Peter M. Abraham wrote: > In the past, just having UDP 1514 open to/from the ossec control > server was enough. > > Are there any other ports, including any ephemeral ones that need to > be open?
Just to clarify what others have said, port 1514/UDP on the server is needed, but I haven't run into any situations where any ports needed to be allowed on the client. I have used Linux and Windows clients with both running host firewalls and it worked fine with no special exceptions.
