Securing Your Server With A Host-based Intrusion Detection System

Discussion in 'HOWTO-Related Questions' started by radox, Oct 7, 2006.

  1. radox

    radox New Member

    On running the ./install.sh evrything goes ok until I run the final install here is the error:


    os_xml_node_access.c:18:20: string.h: No such file or directory
    os_xml_node_access.c:19:20: stdlib.h: No such file or directory
    os_xml_node_access.c: In function `OS_ClearNode':
    os_xml_node_access.c:35: warning: implicit declaration of function `free'
    os_xml_node_access.c:59: error: `NULL' undeclared (first use in this function)
    os_xml_node_access.c:59: error: (Each undeclared identifier is reported only once
    os_xml_node_access.c:59: error: for each function it appears in.)
    os_xml_node_access.c: In function `OS_GetElementsbyNode':
    os_xml_node_access.c:79: error: `NULL' undeclared (first use in this function)
    os_xml_node_access.c:101: warning: implicit declaration of function `realloc'
    os_xml_node_access.c:106: warning: implicit declaration of function `calloc'
    os_xml_node_access.c:116: warning: implicit declaration of function `strdup'
    os_xml_node_access.c:116: warning: assignment makes pointer from integer without a cast
    os_xml_node_access.c:126: warning: assignment makes pointer from integer without a cast
    os_xml_node_access.c:148: warning: assignment makes pointer from integer without a cast
    os_xml_node_access.c:149: warning: assignment makes pointer from integer without a cast
    os_xml_variables.c:17:19: stdio.h: No such file or directory
    os_xml_variables.c:18:20: string.h: No such file or directory
    os_xml_variables.c:19:20: stdlib.h: No such file or directory
    os_xml_variables.c: In function `OS_ApplyVariables':
    os_xml_variables.c:26: error: `NULL' undeclared (first use in this function)
    os_xml_variables.c:26: error: (Each undeclared identifier is reported only once
    os_xml_variables.c:26: error: for each function it appears in.)
    os_xml_variables.c:41: warning: implicit declaration of function `strcasecmp'
    os_xml_variables.c:47: warning: implicit declaration of function `snprintf'
    os_xml_variables.c:49: warning: implicit declaration of function `realloc'
    os_xml_variables.c:53: warning: implicit declaration of function `strdup'
    os_xml_variables.c:53: warning: assignment makes pointer from integer without a cast
    os_xml_variables.c:58: warning: implicit declaration of function `strncpy'
    os_xml_variables.c:85: warning: assignment makes pointer from integer without a cast
    os_xml_variables.c:111: warning: implicit declaration of function `strlen'
    os_xml_variables.c:116: warning: assignment makes pointer from integer without a cast
    os_xml_variables.c:131: warning: implicit declaration of function `memset'
    os_xml_variables.c:168: warning: implicit declaration of function `strncat'
    os_xml_variables.c:205: warning: implicit declaration of function `free'
    make[1]: *** [xml] Error 1
    make[1]: Leaving directory `/tmp/ossec-hids-0.9-2/src/os_xml'

    Error Making os_xml
    make: *** [all] Error 1

    Error 0x5.
    Building error. Unable to finish the installation.


    radox
     
  2. falko

    falko Super Moderator Howtoforge Staff Moderator HowtoForge Supporter ISPConfig Developer

    Please run
    Code:
    apt-get install apt-file
    apt-file update
    apt-file search string.h
    What's the output of the last command?
     
  3. radox

    radox New Member

    string.h

    there is to much output send by email to
    your email address and same error message

    radox
     
    Last edited: Oct 10, 2006
  4. falko

    falko Super Moderator Howtoforge Staff Moderator HowtoForge Supporter ISPConfig Developer

    And what's the output of
    Code:
    apt-file search stdlib.h
    ?

    I think the missing package is libc6-dev. You can install it like this:
    Code:
    apt-get install libc6-dev
     
  5. radox

    radox New Member

    remote email address

    thankyou the lib package was missing.

    look at the output below at the last line;
    2006/10/10 12:08:17 ossec-maild(1223): Error Sending email to 127.0.0.1 (smtp server)

    what i did was put my remote email address to send any messages to but maybe this will not work as my email address is not local.
    how to set up my remote email address as this set up had been done on a vps.
    with debian 3.1?. I am in france ,vps is in US

    here is the line from the howto

    : 3.1- Do you want e-mail notification? (y/n) [y]: <-- y

    - What's your e-mail address? <-- example@example.com (please enter your own email address here)






    ----------------------------------------------------------------------------------------


    ~# tail -f /var/ossec/logs/ossec.log
    2006/10/10 12:07:55 ossec-syscheckd: Started (pid: 19903).
    2006/10/10 12:07:55 ossec-analysisd: Connected to '/queue/alerts/execq' (exec queue)
    2006/10/10 12:07:58 ossec-logcollector(1950): Analyzing file: '/var/log/messages'.
    2006/10/10 12:07:58 ossec-logcollector(1950): Analyzing file: '/var/log/auth.log'.
    2006/10/10 12:07:58 ossec-logcollector(1950): Analyzing file: '/var/log/syslog'.
    2006/10/10 12:07:58 ossec-logcollector(1950): Analyzing file: '/var/log/mail.info'.
    2006/10/10 12:07:58 ossec-logcollector(1950): Analyzing file: '/var/log/apache/error.log'.
    2006/10/10 12:07:58 ossec-logcollector(1950): Analyzing file: '/var/log/apache/access.log'.
    2006/10/10 12:07:58 ossec-logcollector: Started (pid: 19889).
    2006/10/10 12:08:17 ossec-maild(1223): Error Sending email to 127.0.0.1 (smtp server)
     
  6. falko

    falko Super Moderator Howtoforge Staff Moderator HowtoForge Supporter ISPConfig Developer

    I guess you specified the wrong SMTP server during installation (127.0.0.1). You can change it in /var/ossec/etc/ossec.conf. You should change it to the mail server you see when you run
    Code:
    dig mx example.com
    (replace example.com with your own email domain.
     
  7. radox

    radox New Member

    which server am i useing this software to dectect

    ok in the email address i have placed my own admin@mydomain.com

    in the ipaddress section/server i have placed mail.mydomian.com

    so am i correct in thinking that the software will detect the intrusions etc on the local system and send me a email on my remote system if anything is dectected.

    radox
     
  8. falko

    falko Super Moderator Howtoforge Staff Moderator HowtoForge Supporter ISPConfig Developer

    Yes, that's right.
     

Share This Page