/<\/${element}>/d"
+}
+
+remove_comments() {
+    # Comments must be on separate lines i.e. not next to uncommented code
+    awk '/<!--/ {off=1} /-->/ {off=2} /([\s\S]*)/ {if (off==0) print; if (off==2) off=0}'
+}
+
+remove_empty_lines() {
+    sed '/^\s*$/d'
+}
+
+ossec_conf() {
+    echo "<!-- OSSEC HIDS %%VERSION%% -->"
+    echo
+    echo "<!-- DO NOT EDIT - file generated automatically - edit \"ossec.conf.d/900.local.conf\" instead -->"
+    echo
+    echo "<ossec_config>"
+
+    if [ "${ossec_type}" != "agent"  ]; then
+        if cat $@ | remove_comments | grep -q "<rules>"; then
+            echo "  <rules>"
+            cat $@ | remove_comments | select_elements_content "rules" | remove_empty_lines
+            echo "  </rules>"
+        fi
+    fi
+
+    if cat $@ | remove_comments | grep -q "<rootcheck>"; then
+        echo "  <rootcheck>"
+        cat $@ | remove_comments | select_elements_content "rootcheck" | remove_empty_lines
+        echo "  </rootcheck>"
+    fi
+
+    if cat $@ | remove_comments | grep -q "<syscheck>"; then
+        echo "  <syscheck>"
+        cat $@ | remove_comments | select_elements_content "syscheck" | remove_empty_lines
+        echo "  </syscheck>"
+    fi
+
+    cat $@ | remove_comments | select_elements_content "ossec_config" | remove_elements "rules" | remove_elements "rootcheck" |  remove_elements "syscheck" | remove_empty_lines
+
+    echo "</ossec_config>"
+}
+
+ossec_conf "${ossec_conf_files}"
diff --git a/security/ossec-hids-local-config/files/pkg-deinstall.in b/security/ossec-hids-local-config/files/pkg-deinstall.in
new file mode 100644
index 000000000000..0de19bfa22d7
--- /dev/null
+++ b/security/ossec-hids-local-config/files/pkg-deinstall.in
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+ossec_home="%%OSSEC_HOME%%"
+ossec_conf="${ossec_home}/etc/ossec.conf"
+agent_conf="${ossec_home}/etc/shared/agent.conf"
+
+if [ "$2" == "DEINSTALL"  ]; then
+    rm -f "${ossec_conf}"
+    rm -f "${agent_conf}"
+fi
diff --git a/security/ossec-hids-local-config/files/pkg-install.in b/security/ossec-hids-local-config/files/pkg-install.in
new file mode 100644
index 000000000000..f164b9c0b107
--- /dev/null
+++ b/security/ossec-hids-local-config/files/pkg-install.in
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+ossec_home="%%OSSEC_HOME%%"
+ar_bin_dir="${ossec_home}/active-response/bin"
+ossec_conf="${ossec_home}/etc/ossec.conf"
+ossec_conf_bak="${ossec_conf}.bak"
+agent_conf="${ossec_home}/etc/shared/agent.conf"
+agent_conf_bak="${ossec_home}/etc/agent.conf.bak"
+
+if [ "$2" == "POST-INSTALL"  ]; then
+    ln -f "${ar_bin_dir}/%%FW_DROP%%" "${ar_bin_dir}/firewall-drop.sh"
+
+    if [ -e "${ossec_conf}" ]; then
+        mv -f "${ossec_conf}" "${ossec_conf_bak}"
+        echo
+        echo "WARNING:"
+        echo "  Existing \"${ossec_conf}\" has been saved to \"${ossec_conf_bak}\"."
+        echo
+    fi
+
+    case "$1" in
+        ossec-hids-server*)
+            if [ -e "${agent_conf}" ]; then
+                mv -f "${agent_conf}" "${agent_conf_bak}"
+                echo
+                echo "WARNING:"
+                echo "  Existing \"${agent_conf}\" has been saved to \"${agent_conf_bak}\"."
+                echo
+            fi
+            ;;
+    esac
+fi
diff --git a/security/ossec-hids-local-config/files/rules-cmdout.xml.in b/security/ossec-hids-local-config/files/rules-cmdout.xml.in
new file mode 100644
index 000000000000..59e3f4b4e9b0
--- /dev/null
+++ b/security/ossec-hids-local-config/files/rules-cmdout.xml.in
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<group name="ossec,">
+
+  <rule id="56041" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-last-logins'</match>
+    <check_diff />
+    <description>List of the last logged in users.</description> 
+  </rule>
+
+  <rule id="56042" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp4-all'</match>
+    <check_diff />
+    <description>Listening IPv4 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56043" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp4'</match>
+    <check_diff />
+    <description>Listening IPv4 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56044" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp6-all'</match>
+    <check_diff />
+    <description>Listening IPv6 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56045" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp6'</match>
+    <check_diff />
+    <description>Listening IPv6 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56046" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp4-all'</match>
+    <check_diff />
+    <description>Listening IPv4 UDP port opened or closed.</description>
+  </rule>
+
+  <rule id="56047" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp4'</match>
+    <check_diff />
+    <description>Listening IPv4 UDP port opened or closed.</description>
+  </rule>
+
+  <rule id="56048" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp6-all'</match>
+    <check_diff />
+    <description>Listening IPv6 UDP port opened or closed.</description>
+  </rule>
+
+  <rule id="56049" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp6'</match>
+    <check_diff />
+    <description>Listening IPv6 UDP port opened or closed.</description>
+  </rule>
+
+</group>
diff --git a/security/ossec-hids-local-config/files/rules-config.xml.in b/security/ossec-hids-local-config/files/rules-config.xml.in
new file mode 100644
index 000000000000..2853c4ae7ae2
--- /dev/null
+++ b/security/ossec-hids-local-config/files/rules-config.xml.in
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<group name="ossec,">
+
+  <rule id="56001" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>%%OSSEC_HOME%%/etc/ossec.conf.d</match>
+    <description>ossec.conf.d has been modified</description>
+  </rule>
+
+  <rule id="56002" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>%%OSSEC_HOME%%/etc/ossec.conf</match>
+    <description>ossec.conf has been modified</description>
+  </rule>
+
+  <rule id="56003" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>/var/ossec/etc/ossec.conf.d</match>
+    <description>ossec.conf.d has been modified</description>
+  </rule>
+
+  <rule id="56004" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>/var/ossec/etc/ossec.conf</match>
+    <description>ossec.conf has been modified</description>
+  </rule>
+
+  <rule id="56021" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>%%OSSEC_HOME%%/etc/agent.conf.d</match>
+    <description>agent.conf.d has been modified</description>
+  </rule>
+
+  <rule id="56022" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>%%OSSEC_HOME%%/etc/shared/agent.conf</match>
+    <description>agent.conf has been modified</description>
+  </rule>
+
+  <rule id="56023" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>/var/ossec/etc/agent.conf.d</match>
+    <description>agent.conf.d has been modified</description>
+  </rule>
+
+  <rule id="56024" level="10" ignore="10">
+    <if_group>syscheck</if_group>
+    <match>/var/ossec/etc/shared/agent.conf</match>
+    <description>agent.conf has been modified</description>
+  </rule>
+
+</group>
diff --git a/security/ossec-hids-local-config/files/template-ar-cmds-default.xml.in b/security/ossec-hids-local-config/files/template-ar-cmds-default.xml.in
new file mode 100644
index 000000000000..1e2dfaa0e22e
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-cmds-default.xml.in
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <command>
+    <name>host-deny</name>
+    <executable>host-deny.sh</executable>
+    <expect>srcip</expect>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <command>
+    <name>firewall-drop</name>
+    <executable>firewall-drop.sh</executable>
+    <expect>srcip</expect>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <command>
+    <name>disable-account</name>
+    <executable>disable-account.sh</executable>
+    <expect>user</expect>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <command>
+    <name>restart-ossec</name>
+    <executable>restart-ossec.sh</executable>
+    <expect></expect>
+  </command>
+
+  <command>
+    <name>route-null</name>
+    <executable>route-null.sh</executable>
+    <expect>srcip</expect>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-ar-cmds-merge.xml.in b/security/ossec-hids-local-config/files/template-ar-cmds-merge.xml.in
new file mode 100644
index 000000000000..ec2ec7e5a344
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-cmds-merge.xml.in
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <command>
+    <name>merge-config</name>
+    <executable>merge-config.sh</executable>
+    <expect></expect>
+  </command>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-ar-fwdrop.xml.in b/security/ossec-hids-local-config/files/template-ar-fwdrop.xml.in
new file mode 100644
index 000000000000..415de6c6093f
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-fwdrop.xml.in
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <active-response>
+    <!-- Block the IP on the firewall. -->
+    <!-- See: http://www.ossec.net/docs/syntax/head_ossec_config.active-response.html#active-response-options -->
+    <command>firewall-drop</command>
+    <location>local</location>
+    <level>6</level>
+    <timeout>600</timeout>
+  </active-response>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-ar-hostdeny.xml.in b/security/ossec-hids-local-config/files/template-ar-hostdeny.xml.in
new file mode 100644
index 000000000000..59b348853e91
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-hostdeny.xml.in
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <active-response>
+    <!-- Deny the IP in "/etc/hosts.allow" or "/etc/hosts.deny". -->
+    <command>host-deny</command>
+    <location>local</location>
+    <level>6</level>
+    <timeout>600</timeout>
+  </active-response>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-ar-merge.xml.in b/security/ossec-hids-local-config/files/template-ar-merge.xml.in
new file mode 100644
index 000000000000..f38d22673aa7
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-merge.xml.in
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <active-response>
+    <!-- Create "ossec.conf" and "agent.conf" if "ossec.conf.d/*" or "agent.conf.d/*" files change. -->
+    <command>merge-config</command>
+    <location>local</location>
+    <rules_id>56001,56003,56021,56023</rules_id>
+  </active-response>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-ar-restart.xml.in b/security/ossec-hids-local-config/files/template-ar-restart.xml.in
new file mode 100644
index 000000000000..064167e1e0d0
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-ar-restart.xml.in
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <active-response>
+    <!-- Restart OSSEC if "ossec.conf" or "agent.conf" changes. -->
+    <command>restart-ossec</command>
+    <location>local</location>
+    <rules_id>56002,56004,56022,56024</rules_id>
+  </active-response>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-cmdout-last-logins.xml.in b/security/ossec-hids-local-config/files/template-cmdout-last-logins.xml.in
new file mode 100644
index 000000000000..88975caadf91
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-cmdout-last-logins.xml.in
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/last-logins.sh</command>
+    <alias>freebsd-last-logins</alias>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-cmdout-open-ports-tcp.xml.in b/security/ossec-hids-local-config/files/template-cmdout-open-ports-tcp.xml.in
new file mode 100644
index 000000000000..c6028217fe6f
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-cmdout-open-ports-tcp.xml.in
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 4 tcp 1-65535</command>
+    <alias>freebsd-open-ports-tcp4-all</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 4 tcp</command>
+    <alias>freebsd-open-ports-tcp4</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 6 tcp 1-65535</command>
+    <alias>freebsd-open-ports-tcp6-all</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 6 tcp</command>
+    <alias>freebsd-open-ports-tcp6</alias>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-cmdout-open-ports-udp.xml.in b/security/ossec-hids-local-config/files/template-cmdout-open-ports-udp.xml.in
new file mode 100644
index 000000000000..d5c3fc85b809
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-cmdout-open-ports-udp.xml.in
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 4 udp 1-65535</command>
+    <alias>freebsd-open-ports-udp4-all</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 4 udp</command>
+    <alias>freebsd-open-ports-udp4</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 6 udp 1-65535</command>
+    <alias>freebsd-open-ports-udp6-all</alias>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>%%OSSEC_HOME%%/bin/command/open-ports.sh 6 udp</command>
+    <alias>freebsd-open-ports-udp6</alias>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-header-disabled.xml.in b/security/ossec-hids-local-config/files/template-header-disabled.xml.in
new file mode 100644
index 000000000000..627fa275973a
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-header-disabled.xml.in
@@ -0,0 +1,10 @@
+<!-- OSSEC HIDS %%VERSION%% -->
+
+<!-- DO NOT EDIT - file generated automatically using disabled port options -->
+
+<!--
+    You can indirectly edit this file by copying it to the parent directory.
+    The copied file will not be deleted or modified during port removal or
+    upgrades.
+-->
+
diff --git a/security/ossec-hids-local-config/files/template-header-enabled.xml.in b/security/ossec-hids-local-config/files/template-header-enabled.xml.in
new file mode 100644
index 000000000000..224916b36165
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-header-enabled.xml.in
@@ -0,0 +1,4 @@
+<!-- OSSEC HIDS %%VERSION%% -->
+
+<!-- DO NOT EDIT - file generated automatically using enabled port options -->
+
diff --git a/security/ossec-hids-local-config/files/template-header-sample.xml.in b/security/ossec-hids-local-config/files/template-header-sample.xml.in
new file mode 100644
index 000000000000..e0772c338fd1
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-header-sample.xml.in
@@ -0,0 +1 @@
+<!-- Place customized configuration here - it will not be overwritten during upgrades. -->
diff --git a/security/ossec-hids-local-config/files/template-logs-apache.xml.in b/security/ossec-hids-local-config/files/template-logs-apache.xml.in
new file mode 100644
index 000000000000..b88ed1a446a4
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-apache.xml.in
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_APACHE_PROFILE%%">
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/httpd-error.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/httpd-access.log</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_APACHE_PROFILE%%">
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/apache2/error.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/apache2/access.log</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-logs-basic.xml.in b/security/ossec-hids-local-config/files/template-logs-basic.xml.in
new file mode 100644
index 000000000000..bb0c10af052f
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-basic.xml.in
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_BASIC_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/auth.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/maillog</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/messages</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/security</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/userlog</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/xferlog</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_BASIC_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/auth.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/dpkg.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/kern.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/mail.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/messages</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/syslog</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-logs-nginx.xml.in b/security/ossec-hids-local-config/files/template-logs-nginx.xml.in
new file mode 100644
index 000000000000..7d25cf877133
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-nginx.xml.in
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_NGINX_PROFILE%%">
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/nginx/error.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/nginx/access.log</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_NGINX_PROFILE%%">
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/nginx/error.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>apache</log_format>
+    <location>/var/log/nginx/access.log</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-logs-ossec.xml.in b/security/ossec-hids-local-config/files/template-logs-ossec.xml.in
new file mode 100644
index 000000000000..e284af88ecc3
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-ossec.xml.in
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_OSSEC_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>%%OSSEC_HOME%%/logs/active-responses.log</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_OSSEC_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/ossec/logs/active-responses.log</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-logs-radius.xml.in b/security/ossec-hids-local-config/files/template-logs-radius.xml.in
new file mode 100644
index 000000000000..0b10c4bbe5dd
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-radius.xml.in
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_RADIUS_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/radius.log</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_RADIUS_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/freeradius/radius.log</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-logs-vsftpd.xml.in b/security/ossec-hids-local-config/files/template-logs-vsftpd.xml.in
new file mode 100644
index 000000000000..9f63a217558e
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-logs-vsftpd.xml.in
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%LOGS_VSFTPD_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/vsftpd.log</location>
+  </localfile>
+
+</template_config>
+
+<template_config os="Linux" profile="%%LOGS_VSFTPD_PROFILE%%">
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/vsftpd.log</location>
+  </localfile>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-rootcheck-basic.xml.in b/security/ossec-hids-local-config/files/template-rootcheck-basic.xml.in
new file mode 100644
index 000000000000..37c21662a8cf
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-rootcheck-basic.xml.in
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%ROOTCHECK_BASIC_PROFILE%%">
+
+  <rootcheck>
+    <rootkit_files>%%OSSEC_HOME%%/etc/shared/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>%%OSSEC_HOME%%/etc/shared/rootkit_trojans.txt</rootkit_trojans>
+    <system_audit>%%OSSEC_HOME%%/etc/shared/system_audit_rcl.txt</system_audit>
+    <system_audit>%%OSSEC_HOME%%/etc/shared/system_audit_ssh.txt</system_audit>
+  </rootcheck>
+
+</template_config>
+
+<template_config os="Linux" profile="%%ROOTCHECK_BASIC_PROFILE%%">
+
+  <rootcheck>
+    <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
+    <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
+    <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
+  </rootcheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-rootcheck-cis-l1.xml.in b/security/ossec-hids-local-config/files/template-rootcheck-cis-l1.xml.in
new file mode 100644
index 000000000000..1b2f20c72ee2
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-rootcheck-cis-l1.xml.in
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<template_config os="Linux" profile="%%ROOTCHECK_CIS_L1_PROFILE%%">
+
+  <rootcheck>
+    <system_audit>/var/ossec/etc/shared/cis_debianlinux7-8_L1_rcl.txt</system_audit>
+  </rootcheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-rootcheck-cis-l2.xml.in b/security/ossec-hids-local-config/files/template-rootcheck-cis-l2.xml.in
new file mode 100644
index 000000000000..d156887d2ba3
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-rootcheck-cis-l2.xml.in
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<template_config os="Linux" profile="%%ROOTCHECK_CIS_L2_PROFILE%%">
+
+  <rootcheck>
+    <system_audit>/var/ossec/etc/shared/cis_debianlinux7-8_L2_rcl.txt</system_audit>
+  </rootcheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-rootcheck-cis.xml.in b/security/ossec-hids-local-config/files/template-rootcheck-cis.xml.in
new file mode 100644
index 000000000000..0640be7a4c2b
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-rootcheck-cis.xml.in
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<template_config os="Linux" profile="%%ROOTCHECK_CIS_PROFILE%%">
+
+  <rootcheck>
+    <system_audit>/var/ossec/etc/shared/cis_debian_linux_rcl.txt</system_audit>
+  </rootcheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-rules-cmdout.xml.in b/security/ossec-hids-local-config/files/template-rules-cmdout.xml.in
new file mode 100644
index 000000000000..482efd655112
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-rules-cmdout.xml.in
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <rules>
+    <include>freebsd_cmdout_rules.xml</include>
+  </rules>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-rules-config.xml.in b/security/ossec-hids-local-config/files/template-rules-config.xml.in
new file mode 100644
index 000000000000..2e9102f8bb1f
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-rules-config.xml.in
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <rules>
+    <include>freebsd_config_rules.xml</include>
+  </rules>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-rules-default.xml.in b/security/ossec-hids-local-config/files/template-rules-default.xml.in
new file mode 100644
index 000000000000..5f34a6a0a866
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-rules-default.xml.in
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <rules>
+    <include>rules_config.xml</include>
+    <include>ossec_rules.xml</include>
+    <include>syslog_rules.xml</include>
+    <include>sendmail_rules.xml</include>
+    <include>postfix_rules.xml</include>
+    <include>spamd_rules.xml</include>
+    <include>imapd_rules.xml</include>
+    <include>mailscanner_rules.xml</include>
+    <include>ms-exchange_rules.xml</include>
+    <include>courier_rules.xml</include>
+    <include>firewall_rules.xml</include>
+    <include>pix_rules.xml</include>
+    <include>netscreenfw_rules.xml</include>
+    <include>cisco-ios_rules.xml</include>
+    <include>sonicwall_rules.xml</include>
+    <include>pam_rules.xml</include>
+    <include>telnetd_rules.xml</include>
+    <include>sshd_rules.xml</include>
+    <include>solaris_bsm_rules.xml</include>
+    <include>asterisk_rules.xml</include>
+    <include>ms_dhcp_rules.xml</include>
+    <include>arpwatch_rules.xml</include>
+    <include>symantec-av_rules.xml</include>
+    <include>symantec-ws_rules.xml</include>
+    <include>trend-osce_rules.xml</include>
+    <include>hordeimp_rules.xml</include>
+    <include>roundcube_rules.xml</include>
+    <include>wordpress_rules.xml</include>
+    <include>cimserver_rules.xml</include>
+    <include>dovecot_rules.xml</include>
+    <include>vmpop3d_rules.xml</include>
+    <include>vpopmail_rules.xml</include>
+    <include>ftpd_rules.xml</include>
+    <include>proftpd_rules.xml</include>
+    <include>pure-ftpd_rules.xml</include>
+    <include>vsftpd_rules.xml</include>
+    <include>ms_ftpd_rules.xml</include>
+    <include>named_rules.xml</include>
+    <include>exim_rules.xml</include>
+    <include>smbd_rules.xml</include>
+    <include>racoon_rules.xml</include>
+    <include>vpn_concentrator_rules.xml</include>
+    <include>msauth_rules.xml</include>
+    <include>mcafee_av_rules.xml</include>
+    <include>ms-se_rules.xml</include>
+    <include>sysmon_rules.xml</include>
+    <include>ms_ipsec_rules.xml</include>
+    <include>vmware_rules.xml</include>
+    <include>ids_rules.xml</include>
+    <include>apache_rules.xml</include>
+    <include>web_rules.xml</include>
+    <include>zeus_rules.xml</include>
+    <include>nginx_rules.xml</include>
+    <include>php_rules.xml</include>
+    <include>web_appsec_rules.xml</include>
+    <include>squid_rules.xml</include>
+    <include>attack_rules.xml</include>
+    <include>systemd_rules.xml</include>
+    <include>firewalld_rules.xml</include>
+    <include>mysql_rules.xml</include>
+    <include>postgresql_rules.xml</include>
+    <include>dropbear_rules.xml</include>
+    <include>openbsd_rules.xml</include>
+    <include>apparmor_rules.xml</include>
+    <include>clam_av_rules.xml</include>
+    <include>openbsd-dhcpd_rules.xml</include>
+    <include>nsd_rules.xml</include>
+    <include>owncloud_rules.xml</include>
+    <include>proxmox-ve_rules.xml</include>
+    <include>opensmtpd_rules.xml</include>
+    <include>dnsmasq_rules.xml</include>
+    <include>linux_usbdetect_rules.xml</include>
+    <include>ms1016_usbdetect_rules.xml</include>
+    <include>ms_firewall_rules.xml</include>
+    <include>psad_rules.xml</include>
+    <include>unbound_rules.xml</include>
+    <include>local_rules.xml</include>
+
+    <!-- Files not included by default -->
+    <!--<include>policy_rules.xml</include>-->
+  </rules>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-sample-agent.xml.in b/security/ossec-hids-local-config/files/template-sample-agent.xml.in
new file mode 100644
index 000000000000..099a6d38e2e8
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-sample-agent.xml.in
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <client>
+    <!-- Specify the IP address of the %%PORTNAME%% server. -->
+    <server-ip>1.2.3.4</server-ip>
+    <!-- Alternatively, specify the hostname of the %%PORTNAME%% server. -->
+    <!-- <server-hostname>example.com</server-hostname> -->
+
+    <!-- Specifies the agent.conf profiles to be used by the agent. Multiple profiles can be included, separated by a comma and a space. -->
+    <!-- <config-profile>%%CONFIG_PROFILES%%</config-profile> -->
+  </client>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-sample-database.xml.in b/security/ossec-hids-local-config/files/template-sample-database.xml.in
new file mode 100644
index 000000000000..80f156f73fd7
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-sample-database.xml.in
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+  <!-- Run "%%OSSEC_HOME%%/bin/ossec-control enable database" to enable ossec-dbd. -->
+  <database_output>
+    <hostname>localhost</hostname>
+    <username>ossec</username>
+    <password>secret</password>
+    <database>ossec</database>
+    <type>%%DB_TYPE%%</type>
+  </database_output>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-sample-local.xml.in b/security/ossec-hids-local-config/files/template-sample-local.xml.in
new file mode 100644
index 000000000000..bf1ec5cc37ac
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-sample-local.xml.in
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <global>
+    <!-- Uncomment to enable email notifications. -->
+    <!--
+    <email_notification>yes</email_notification>
+    <email_to>example@example.com</email_to>
+    <smtp_server>smtp.example.com</smtp_server>
+    <email_from>ossecm@example.com</email_from>
+    -->
+
+    <!-- List of IP addresses that should never be blocked by the active response (one per element). -->
+    <white_list>127.0.0.1</white_list>
+  </global>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-sample-server.xml.in b/security/ossec-hids-local-config/files/template-sample-server.xml.in
new file mode 100644
index 000000000000..901e26a6fe98
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-sample-server.xml.in
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <remote>
+    <connection>secure</connection>
+    <!-- OSSEC server listens on all interfacees by default. -->
+    <!-- <local_ip>1.2.3.4</local_ip> -->
+  </remote>
+
+  <global>
+    <!-- Uncomment to enable email notifications. -->
+    <!--
+    <email_notification>yes</email_notification>
+    <email_to>example@example.com</email_to>
+    <smtp_server>smtp.example.com</smtp_server>
+    <email_from>ossecm@example.com</email_from>
+    -->
+
+    <!-- List of IP addresses that should never be blocked by the active response (one per element). -->
+    <white_list>127.0.0.1</white_list>
+  </global>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-syscheck-basic.xml.in b/security/ossec-hids-local-config/files/template-syscheck-basic.xml.in
new file mode 100644
index 000000000000..516b921dcd35
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-syscheck-basic.xml.in
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%SYSCHECK_BASIC_PROFILE%%">
+
+  <syscheck>
+    <directories realtime="yes" check_all="yes">/bin,/sbin,/usr/bin,/usr/sbin,%%PREFIX%%/bin,%%PREFIX%%/sbin</directories>
+    <directories realtime="yes" check_all="yes">/etc,%%PREFIX%%/etc</directories>
+  </syscheck>
+
+</template_config>
+
+<template_config os="Linux" profile="%%SYSCHECK_BASIC_PROFILE%%">
+
+  <syscheck>
+    <directories realtime="yes" check_all="yes">/bin,/sbin,/usr/bin,/usr/sbin,/usr/local/bin,/usr/local/sbin</directories>
+    <directories realtime="yes" check_all="yes">/etc,/usr/local/etc</directories>
+  </syscheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-syscheck-hostdeny.xml.in b/security/ossec-hids-local-config/files/template-syscheck-hostdeny.xml.in
new file mode 100644
index 000000000000..07f278dce15b
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-syscheck-hostdeny.xml.in
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD">
+
+  <syscheck>
+    <ignore>/etc/hosts.allow</ignore>
+  </syscheck>
+
+</template_config>
+
+<template_config os="Linux">
+
+  <syscheck>
+    <ignore>/etc/hosts.deny</ignore>
+  </syscheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-syscheck-newfiles.xml.in b/security/ossec-hids-local-config/files/template-syscheck-newfiles.xml.in
new file mode 100644
index 000000000000..eee5915b0c3c
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-syscheck-newfiles.xml.in
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD">
+
+  <syscheck>
+    <alert_new_files>yes</alert_new_files>
+  </syscheck>
+
+</template_config>
+
+<template_config os="Linux">
+
+  <syscheck>
+    <alert_new_files>yes</alert_new_files>
+  </syscheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-syscheck-noauto.xml.in b/security/ossec-hids-local-config/files/template-syscheck-noauto.xml.in
new file mode 100644
index 000000000000..b71e1aeaba59
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-syscheck-noauto.xml.in
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD">
+
+  <syscheck>
+    <auto_ignore>no</auto_ignore>
+  </syscheck>
+
+</template_config>
+
+<template_config os="Linux">
+
+  <syscheck>
+    <auto_ignore>no</auto_ignore>
+  </syscheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/files/template-syscheck-ossec.xml.in b/security/ossec-hids-local-config/files/template-syscheck-ossec.xml.in
new file mode 100644
index 000000000000..42911efa628e
--- /dev/null
+++ b/security/ossec-hids-local-config/files/template-syscheck-ossec.xml.in
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template_config os="FreeBSD" profile="%%SYSCHECK_OSSEC_PROFILE%%">
+
+  <syscheck>
+    <directories realtime="yes" check_all="yes">%%OSSEC_SYSCHECK_BIN_DIRS%%</directories>
+    <directories realtime="yes" check_all="yes">%%OSSEC_SYSCHECK_ETC_DIRS%%</directories>
+  </syscheck>
+
+</template_config>
+
+<template_config os="Linux" profile="%%SYSCHECK_OSSEC_PROFILE%%">
+
+  <syscheck>
+    <directories realtime="yes" check_all="yes">/var/ossec/bin,/var/ossec/active-response,/var/ossec/agentless</directories>
+    <directories realtime="yes" check_all="yes">/var/ossec/etc,/var/ossec/rules</directories>
+  </syscheck>
+
+</template_config>
diff --git a/security/ossec-hids-local-config/opt-ar.mk b/security/ossec-hids-local-config/opt-ar.mk
new file mode 100644
index 000000000000..d52f4bb287c2
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-ar.mk
@@ -0,0 +1,46 @@
+AR_MANAGED_CONF=	110.active-response.conf
+AR_LOCAL_CONF=		510.active-response.local.conf
+
+AR_DESC=		Active Response
+
+# Default commands
+AR_CMDS_DEFAULT_OPTION=	DEFAULT_C
+AR_CMDS_DEFAULT_DESC=	Commands provided by OSSEC
+AR_CMDS_DEFAULT_DEFINE=	server local
+AR_CMDS_DEFAULT_DEFAULT=server local
+AR_OPTIONS+=		AR_CMDS_DEFAULT
+
+# Config merge commands
+AR_CMDS_MERGE_OPTION=	MERGE_C
+AR_CMDS_MERGE_DESC=	Commands to merge configuration files
+AR_CMDS_MERGE_DEFINE=	server local
+AR_CMDS_MERGE_DEFAULT=	server local
+AR_OPTIONS+=		AR_CMDS_MERGE
+
+# Config merge active response
+AR_MERGE_OPTION=	MERGE_AR
+AR_MERGE_DESC=		Merge configuration files when they change
+AR_MERGE_DEFINE=	server local
+AR_MERGE_DEFAULT=	server local
+AR_OPTIONS+=		AR_MERGE
+
+# OSSEC restart active response
+AR_RESTART_OPTION=	RESTART_AR
+AR_RESTART_DESC=	Restart OSSEC when main configuration files change
+AR_RESTART_DEFINE=	server local
+AR_RESTART_DEFAULT=	server local
+AR_OPTIONS+=		AR_RESTART
+
+# Host deny active response
+AR_HOSTDENY_OPTION=	HOSTDENY_AR
+AR_HOSTDENY_DESC=	Block the attacker's IP using access control files
+AR_HOSTDENY_DEFINE=	server local
+AR_HOSTDENY_DEFAULT=
+AR_OPTIONS+=		AR_HOSTDENY
+
+# Firewall drop active response
+AR_FWDROP_OPTION=	FWDROP_AR
+AR_FWDROP_DESC=		Block the attacker's IP on the firewall
+AR_FWDROP_DEFINE=	server local
+AR_FWDROP_DEFAULT=
+AR_OPTIONS+=		AR_FWDROP
diff --git a/security/ossec-hids-local-config/opt-cmdout.mk b/security/ossec-hids-local-config/opt-cmdout.mk
new file mode 100644
index 000000000000..98da6dd68e7e
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-cmdout.mk
@@ -0,0 +1,27 @@
+CMDOUT_MANAGED_CONF=		140.command-output.conf
+CMDOUT_LOCAL_CONF=		540.command-output.local.conf
+
+CMDOUT_DESC=			Command Output Monitoring
+
+CMDOUT_SCRIPTS=			last-logins open-ports
+
+# Last logins
+CMDOUT_LAST_LOGINS_OPTION=	LOGINS
+CMDOUT_LAST_LOGINS_DESC=	Last logins
+CMDOUT_LAST_LOGINS_DEFINE=	server local agent
+CMDOUT_LAST_LOGINS_DEFAULT=	server local agent
+CMDOUT_OPTIONS+=		CMDOUT_LAST_LOGINS
+
+# Open TCP ports
+CMDOUT_OPEN_PORTS_TCP_OPTION=	PORTS_TCP
+CMDOUT_OPEN_PORTS_TCP_DESC=	Open TCP ports
+CMDOUT_OPEN_PORTS_TCP_DEFINE=	server local agent
+CMDOUT_OPEN_PORTS_TCP_DEFAULT=	server local agent
+CMDOUT_OPTIONS+=		CMDOUT_OPEN_PORTS_TCP
+
+# Open UDP ports
+CMDOUT_OPEN_PORTS_UDP_OPTION=	PORTS_UDP
+CMDOUT_OPEN_PORTS_UDP_DESC=	Open UDP ports
+CMDOUT_OPEN_PORTS_UDP_DEFINE=	server local agent
+CMDOUT_OPEN_PORTS_UDP_DEFAULT=	server local agent
+CMDOUT_OPTIONS+=		CMDOUT_OPEN_PORTS_UDP
diff --git a/security/ossec-hids-local-config/opt-logs.mk b/security/ossec-hids-local-config/opt-logs.mk
new file mode 100644
index 000000000000..b706eee3c382
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-logs.mk
@@ -0,0 +1,52 @@
+LOGS_MANAGED_CONF=	150.logs.conf
+LOGS_LOCAL_CONF=	550.logs.local.conf
+
+LOGS_DESC=		Log Monitoring
+
+# Default logs support
+LOGS_BASIC_OPTION=	BASIC
+LOGS_BASIC_PROFILE=	basic
+LOGS_BASIC_DESC=	Default system logs
+LOGS_BASIC_DEFINE=	server local agent pushed
+LOGS_BASIC_DEFAULT=	server local pushed
+LOGS_OPTIONS+=		LOGS_BASIC
+
+# Active response log support
+LOGS_OSSEC_OPTION=	OSSEC
+LOGS_OSSEC_PROFILE=	ossec
+LOGS_OSSEC_DESC=	Active response logs
+LOGS_OSSEC_DEFINE=	server local agent pushed
+LOGS_OSSEC_DEFAULT=	server local pushed
+LOGS_OPTIONS+=		LOGS_OSSEC
+
+# Apache logs support
+LOGS_APACHE_OPTION=	APACHE
+LOGS_APACHE_PROFILE=	apache
+LOGS_APACHE_DESC=	Apache logs
+LOGS_APACHE_DEFINE=	server local agent pushed
+LOGS_APACHE_DEFAULT=	pushed
+LOGS_OPTIONS+=		LOGS_APACHE
+
+# Nginx logs support
+LOGS_NGINX_OPTION=	NGINX
+LOGS_NGINX_PROFILE=	nginx
+LOGS_NGINX_DESC=	Nginx logs
+LOGS_NGINX_DEFINE=	server local agent pushed
+LOGS_NGINX_DEFAULT=	pushed
+LOGS_OPTIONS+=		LOGS_NGINX
+
+# Radius logs support
+LOGS_RADIUS_OPTION=	RADIUS
+LOGS_RADIUS_PROFILE=	radius
+LOGS_RADIUS_DESC=	FreeRADIUS logs
+LOGS_RADIUS_DEFINE=	server local agent pushed
+LOGS_RADIUS_DEFAULT=	pushed
+LOGS_OPTIONS+=		LOGS_RADIUS
+
+# Vsftpd logs support
+LOGS_VSFTPD_OPTION=	VSFTPD
+LOGS_VSFTPD_PROFILE=	vsftpd
+LOGS_VSFTPD_DESC=	Vsftpd logs
+LOGS_VSFTPD_DEFINE=	server local agent pushed
+LOGS_VSFTPD_DEFAULT=	pushed
+LOGS_OPTIONS+=		LOGS_VSFTPD
diff --git a/security/ossec-hids-local-config/opt-rootcheck.mk b/security/ossec-hids-local-config/opt-rootcheck.mk
new file mode 100644
index 000000000000..3183216115ac
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-rootcheck.mk
@@ -0,0 +1,36 @@
+ROOTCHECK_MANAGED_CONF=		120.rootcheck.conf
+ROOTCHECK_LOCAL_CONF=		520.rootcheck.local.conf
+
+ROOTCHECK_DESC=			System Audit and Rootkit Detection (rootcheck)
+
+# Basic
+ROOTCHECK_BASIC_OPTION=		BASIC_RC
+ROOTCHECK_BASIC_PROFILE=	basic
+ROOTCHECK_BASIC_DESC=		Basic audit and rootkits
+ROOTCHECK_BASIC_DEFINE=		server local agent pushed
+ROOTCHECK_BASIC_DEFAULT=	server local pushed
+ROOTCHECK_OPTIONS+=		ROOTCHECK_BASIC
+
+# CIS default
+ROOTCHECK_CIS_OPTION=		CIS_RC
+ROOTCHECK_CIS_PROFILE=		cis
+ROOTCHECK_CIS_DESC=		CIS benchmark - Legacy
+ROOTCHECK_CIS_DEFINE=		pushed
+ROOTCHECK_CIS_DEFAULT=		pushed
+ROOTCHECK_OPTIONS+=		ROOTCHECK_CIS
+
+# CIS level 1
+ROOTCHECK_CIS_L1_OPTION=	CIS_L1_RC
+ROOTCHECK_CIS_L1_PROFILE=	cis-level1
+ROOTCHECK_CIS_L1_DESC=		CIS benchmark - Level 1
+ROOTCHECK_CIS_L1_DEFINE=	pushed
+ROOTCHECK_CIS_L1_DEFAULT=	pushed
+ROOTCHECK_OPTIONS+=		ROOTCHECK_CIS_L1
+
+# CIS level 2
+ROOTCHECK_CIS_L2_OPTION=	CIS_L2_RC
+ROOTCHECK_CIS_L2_PROFILE=	cis-level2
+ROOTCHECK_CIS_L2_DESC=		CIS benchmark - Level 2
+ROOTCHECK_CIS_L2_DEFINE=	pushed
+ROOTCHECK_CIS_L2_DEFAULT=	pushed
+ROOTCHECK_OPTIONS+=		ROOTCHECK_CIS_L2
diff --git a/security/ossec-hids-local-config/opt-rules.mk b/security/ossec-hids-local-config/opt-rules.mk
new file mode 100644
index 000000000000..f3f7413f5492
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-rules.mk
@@ -0,0 +1,27 @@
+RULES_MANAGED_CONF=	100.rules.conf
+RULES_LOCAL_CONF=	500.rules.local.conf
+
+RULES_DESC=		Alerting Rules
+
+RULES_FILES=		config cmdout
+
+# Default rules
+RULES_DEFAULT_OPTION=	DEFAULT_R
+RULES_DEFAULT_DESC=	Rules provided by OSSEC
+RULES_DEFAULT_DEFINE=	server local
+RULES_DEFAULT_DEFAULT=	server local
+RULES_OPTIONS+=		RULES_DEFAULT
+
+# Config rules
+RULES_CONFIG_OPTION=	CONFIG_R
+RULES_CONFIG_DESC=	Alert changes of the OSSEC main configuration files
+RULES_CONFIG_DEFINE=	server local
+RULES_CONFIG_DEFAULT=	server local
+RULES_OPTIONS+=		RULES_CONFIG
+
+# Command output rules
+RULES_CMDOUT_OPTION=	CMDOUT_R
+RULES_CMDOUT_DESC=	Alert changes of output of the monitored commands
+RULES_CMDOUT_DEFINE=	server local
+RULES_CMDOUT_DEFAULT=	server local
+RULES_OPTIONS+=		RULES_CMDOUT
diff --git a/security/ossec-hids-local-config/opt-syscheck.mk b/security/ossec-hids-local-config/opt-syscheck.mk
new file mode 100644
index 000000000000..9b4e6efd7387
--- /dev/null
+++ b/security/ossec-hids-local-config/opt-syscheck.mk
@@ -0,0 +1,42 @@
+SYSCHECK_MANAGED_CONF=		130.syscheck.conf
+SYSCHECK_LOCAL_CONF=		530.syscheck.local.conf
+
+SYSCHECK_DESC=			File Integrity Checking (syscheck)
+
+# Default direcotries
+SYSCHECK_BASIC_OPTION=		BASIC_SC
+SYSCHECK_BASIC_PROFILE=		basic
+SYSCHECK_BASIC_DESC=		"bin", "sbin" and "etc"
+SYSCHECK_BASIC_DEFINE=		server local agent pushed
+SYSCHECK_BASIC_DEFAULT=		server local pushed
+SYSCHECK_OPTIONS+=		SYSCHECK_BASIC
+
+# OSSEC directories
+SYSCHECK_OSSEC_OPTION=		OSSEC_SC
+SYSCHECK_OSSEC_PROFILE=		ossec
+SYSCHECK_OSSEC_DESC=		OSSEC directories
+SYSCHECK_OSSEC_DEFINE=		server local agent pushed
+SYSCHECK_OSSEC_DEFAULT=		server local pushed
+SYSCHECK_OPTIONS+=		SYSCHECK_OSSEC
+
+# Alert new files
+SYSCHECK_NEWFILES_OPTION=	NEWFILES_SC
+SYSCHECK_NEWFILES_DESC=		Alert on new files created
+SYSCHECK_NEWFILES_DEFINE=	server local
+SYSCHECK_NEWFILES_DEFAULT=	server local
+SYSCHECK_OPTIONS+=		SYSCHECK_NEWFILES
+
+# Disable auto_ignore
+SYSCHECK_NOAUTO_OPTION=		NOAUTO_SC
+SYSCHECK_NOAUTO_DESC=		Disable auto_ignore feature
+SYSCHECK_NOAUTO_DEFINE=		server local
+SYSCHECK_NOAUTO_DEFAULT=	server local
+SYSCHECK_OPTIONS+=		SYSCHECK_NOAUTO
+
+# Ignore /etc/hosts.allow
+SYSCHECK_HOSTDENY_DEPENDS=	AR_HOSTDENY
+SYSCHECK_HOSTDENY_OPTION=	HOSTDENY_SC
+SYSCHECK_HOSTDENY_DESC=		Ignore access control files
+SYSCHECK_HOSTDENY_DEFINE=	server local agent pushed
+SYSCHECK_HOSTDENY_DEFAULT=	server local pushed
+SYSCHECK_OPTIONS+=		SYSCHECK_HOSTDENY
diff --git a/security/ossec-hids-local-config/pkg-descr b/security/ossec-hids-local-config/pkg-descr
new file mode 100644
index 000000000000..0b039e55d8c2
--- /dev/null
+++ b/security/ossec-hids-local-config/pkg-descr
@@ -0,0 +1,9 @@
+OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection
+System (HIDS). It has a powerful correlation and analysis engine, integrating
+log analysis, file integrity checking, Windows registry monitoring, centralized
+policy enforcement, rootkit detection, real-time alerting and active response.
+
+This package adds the configuration overlay with samples, additional rules,
+commands, scripts and support for multiple configuration files.
+
+WWW: https://ossec.github.io
diff --git a/security/ossec-hids-local-config/pkg-help-agent b/security/ossec-hids-local-config/pkg-help-agent
new file mode 100644
index 000000000000..f16999a82460
--- /dev/null
+++ b/security/ossec-hids-local-config/pkg-help-agent
@@ -0,0 +1,29 @@
+Unless stated otherwise, every option here corresponds to certain configuration
+block which would be placed in one of the configuration files in "ossec.conf.d"
+directory. Disabled options will do the same, but for "ossec.conf.d/disabled"
+directory. All "*.conf" files from the "ossec.conf.d" directory will be merged
+into "ossec.conf" in alphabetic order. If you are not satisfied with the
+generated configuration, you can disable the corresponding option and use files
+from "ossec.conf.d/disabled" directory as samples.
+
+Most of the options are disabled by default, because it is expected that the
+server will push the agent configuration using "agent.conf". FreeBSD port of
+OSSEC server extended with similar "config" port does this by default. If this
+is the case, then the "ossec.conf" should only enable required profiles.
+
+Files generated by the port will be overwritten during port upgrades so any
+additional configuration should be put in separate files.
+
+Command Output Monitoring:
+
+  Adds additional commands, the output of which can be monitored. To actually
+  send alerts about the changing output, the proper rules need to be configured
+  on the server as well. For security reasons commands cannot be pushed by the
+  server and thus must be configured locally on every agent.
+  These commands can be tweaked in "command.conf".
+
+Active Response Firewall:
+
+  Creates "firewall-drop.sh" hardlink to one of the scripts shipped with OSSEC.
+  This option is only meaningful if this OSSEC instance will be the target of
+  "firewall-drop" active response (configured on the server).
diff --git a/security/ossec-hids-local-config/pkg-help-local b/security/ossec-hids-local-config/pkg-help-local
new file mode 100644
index 000000000000..69623078b5c5
--- /dev/null
+++ b/security/ossec-hids-local-config/pkg-help-local
@@ -0,0 +1,31 @@
+Unless stated otherwise, every option here corresponds to certain configuration
+block which would be placed in one of the configuration files in "ossec.conf.d"
+directory. Disabled options will do the same, but for "ossec.conf.d/disabled"
+directory. All "*.conf" files from the "ossec.conf.d" directory will be merged
+into "ossec.conf" in alphabetic order. If you are not satisfied with the
+generated configuration, you can disable the corresponding option and use files
+from "ossec.conf.d/disabled" directory as samples.
+
+Files generated by the port will be overwritten during port upgrades so any
+additional configuration should be put in separate files.
+
+File Integrity Checking:
+
+  NOAUTO_SC:
+    OSSEC by default will ignore files that change too often (after the third
+    change). This option disables this feature. Files that change too often
+    as a result of correct system operation should better be added to ignore
+    list manually.
+
+Command Output Monitoring:
+
+  Adds additional commands, the output of which can be monitored. To actually
+  send alerts about the changing output, the proper rules need to be configured
+  as well (see CMDOUT_R option).
+  These commands can be tweaked in "command.conf".
+
+Active Response Firewall:
+
+  Creates "firewall-drop.sh" hardlink to one of the scripts shipped with OSSEC.
+  This option is only meaningful if "firewall-drop" active response will be
+  enabled in the configuration.
diff --git a/security/ossec-hids-local-config/pkg-help-server b/security/ossec-hids-local-config/pkg-help-server
new file mode 100644
index 000000000000..bbcdec16c3f0
--- /dev/null
+++ b/security/ossec-hids-local-config/pkg-help-server
@@ -0,0 +1,46 @@
+Unless stated otherwise, every option here corresponds to certain configuration
+block which would be placed in one of the configuration files in "ossec.conf.d"
+directory. Disabled options will do the same, but for "ossec.conf.d/disabled"
+directory. All "*.conf" files from the "ossec.conf.d" directory will be merged
+into "ossec.conf" in alphabetic order. If you are not satisfied with the
+generated configuration, you can disable the corresponding option and use files
+from "ossec.conf.d/disabled" directory as samples.
+
+The "pushed" sections (*_P options) relate to configuration pushed to agents
+using "agent.conf". The generated configuration blocks will be placed in
+"agent.conf.d" and "agent.conf.d/disabled" directories.
+Note that the agent needs to enable proper profile to benefit from "agent.conf"
+configuration pushed by the server. This also means that profiles not enabled
+on the agent are ignored. This is why all "pushed" options are enabled by
+default. The port currently contains configuration templates for the following
+agent systems:
+
+  - FreeBSD
+  - Debian Linux
+
+Consider contributing to the port by contacting the maintainer and providing
+configuration templates for other operating systems runnig OSSEC agents.
+
+Files generated by the port will be overwritten during port upgrades so any
+additional configuration should be put in separate files.
+
+File Integrity Checking:
+
+  NOAUTO_SC:
+    OSSEC by default will ignore files that change too often (after the third
+    change). This option disables this feature. Files that change too often
+    as a result of correct system operation should better be added to ignore
+    list manually.
+
+Command Output Monitoring:
+
+  Adds additional commands, the output of which can be monitored. To actually
+  send alerts about the changing output, the proper rules need to be configured
+  as well (see CMDOUT_R option).
+  These commands can be tweaked in "command.conf".
+
+Active Response Firewall:
+
+  Creates "firewall-drop.sh" hardlink to one of the scripts shipped with OSSEC.
+  This option is only meaningful if this OSSEC instance will be the target of
+  "firewall-drop" active response.
diff --git a/security/ossec-hids-local-config/pkg-plist-agent b/security/ossec-hids-local-config/pkg-plist-agent
new file mode 100644
index 000000000000..bb8bf5863e61
--- /dev/null
+++ b/security/ossec-hids-local-config/pkg-plist-agent
@@ -0,0 +1,23 @@
+@dir(,ossec,0550) %%OSSEC_HOME%%
+@dir(,ossec,0550) %%OSSEC_HOME%%/active-response
+@dir(,ossec,0550) %%OSSEC_HOME%%/active-response/bin
+@(,ossec,0550) %%OSSEC_HOME%%/active-response/bin/merge-config.sh
+@dir(,,0550) %%OSSEC_HOME%%/bin
+@dir(,,0550) %%OSSEC_HOME%%/bin/command
+@(,,0550) %%OSSEC_HOME%%/bin/command/last-logins.sh
+@(,,0550) %%OSSEC_HOME%%/bin/command/open-ports.sh
+@dir(,,0550) %%OSSEC_HOME%%/bin/config
+@(,,0550) %%OSSEC_HOME%%/bin/config/ossec-conf
+@dir(,ossec,0550) %%OSSEC_HOME%%/etc
+@sample(,ossec,0640) %%OSSEC_HOME%%/etc/command.conf.sample
+@dir(,ossec,0550) %%OSSEC_HOME%%/etc/ossec.conf.d
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/120.rootcheck.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/130.syscheck.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/140.command-output.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/150.logs.conf
+@sample(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/900.local.conf.sample
+@dir(,ossec,0550) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/520.rootcheck.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/530.syscheck.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/540.command-output.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/550.logs.local.conf
diff --git a/security/ossec-hids-local-config/pkg-plist-local b/security/ossec-hids-local-config/pkg-plist-local
new file mode 100644
index 000000000000..24b4175d4300
--- /dev/null
+++ b/security/ossec-hids-local-config/pkg-plist-local
@@ -0,0 +1,30 @@
+@dir(,ossec,0550) %%OSSEC_HOME%%
+@dir(,ossec,0550) %%OSSEC_HOME%%/active-response
+@dir(,ossec,0550) %%OSSEC_HOME%%/active-response/bin
+@(,ossec,0550) %%OSSEC_HOME%%/active-response/bin/merge-config.sh
+@dir(,,0550) %%OSSEC_HOME%%/bin
+@dir(,,0550) %%OSSEC_HOME%%/bin/command
+@(,,0550) %%OSSEC_HOME%%/bin/command/last-logins.sh
+@(,,0550) %%OSSEC_HOME%%/bin/command/open-ports.sh
+@dir(,,0550) %%OSSEC_HOME%%/bin/config
+@(,,0550) %%OSSEC_HOME%%/bin/config/ossec-conf
+@dir(,ossec,0550) %%OSSEC_HOME%%/etc
+@sample(,ossec,0640) %%OSSEC_HOME%%/etc/command.conf.sample
+@dir(,ossec,0550) %%OSSEC_HOME%%/etc/ossec.conf.d
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/100.rules.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/110.active-response.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/120.rootcheck.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/130.syscheck.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/140.command-output.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/150.logs.conf
+@sample(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/900.local.conf.sample
+@dir(,ossec,0550) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/500.rules.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/510.active-response.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/520.rootcheck.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/530.syscheck.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/540.command-output.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/550.logs.local.conf
+@dir(,ossec,0550) %%OSSEC_HOME%%/rules
+@(,ossec,0640) %%OSSEC_HOME%%/rules/freebsd_cmdout_rules.xml
+@(,ossec,0640) %%OSSEC_HOME%%/rules/freebsd_config_rules.xml
diff --git a/security/ossec-hids-local-config/pkg-plist-server b/security/ossec-hids-local-config/pkg-plist-server
new file mode 100644
index 000000000000..bc26aefc2d25
--- /dev/null
+++ b/security/ossec-hids-local-config/pkg-plist-server
@@ -0,0 +1,39 @@
+@dir(,ossec,0550) %%OSSEC_HOME%%
+@dir(,ossec,0550) %%OSSEC_HOME%%/active-response
+@dir(,ossec,0550) %%OSSEC_HOME%%/active-response/bin
+@(,ossec,0550) %%OSSEC_HOME%%/active-response/bin/merge-config.sh
+@dir(,,0550) %%OSSEC_HOME%%/bin
+@dir(,,0550) %%OSSEC_HOME%%/bin/command
+@(,,0550) %%OSSEC_HOME%%/bin/command/last-logins.sh
+@(,,0550) %%OSSEC_HOME%%/bin/command/open-ports.sh
+@dir(,,0550) %%OSSEC_HOME%%/bin/config
+@(,,0550) %%OSSEC_HOME%%/bin/config/agent-conf
+@(,,0550) %%OSSEC_HOME%%/bin/config/ossec-conf
+@dir(,ossec,0550) %%OSSEC_HOME%%/etc
+@dir(,ossec,0550) %%OSSEC_HOME%%/etc/agent.conf.d
+@(,ossec,0640) %%OSSEC_HOME%%/etc/agent.conf.d/120.rootcheck.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/agent.conf.d/130.syscheck.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/agent.conf.d/150.logs.conf
+@dir(,ossec,0550) %%OSSEC_HOME%%/etc/agent.conf.d/disabled
+@(,ossec,0640) %%OSSEC_HOME%%/etc/agent.conf.d/disabled/520.rootcheck.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/agent.conf.d/disabled/530.syscheck.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/agent.conf.d/disabled/550.logs.local.conf
+@sample(,ossec,0640) %%OSSEC_HOME%%/etc/command.conf.sample
+@dir(,ossec,0550) %%OSSEC_HOME%%/etc/ossec.conf.d
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/100.rules.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/110.active-response.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/120.rootcheck.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/130.syscheck.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/140.command-output.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/150.logs.conf
+@sample(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/900.local.conf.sample
+@dir(,ossec,0550) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/500.rules.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/510.active-response.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/520.rootcheck.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/530.syscheck.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/540.command-output.local.conf
+@(,ossec,0640) %%OSSEC_HOME%%/etc/ossec.conf.d/disabled/550.logs.local.conf
+@dir(,ossec,0550) %%OSSEC_HOME%%/rules
+@(,ossec,0640) %%OSSEC_HOME%%/rules/freebsd_cmdout_rules.xml
+@(,ossec,0640) %%OSSEC_HOME%%/rules/freebsd_config_rules.xml
diff --git a/security/ossec-hids-local-config/scripts/plist.sh b/security/ossec-hids-local-config/scripts/plist.sh
new file mode 100644
index 000000000000..6d617874ab65
--- /dev/null
+++ b/security/ossec-hids-local-config/scripts/plist.sh
@@ -0,0 +1,113 @@
+#!/bin/sh
+
+# Script generates entries for pkg-plist.
+# Do not use it directly. Use the following command instead:
+#
+# make MAINTAINER_MODE=yes clean plist
+
+OSSEC_TYPE=$1
+OSSEC_HOME=$2
+PLIST=$3
+WORKDIR=$4
+STAGEDIR=$5
+
+staged_plist="${WORKDIR}/.staged-plist"
+fixed_lines=""
+skip_lines=""
+skip_paths=""
+sample_paths="/etc/command.conf.sample /etc/ossec.conf.d/900.local.conf.sample /etc/agent.conf.d/900.local.conf.sample"
+
+print_path() {
+    local path="$1"
+    local command="$2"
+    local full_path="${STAGEDIR}${OSSEC_HOME}${path}"
+    if [ -z "${command}" ]; then
+        command="@"
+        if [ -d "${full_path}" ]; then
+            command="@dir"
+        fi
+    fi
+    local user=`stat -f "%Su" "${full_path}"`
+    if [ "${user}" == "${USER}" ]; then
+        user=""
+    fi
+    local group=`stat -f "%Sg" "${full_path}"`
+    if [ "${group}" == "${GROUP}" ]; then
+        group=""
+    fi
+    local mode=`stat -f "%p" "${full_path}" | tail -c 5`
+    echo -e "${command}(${user},${group},${mode}) %%OSSEC_HOME%%${path}" >> "${PLIST}"
+}
+
+echo -n > "${PLIST}"
+
+print_path
+
+done_paths=""
+while read line; do
+    skip_line=""
+    for e in ${skip_lines}; do
+        if [ "${e}" == "${line}" ]; then
+            skip_line="${e}"
+            break
+        fi
+    done
+    if [ -z "${skip_line}" ]; then
+        path=""
+        case $line in
+            "@dir %%OSSEC_HOME%%"*)
+                path=`echo "${line}" | sed -e "s|@dir %%OSSEC_HOME%%||g"`
+                ;;
+            "%%OSSEC_HOME%%"*)
+                path=`echo "${line}" | sed -e "s|%%OSSEC_HOME%%||g"`
+                ;;
+            "%%"*)
+                unchanged_lines="${unchanged_lines} ${line}"
+                ;;
+        esac
+        if [ -n "${path}" ]; then
+            segments=`echo "${path}" | tr "/" "\n"`
+            path=""
+            for segment in ${segments}; do
+                path="${path}/${segment}"
+                skip_path=""
+                for e in ${skip_paths}; do
+                    if [ "${e}" == "${path}" ]; then
+                        skip_path="${e}"
+                        break
+                    fi
+                done
+                if [ -n "${skip_path}" ]; then
+                    break
+                fi
+                done_path=""
+                for e in ${done_paths}; do
+                    if [ "${e}" == "${path}" ]; then
+                        done_path="${e}"
+                        break
+                    fi
+                done
+                if [ -z "${done_path}" ]; then
+                    done_paths="${done_paths} ${path}"
+                    sample_path=""
+                    for e in ${sample_paths}; do
+                        if [ "${e}" == "${path}" ]; then
+                            sample_path="${e}"
+                            break
+                        fi
+                    done
+                    if [ -n "${sample_path}" ]; then
+                        print_path "${path}" @sample
+                    else
+                        print_path "${path}"
+                    fi
+                fi
+            done
+        fi
+    fi
+done < "${staged_plist}"
+
+unchanged_lines="${unchanged_lines} ${fixed_lines}"
+for line in ${unchanged_lines}; do
+    echo "${line}" >> "${PLIST}"
+done
diff --git a/security/ossec-hids-local-config/scripts/rules.sh b/security/ossec-hids-local-config/scripts/rules.sh
new file mode 100644
index 000000000000..65e28e23561a
--- /dev/null
+++ b/security/ossec-hids-local-config/scripts/rules.sh
@@ -0,0 +1,89 @@
+#!/bin/sh
+
+# Script generates entries for template-rules-default.xml.in.
+# Do not use it directly. Use the following command instead:
+#
+# make MAINTAINER_MODE=yes rules
+
+rules_template=$1
+src_dir=$2
+
+skip_files="policy_rules.xml local_rules.xml"
+append_files="local_rules.xml"
+
+rules=""
+for file in `find "${src_dir}/etc/rules" -depth 1 -name "*.xml"`; do
+    file_name="${file##*/}"
+    skip_file=""
+    for e in ${skip_files}; do
+        if [ "${e}" == "${file_name}" ]; then
+            skip_file="${e}"
+            break
+        fi
+    done
+    if [ -z "${skip_file}" ]; then
+        rule_ids=`sed -Ene 's|^.*<rule[[:space:]]+id="([0-9]+)".*$|\1|p' "${file}"`
+        if [ -n "${rule_ids}" ]; then
+            min_rule_id=`echo "${rule_ids}" | sort -n | head -n 1`
+            ref_rule_ids=`sed -Ene 's|^.*<if_sid>([0-9,]+)</if_sid>.*$|\1|p' "${file}" | tr ',' '\n'`
+            for ref_rule_id in ${ref_rule_ids}; do
+                found_rule_id=""
+                for rule_id in ${rule_ids}; do
+                    if [ "${ref_rule_id}" = "${rule_id}" ]; then
+                        found_rule_id="${rule_id}"
+                        break
+                    fi
+                done
+                if [ -z "${found_rule_id}" ]; then
+                    # The referenced rule id is not present in this file so it must come from another
+                    if [ ${ref_rule_id} -gt ${min_rule_id} ]; then
+                        # Ordering by referenced rule id doesn't need to give proper results, but let's hope it does
+                        min_rule_id=$((ref_rule_id + 1))
+                    fi
+                fi
+            done
+
+            rules="${rules}${min_rule_id} ${file_name}
+"
+        fi
+    fi
+done
+
+echo -n "${rules}" | sort -n
+
+if [ -n "${rules_template}" ]; then
+    rules=`echo -n "${rules}" | sort -n | cut -d' ' -f2`
+    for file_name in ${append_files}; do
+        rules="${rules}
+${file_name}"
+    done
+
+    echo '<?xml version="1.0" encoding="UTF-8"?>
+<template_config>
+
+  <rules>' > "${rules_template}"
+
+    for rule in ${rules}; do
+        echo "    <include>${rule}</include>" >> "${rules_template}"
+    done
+
+    echo '
+    <!-- Files not included by default -->' >> "${rules_template}"
+
+    for skip_file in ${skip_files}; do
+        append_file=""
+        for e in ${append_files}; do
+            if [ "${e}" == "${skip_file}" ]; then
+                append_file="${e}"
+                break
+            fi
+        done
+        if [ -z "${append_file}" ]; then
+            echo "    <!--<include>${skip_file}</include>-->" >> "${rules_template}"
+        fi
+    done
+
+    echo '  </rules>
+
+</template_config>' >> "${rules_template}"
+fi
diff --git a/security/ossec-hids-local-config/scripts/template-to-agent.sh b/security/ossec-hids-local-config/scripts/template-to-agent.sh
new file mode 100644
index 000000000000..3034b1fe1254
--- /dev/null
+++ b/security/ossec-hids-local-config/scripts/template-to-agent.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+if [ $# -lt 3 ]; then
+    echo "Too few arguments"
+    echo "Usage: `basename $0` <ossec_type> <ossec_prefix> <ossec_file>"
+    exit 1
+fi
+
+ossec_type="$1"
+ossec_prefix="$2"
+ossec_file="$3"
+
+if [ ! -f "${ossec_file}" ]; then
+    echo "File \"${ossec_file}\" does not exist"
+    exit 1
+fi
+
+ossec_syscheck_bin_dirs="${ossec_prefix}/bin,${ossec_prefix}/active-response"
+ossec_syscheck_etc_dirs="${ossec_prefix}/etc"
+
+replace() {
+    sed -e 's|<template_config \(.*\)>|<agent_config \1>|' \
+        -e 's|</template_config>|</agent_config>|' \
+        -e "s|%%OSSEC_SYSCHECK_BIN_DIRS%%|${ossec_syscheck_bin_dirs}|" \
+        -e "s|%%OSSEC_SYSCHECK_ETC_DIRS%%|${ossec_syscheck_etc_dirs}|" \
+        "${ossec_file}"
+}
+
+extract() {
+    sed -n '/^<agent_config .*>$/,/^<\/agent_config>$/p'
+}
+
+replace | extract
diff --git a/security/ossec-hids-local-config/scripts/template-to-ossec.sh b/security/ossec-hids-local-config/scripts/template-to-ossec.sh
new file mode 100644
index 000000000000..39334462a987
--- /dev/null
+++ b/security/ossec-hids-local-config/scripts/template-to-ossec.sh
@@ -0,0 +1,45 @@
+#!/bin/sh
+
+if [ $# -lt 3 ]; then
+    echo "Too few arguments"
+    echo "Usage: `basename $0` <ossec_type> <ossec_prefix> <ossec_file>"
+    exit 1
+fi
+
+ossec_type="$1"
+ossec_prefix="$2"
+ossec_file="$3"
+
+if [ ! -f "${ossec_file}" ]; then
+    echo "File \"${ossec_file}\" does not exist"
+    exit 1
+fi
+
+ossec_syscheck_bin_dirs="${ossec_prefix}/bin,${ossec_prefix}/active-response"
+ossec_syscheck_etc_dirs="${ossec_prefix}/etc"
+if [ "${ossec_type}" != "agent" ]; then
+    ossec_syscheck_bin_dirs="${ossec_syscheck_bin_dirs},${ossec_prefix}/agentless"
+    ossec_syscheck_etc_dirs="${ossec_syscheck_etc_dirs},${ossec_prefix}/rules"
+fi
+
+replace() {
+    if grep -q "<template_config>" "${ossec_file}"; then
+        sed -e 's|<template_config>|<ossec_config>|' \
+            -e 's|</template_config>|</ossec_config>|' \
+            -e "s|%%OSSEC_SYSCHECK_BIN_DIRS%%|${ossec_syscheck_bin_dirs}|" \
+            -e "s|%%OSSEC_SYSCHECK_ETC_DIRS%%|${ossec_syscheck_etc_dirs}|" \
+            "${ossec_file}"
+    else
+        sed -e 's|<template_config .*os="FreeBSD".*>|<ossec_config>|' \
+            -e 's|</template_config>|</ossec_config>|' \
+            -e "s|%%OSSEC_SYSCHECK_BIN_DIRS%%|${ossec_syscheck_bin_dirs}|" \
+            -e "s|%%OSSEC_SYSCHECK_ETC_DIRS%%|${ossec_syscheck_etc_dirs}|" \
+            "${ossec_file}"
+    fi
+}
+
+extract() {
+    sed -n '/^<ossec_config.*>$/,/^<\/ossec_config>$/p'
+}
+
+replace | extract