Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > HOWTO-Related Questions

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 20th September 2006, 20:45
PortMan PortMan is offline
Member
 
Join Date: Jun 2006
Posts: 57
Thanks: 0
Thanked 0 Times in 0 Posts
Default Securing Your Server With A Host-based Intrusion Detection System

I installed OSSEC HIDS and I'm now getting an email every minute with the following error:

Received From: helix->syscheck
Rule: 13 fired (level 8) -> "Integrity checksum of file '/etc/sysconfig/hwconf' has changed again (2nd time)"
Portion of the log(s):


1. What is this telling me?

2. How do I correct the error?


Thanks.
Reply With Quote
Sponsored Links
  #2  
Old 21st September 2006, 20:21
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,747 Times in 2,578 Posts
Default

Quote:
Originally Posted by PortMan
I installed OSSEC HIDS and I'm now getting an email every minute with the following error:

Received From: helix->syscheck
Rule: 13 fired (level 8) -> "Integrity checksum of file '/etc/sysconfig/hwconf' has changed again (2nd time)"
Portion of the log(s):


1. What is this telling me?
It is telling you that the file /etc/sysconfig/hwconf has changed.

Quote:
Originally Posted by PortMan
2. How do I correct the error?
It's no error. If you think this file shouldn't have changed, you can now take further investigations, and if you think this is ok you can just ignore the mail.
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #3  
Old 21st September 2006, 20:36
PortMan PortMan is offline
Member
 
Join Date: Jun 2006
Posts: 57
Thanks: 0
Thanked 0 Times in 0 Posts
Default

Thanks for the reply. What type of changes would make this file change? I haven't changed any hardware or software.
Reply With Quote
  #4  
Old 22nd September 2006, 14:28
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,747 Times in 2,578 Posts
 
Default

I wouldn't worry too much about it. In this case I think it's the normal system behaviour.
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
php Apps email not going through palkat General 8 21st September 2011 06:35
Statistic not working mzo Installation/Configuration 49 20th April 2011 13:19
Webmail Relay Error palkat General 17 23rd April 2006 19:12
server blocked/stopped by host Ovidiu Technical 11 14th February 2006 11:50
The Perfect Setup Suse 9.3 - Postfix problems new_bee05 HOWTO-Related Questions 20 25th November 2005 03:30


All times are GMT +2. The time now is 01:36.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.