Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > HOWTO-Related Questions

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 19th March 2008, 00:37
vitorio vitorio is offline
Junior Member
 
Join Date: Mar 2008
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
Default how to save changes to ossec.conf file?

I've recently installed OSSEC. I did not had any problems during installation. It also seems to be running. But... I'm having problem to edit ossec.conf file in /var/ossec/etc directory.

The file is read-only and thus no changes allowed to be made, no matter with privileges I have while doing it.

I've not tried to chmod the file (yet ) in order to alter access permissions and to make it writable since I have a feeling this would be a wrong way of doing things.

To me it looks like a kind of hacking a good security system, something similar to logging in as root instead of using sudo in Ubuntu.

Am i wrong here and removing read-only attribute is the only way to go? Or another OSSEC specific way does exists?
Reply With Quote
Sponsored Links
  #2  
Old 19th March 2008, 01:11
o.meyer o.meyer is offline
Senior Member
 
Join Date: Aug 2007
Posts: 167
Thanks: 2
Thanked 24 Times in 23 Posts
Default

Hi vitorio,

please paste the output of

Code:
ls -la /var/ossec/etc/ossec.conf
Best regards,

Olli
Reply With Quote
  #3  
Old 19th March 2008, 02:59
zcworld zcworld is offline
Senior Member
 
Join Date: Jul 2006
Location: South Australia
Posts: 329
Thanks: 2
Thanked 37 Times in 37 Posts
Send a message via MSN to zcworld Send a message via Skype™ to zcworld
Default

i would think the file would be owned by the root / wheel group
so you need to be root user or SU to have access rights to edit that file
__________________
Shane Ebert :: Facebok
Reply With Quote
  #4  
Old 19th March 2008, 23:16
vitorio vitorio is offline
Junior Member
 
Join Date: Mar 2008
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
Default

Here is output of ls -la:

Code:
vitorio@homedir:~$ sudo ls -la /var/ossec/etc/ossec.conf
-r--r----- 1 root ossec 5928 2008-03-04 16:34 /var/ossec/etc/ossec.conf
To make my previous post clearer... I certainly gained root privileges before attempting to edit the file. I actually did it different ways:

Code:
gksudo gedit/vim /var/ossec/etc/ossec.conf
and
Code:
sudo -s 
root:# gedit/vim /var/ossec/etc/ossec.conf
In gedit I just had Save button disabled, vim reported an error attempting to modify a read-only file and gave up.

But this behavior is natural - file as you can see above is indeed read-only after installation.

So, my question was, am I trying to invent the wheel and to change the file attributes to read/write is the way to go, or there is some specific OSSEC way to handle it?
Reply With Quote
  #5  
Old 20th March 2008, 18:10
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,741 Times in 2,575 Posts
 
Default

Run
Code:
chmod 640 /var/ossec/etc/ossec.conf
Then edit it, save your changes, and run
Code:
chmod 440 /var/ossec/etc/ossec.conf
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Postfix delivery problem erebus Installation/Configuration 8 29th July 2014 20:17
Chroot SSH + ISPConfig Norman Installation/Configuration 27 26th March 2007 03:40
Systemimager (rsync) doesn't copy all comedit HOWTO-Related Questions 11 19th January 2007 17:17
HotSaNIC domino Tips/Tricks/Mods 23 6th November 2006 05:19
jamed up my table borders?? Boon-Dog-Danny Installation/Configuration 5 23rd September 2006 16:12


All times are GMT +2. The time now is 23:09.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.