the 3 directories are ready to compile deb (src and bin).

pre-requisites:
- apt-get install ubuntu-dev-tools build-essential debhelper gnupg-agent

In particular you can use them to:
- make install to get the proper tools (build)
- use dpkg-buildpackage -rfakeroot to make the bin deb
- use debuild -S -sa to make the src deb


deprecated:
- install ossec with the normal ./install.sh
- make deb to create the proper package

To build the deb src:
#####################
- if it is a major change copy ossec-hids-2.7.tar.gz to ossec-hids-*_2.7.0.orig.tar.gz
- maybe update ossec-hids-*-2.6.0/debian/changelog (with 'dch -i' command): pay attention to lucid vs precise and to email address (nicolas.zin@gmail.com)
- copy the src directory from ossec-hids-2.6.tgz to src (in the same directory than Makefile)
- copy the etc directory from ossec-hids-2.6.tgz to etc (in the same directory than Makefile)
- copy the contrib directory from ossec-hids-2.6.tgz to etc (in the same directory than Makefile)
- copy the active-response directory from ossec-hids-2.7.tgz to active-response (in the same directory than Makefile)
- for the ossec-hids-server, change etc/ossec.conf to add
  <ossec_config>
  <global>
    <!-- to specify GeoIP database file location -->
    <geoip_db_path>/etc/GeoLiteCity.dat</geoip_db_path>
    <geoip6_db_path>/etc/GeoLiteCityv6.dat</geoip6_db_path>
  </global>
  <alerts>
    <!-- to add GeoIP info in alerts -->
    <use_geoip>yes</use_geoip>
  </alerts>
  </ossec_config>

- have the gpg key
- debuild -S -sa to make the src deb

upload to launchpad:
* ossec-hids-*_2.6.0-ubuntu1.dsc
* ossec-hids-*_2.6.0.orig.tar.gz
* ossec-hids-*_2.6.0-ubuntu1.diff.gz
or
dput ppa:nicolas-zin/ossec-ubuntu <source.changes>


Do the process for lucid and precise