Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > HOWTO-Related Questions

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Thread Tools Display Modes
Old 19th March 2008, 01:37
vitorio vitorio is offline
Junior Member
Join Date: Mar 2008
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
Default how to save changes to ossec.conf file?

I've recently installed OSSEC. I did not had any problems during installation. It also seems to be running. But... I'm having problem to edit ossec.conf file in /var/ossec/etc directory.

The file is read-only and thus no changes allowed to be made, no matter with privileges I have while doing it.

I've not tried to chmod the file (yet ) in order to alter access permissions and to make it writable since I have a feeling this would be a wrong way of doing things.

To me it looks like a kind of hacking a good security system, something similar to logging in as root instead of using sudo in Ubuntu.

Am i wrong here and removing read-only attribute is the only way to go? Or another OSSEC specific way does exists?
Reply With Quote
Sponsored Links
Old 19th March 2008, 02:11
o.meyer o.meyer is offline
Senior Member
Join Date: Aug 2007
Posts: 167
Thanks: 2
Thanked 24 Times in 23 Posts

Hi vitorio,

please paste the output of

ls -la /var/ossec/etc/ossec.conf
Best regards,

Reply With Quote
Old 19th March 2008, 03:59
zcworld zcworld is offline
Senior Member
Join Date: Jul 2006
Location: South Australia
Posts: 329
Thanks: 2
Thanked 37 Times in 37 Posts
Send a message via MSN to zcworld Send a message via Skype™ to zcworld

i would think the file would be owned by the root / wheel group
so you need to be root user or SU to have access rights to edit that file
Shane Ebert :: Facebok
Reply With Quote
Old 20th March 2008, 00:16
vitorio vitorio is offline
Junior Member
Join Date: Mar 2008
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts

Here is output of ls -la:

vitorio@homedir:~$ sudo ls -la /var/ossec/etc/ossec.conf
-r--r----- 1 root ossec 5928 2008-03-04 16:34 /var/ossec/etc/ossec.conf
To make my previous post clearer... I certainly gained root privileges before attempting to edit the file. I actually did it different ways:

gksudo gedit/vim /var/ossec/etc/ossec.conf
sudo -s 
root:# gedit/vim /var/ossec/etc/ossec.conf
In gedit I just had Save button disabled, vim reported an error attempting to modify a read-only file and gave up.

But this behavior is natural - file as you can see above is indeed read-only after installation.

So, my question was, am I trying to invent the wheel and to change the file attributes to read/write is the way to go, or there is some specific OSSEC way to handle it?
Reply With Quote
Old 20th March 2008, 19:10
falko falko is offline
Super Moderator
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,749 Times in 2,579 Posts

chmod 640 /var/ossec/etc/ossec.conf
Then edit it, save your changes, and run
chmod 440 /var/ossec/etc/ossec.conf
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Postfix delivery problem erebus Installation/Configuration 8 29th July 2014 21:17
Chroot SSH + ISPConfig Norman Installation/Configuration 27 26th March 2007 04:40
Systemimager (rsync) doesn't copy all comedit HOWTO-Related Questions 11 19th January 2007 18:17
HotSaNIC domino Tips/Tricks/Mods 23 6th November 2006 06:19
jamed up my table borders?? Boon-Dog-Danny Installation/Configuration 5 23rd September 2006 17:12

All times are GMT +2. The time now is 19:28.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.