Hi! On Wed, Oct 6, 2010 at 11:46 AM, jplee3 <[email protected]> wrote: > Hi, > > I came across a couple threads mentioning it's impossible to have > OSSEC point to another logging directory due to "chrooted processes" - > this seems a bit convoluted and I just wanted to know practically > *why* it isn't possible and if there are any thoughts on bringing the > option in (and if not, why not). >
Because the processes are chrooted. Assuming a default install in /var/ossec, the processes cannot see outside of /var/ossec. /var/ossec is the / directory for some of the ossec processes, and /var/log does not exist. This is done as a security measure. If one of the chrooted processes is compromised the attacker shouldn't be able to modify anything outside of /var/ossec. OpenSSH uses chroot as part of its privilege separation protection (http://www.citi.umich.edu/u/provos/ssh/privsep.html). > I don't see any reason why it would be a bad idea to be able to log to > another location. I know the OSSEC logs don't grow very large, but > this dynamic can change if many clients are added that are generally > noisier (depending on how the alerting is setup). Regardless, it would > just be nice to have the option. > Remove the chroot calls in the source. Most people that I've talked to would rather have the protection over this option. It's a tradeoff. > I know there are several workarounds: mounting a new partition and > assigning it /var/ossec/logs, but that can be quite a hassle depending > on the environment and won't work for everyone. The only other option > is rsyncing files over, but that's more overhead to be concerned > about. > > Other options: local nfs mounts, null mounts(?) This is a planning problem. You have to plan for expansion, and part of that is making sure you have enough space for logs.
