Hi folks,

I followed the OSSEC-WUI install guide 
(http://www.ossec.net/wiki/index.php/OSSECWUI:Install) to the letter, and 
triple-checked my work... but I still cannot get OSSEC-WUI to work.

Running OSSEC-1.6 with OSSEC-WUI-0.3; OSSEC is installed within the Apache 
chroot. This is on top of CentOS 5.1 (SELinux disabled).


==> /var/www/html/ossec_conf.php <==
...
/* Ossec directory */
$ossec_dir="/var/www/ossec/";
...


==> /etc/group <==
...
ossec:x:101:apache:
...

==> # ls -la /var/www/ossec <==
total 44
dr-xr-x--- 11 root  ossec 4096 Aug 18 18:13 .
drwxr-xr-x 10 root  root  4096 Jan 21  2008 ..
dr-xr-x---  3 root  ossec 4096 Aug 18 18:13 active-response
dr-xr-x---  2 root  ossec 4096 Sep  8 11:58 bin
dr-xr-x---  3 root  ossec 4096 Sep  8 13:06 etc
drwxr-x---  5 ossec ossec 4096 Aug 20 21:13 logs
dr-xr-x---  9 root  ossec 4096 Aug 18 18:13 queue
dr-xr-x---  5 root  ossec 4096 Sep  8 13:06 rules
drwxr-x---  5 ossec ossec 4096 Aug 18 18:14 stats
dr-xr-x---  2 root  ossec 4096 Aug 18 18:13 tmp
dr-xr-x---  3 root  ossec 4096 Sep  8 13:06 var


==> /var/log/httpd/ssl_error_log <==
[Mon Sep 08 13:27:25 2008] [error] [client 10.100.100.30] PHP Warning:  
opendir(/var/www/ossec/) [<a href='function.opendir'>function.opendir</a>]: 
failed to open dir: Permission denied in 
/var/www/html/ossec-wui/lib/os_lib_handle.php on line 94, referer: 
https://192.168.1.82/ossec-wui/index.php


==> # ls -la /var/www/html/ossec-wui <==
total 108
drwxr-xr-x 8 1000   1000  4096 Aug 11 12:48 .
drwxr-xr-x 4 root root    4096 Aug 21 11:05 ..
-rwxr-xr-x 1 1000   1000   278 Feb 27  2008 CONTRIB
drwxr-xr-x 3 1000   1000  4096 Mar  4  2008 css
-rw-r--r-- 1 root root     266 Sep  8 12:55 .htaccess
-rw-r--r-- 1 1000   1000   218 Feb 29  2008 htaccess_def.txt
-rw-r--r-- 1 root root      22 Sep  8 12:55 .htpasswd
drwxr-xr-x 2 1000   1000  4096 Mar  4  2008 img
-rwxr-xr-x 1 1000   1000  5225 Feb 27  2008 index.php
drwxr-xr-x 2 1000   1000  4096 Mar  4  2008 js
drwxr-xr-x 3 1000   1000  4096 Aug 11 12:48 lib
-rw-r--r-- 1 1000   1000 35745 Mar  3  2008 LICENSE
-rw-r--r-- 1 1000   1000   467 Sep  8 13:09 ossec_conf.php
-rw-r--r-- 1 1000   1000  1157 Feb 27  2008 README
-rw-r--r-- 1 1000   1000   923 Feb 27  2008 README.search
-rwxr-xr-x 1 1000   1000  1824 Feb 29  2008 setup.sh
drwxr-xr-x 2 1000   1000  4096 Aug 11 12:48 site
drwxrwx--- 2 root apache  4096 Aug 11 12:48 tmp


It's clearly a file permissions issue, but if I open up the permissions 
/var/www/ossec enough to make OSSEC-WUI read data within, OSSEC log-collector 
fails at the following restart:

==> /var/www/ossec/logs/ossec.log <==
2008/09/08 13:01:02 ossec-logcollector(1211): ERROR: Unable to access queue: 
'/var/www/ossec/queue/ossec/queue'. Giving up..

I've restarted Apache a number of times after all my changes, and I tried this 
with OSSEC 1.5.1 and OSSEC 1.6, so I don't think it's corrupt install. (This 
was all working back with OSSEC 1.5 a couple of months ago.)

BTW: with regards to the OSSEC-WUI install wiki, it's unclear which "tmp/" dir 
step# 6 is referring to...

Any help/advice is extremely appreciated.

Thanks in advance,





      

Reply via email to