Hi folks, I followed the OSSEC-WUI install guide (http://www.ossec.net/wiki/index.php/OSSECWUI:Install) to the letter, and triple-checked my work... but I still cannot get OSSEC-WUI to work.
Running OSSEC-1.6 with OSSEC-WUI-0.3; OSSEC is installed within the Apache chroot. This is on top of CentOS 5.1 (SELinux disabled). ==> /var/www/html/ossec_conf.php <== ... /* Ossec directory */ $ossec_dir="/var/www/ossec/"; ... ==> /etc/group <== ... ossec:x:101:apache: ... ==> # ls -la /var/www/ossec <== total 44 dr-xr-x--- 11 root ossec 4096 Aug 18 18:13 . drwxr-xr-x 10 root root 4096 Jan 21 2008 .. dr-xr-x--- 3 root ossec 4096 Aug 18 18:13 active-response dr-xr-x--- 2 root ossec 4096 Sep 8 11:58 bin dr-xr-x--- 3 root ossec 4096 Sep 8 13:06 etc drwxr-x--- 5 ossec ossec 4096 Aug 20 21:13 logs dr-xr-x--- 9 root ossec 4096 Aug 18 18:13 queue dr-xr-x--- 5 root ossec 4096 Sep 8 13:06 rules drwxr-x--- 5 ossec ossec 4096 Aug 18 18:14 stats dr-xr-x--- 2 root ossec 4096 Aug 18 18:13 tmp dr-xr-x--- 3 root ossec 4096 Sep 8 13:06 var ==> /var/log/httpd/ssl_error_log <== [Mon Sep 08 13:27:25 2008] [error] [client 10.100.100.30] PHP Warning: opendir(/var/www/ossec/) [<a href='function.opendir'>function.opendir</a>]: failed to open dir: Permission denied in /var/www/html/ossec-wui/lib/os_lib_handle.php on line 94, referer: https://192.168.1.82/ossec-wui/index.php ==> # ls -la /var/www/html/ossec-wui <== total 108 drwxr-xr-x 8 1000 1000 4096 Aug 11 12:48 . drwxr-xr-x 4 root root 4096 Aug 21 11:05 .. -rwxr-xr-x 1 1000 1000 278 Feb 27 2008 CONTRIB drwxr-xr-x 3 1000 1000 4096 Mar 4 2008 css -rw-r--r-- 1 root root 266 Sep 8 12:55 .htaccess -rw-r--r-- 1 1000 1000 218 Feb 29 2008 htaccess_def.txt -rw-r--r-- 1 root root 22 Sep 8 12:55 .htpasswd drwxr-xr-x 2 1000 1000 4096 Mar 4 2008 img -rwxr-xr-x 1 1000 1000 5225 Feb 27 2008 index.php drwxr-xr-x 2 1000 1000 4096 Mar 4 2008 js drwxr-xr-x 3 1000 1000 4096 Aug 11 12:48 lib -rw-r--r-- 1 1000 1000 35745 Mar 3 2008 LICENSE -rw-r--r-- 1 1000 1000 467 Sep 8 13:09 ossec_conf.php -rw-r--r-- 1 1000 1000 1157 Feb 27 2008 README -rw-r--r-- 1 1000 1000 923 Feb 27 2008 README.search -rwxr-xr-x 1 1000 1000 1824 Feb 29 2008 setup.sh drwxr-xr-x 2 1000 1000 4096 Aug 11 12:48 site drwxrwx--- 2 root apache 4096 Aug 11 12:48 tmp It's clearly a file permissions issue, but if I open up the permissions /var/www/ossec enough to make OSSEC-WUI read data within, OSSEC log-collector fails at the following restart: ==> /var/www/ossec/logs/ossec.log <== 2008/09/08 13:01:02 ossec-logcollector(1211): ERROR: Unable to access queue: '/var/www/ossec/queue/ossec/queue'. Giving up.. I've restarted Apache a number of times after all my changes, and I tried this with OSSEC 1.5.1 and OSSEC 1.6, so I don't think it's corrupt install. (This was all working back with OSSEC 1.5 a couple of months ago.) BTW: with regards to the OSSEC-WUI install wiki, it's unclear which "tmp/" dir step# 6 is referring to... Any help/advice is extremely appreciated. Thanks in advance,
