carlopmart wrote:
> Hi all,
>
> I have install ossec 1.3 on two rhel5 servers. On both servers ossec
> generates this alert??
>
> OSSEC HIDS Notification.
> 2007 Sep 12 09:51:32
>
> Received From: xenhost->rootcheck
> Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
> Portion of the log(s):
>
> File '/sys/module/sbs/parameters/capacity_mode' is owned by root and has
> written permissions to anyone.
>
>
> What does it means???
>
>
Ah, I expect, if you check the permissions on that file, you will find
that the owner is root and the everyone has write permissions. Not being
that familiar with RHEL per se, I would guess that's a system file and
giving everyone write permissions invites, er, damage. :-)
