Jeremiah, I'm new to OSSEC-HIDS as well. I am experiencing your issue though and I'm also running ossec on CentOS 5 server. When I would go to the WUI I would get no agent available on the main page, as well as no stats, etc. I changed the permissions on the ossec directory and it worked. chmod 775 -R /var/ossec If that doesn't work, try 777. This seemed to fix it for me. And below is a list of files and folders that were changed. My problem however is this seems to happen every single day. I have to run chmod 775 or 777 on the ossec direcotry in order for the WUI to work properly. Does anyone know why this happens? What sets the permissions on these directories? Is there a fix? The user I created when I set up WUI was added to the ossec group via /etc/groups. However, when I go to the WUI I'm not prompted to log in with this account. If I was, then perhaps it would always work as the WUI user is in the OSSEC group. It's like i'm automatically anonymously logging in and that's why I don't have access to agents, logs, stats unless I give permission to "all other users". Is my .htaccess file not working correctly? When you folks go to the WUI are you prompted to log in with a user account? Any help is greatly appreciated. TIA, Derrick mode of `ossec/stats/hourly-average/2' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/16' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/5' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/22' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/0' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/1' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/10' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/6' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/15' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/12' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/23' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/7' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/17' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/2' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/19' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/11' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/14' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/13' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/9' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/4' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/21' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/18' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/8' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/20' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/weekly-average/2/3' changed to 0777 (rwxrwxrwx) mode of `ossec/stats/totals/2009/Apr/ossec-totals-15.log' changed to 0777 (rwxrwxrwx) mode of `ossec/logs/archives/2009/Apr/ossec-archive-15.log' changed to 0777 (rwxrwxrwx) mode of `ossec/logs/archives/2009/Apr/ossec-archive-14.log.sum' changed to 0777 (rwxrwxrwx) mode of `ossec/logs/archives/archives.log' changed to 0777 (rwxrwxrwx) mode of `ossec/logs/alerts/alerts.log' changed to 0777 (rwxrwxrwx) mode of `ossec/logs/alerts/2009/Apr/ossec-alerts-14.log.sum' changed to 0777 (rwxrwxrwx) mode of `ossec/logs/alerts/2009/Apr/ossec-alerts-14.log.gz' changed to 0777 (rwxrwxrwx) mode of `ossec/logs/firewall/2009/Apr/ossec-firewall-14.log.sum' changed to 0777 (rwxrwxrwx) mode of `ossec/logs/firewall/2009/Apr/ossec-firewall-15.log' changed to 0777 (rwxrwxrwx) mode of `ossec/logs/firewall/firewall.log' changed to 0777 (rwxrwxrwx)
________________________________ From: [email protected] on behalf of Jeremiah J. French Sent: Sat 4/18/2009 12:00 AM To: [email protected] Subject: [ossec-list] ossec-wui-0.3 Hello, Disclaimer: I'm fairly new to both Linux and Ossec-HIDS My test environment includes a CentOS 5 server running Ossec-HIDS Server Manager 2.0 with WUI 0.3 and 1 Windows Vista client running Agent Manager for Windows 2.0 Agent connects to server fine (verified in agent logs and I am receiving notifications via email) however the WUI reports no agent available on the main page. I've rebooted several times, followed the instructions here: http://www.ossec.net/wiki/index.php/OSSECWUI:Install, checked the status of the server using: /var/ossec/bin/ossec-control status (output...) ossec-monitord is running... ossec-logcollector is running... ossec-remoted is running... ossec-syscheckd is running... ossec-analysisd is running... ossec-maild is running... ossec-execd is running... ...and tried the recommendation here: http://www.ossec.net/dcid/?p=125. Nothing seems to solve the problem. I am officially stuck. Any suggestions? Thanks, Jeremiah
<<inline: winmail.dat>>
