0

I have just installed the current stable release of OSSEC (2.8.1) for Ubuntu, but at the end of the installation I noticed that it said:

- System is Debian (Ubuntu or derivative).
 - Init script modified to start OSSEC HIDS during boot.

 - Configuration finished properly.

 - To start OSSEC HIDS:
        /var/ossec/bin/ossec-control start

 - To stop OSSEC HIDS:
        /var/ossec/bin/ossec-control stop

 - The configuration can be viewed or modified at /var/ossec/etc/ossec.conf

So what is OSSEC HIDS, is it the actual program or something else? If it is the actual program then does this mean that I need to add the command /var/ossec/bin/ossec-control start to the list of startup applications?

Information Update:

I have found that unless I run this command to manually start OSSEC HIDS:

sudo /var/ossec/bin/ossec-control start

That if I run the command to check the status:

sudo /var/ossec/bin/ossec-control status

This is the output:

ossec-monitord not running...
ossec-logcollector not running...
ossec-syscheckd not running...
ossec-analysisd not running...
ossec-maild not running...
ossec-execd not running...

So it does not seem that it starts automatically, how can I get it to do this then? I have also found that I cannot add this to the list of startup applications as the start command requires sudo to be executed.


OS Information:

Description:    Ubuntu 14.10
Release:    14.10
16
  • I'd stick that command in /etc/rc.local, where the sudo wouldn't be needed.
    – muru
    Apr 5, 2015 at 10:20
  • @muru: What? The start command? If yes, should I include sudo at the start of the command?
    – user364819
    Apr 5, 2015 at 10:21
  • Yes, add /var/ossec/bin/ossec-control start to /etc/rc.local, and without the sudo. Commands in rc.local are run as root.
    – muru
    Apr 5, 2015 at 10:23
  • @muru: Ok, will try that... most of that script at the moment seems to be commented out, should I uncomment out the first line #!/bin/sh -e at least? And should I just leave the exit 0 there?
    – user364819
    Apr 5, 2015 at 10:24
  • @muru: And if I leave the exit 0 in there, should I put my command before or after it, or does it not matter?
    – user364819
    Apr 5, 2015 at 10:26

3 Answers 3

1

One way to run OSSEC at startup is to add the start command to /etc/rc.local before the exit 0 line and after #! /bin/sh. Though this is no longer necessary now that OSSEC supports systemd.

1

OSSEC = Open Source SECurity

HIDS = host-based intrusion detection system (HIDS)

http://www.ossec.net/

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

From the message, OSSEC will automatically start on boot and runs as a service in the back ground.

To manually start or stop use

sudo /var/ossec/bin/ossec-control start
sudo /var/ossec/bin/ossec-control stop

you do not need to do anything else.

See also http://ubuntuforums.org/showthread.php?t=213445

Although it is possible my forums post may be a bit dated, for the most part it should help. If there is a problem with the post, post in the forums.

5
  • So it definitely starts on startup because I do not receive any emails from it until I start it manually? And when I start it manually it tells me that it has successfully started the services, instead of telling me that they are already running?
    – user364819
    Apr 4, 2015 at 17:40
  • you may wish to install the web interface - ossec.net/wiki/index.php/OSSECWUI:Install
    – Panther
    Apr 4, 2015 at 18:11
  • you can likely run sudo /var/ossec/bin/ossec-control status
    – Panther
    Apr 4, 2015 at 18:12
  • If I do not first run the command to manually start OSSEC HIDS, then if I run the command to get the status this is the output: ossec-monitord not running... ossec-logcollector not running... ossec-syscheckd not running... ossec-analysisd not running... ossec-maild not running... ossec-execd not running...
    – user364819
    Apr 5, 2015 at 10:08
  • I have added more information to my original question.
    – user364819
    Apr 5, 2015 at 10:13
1

Not sure if you fixed this or not, but if you are still using 14.10 then you can try this:

sudo nano /etc/init.d/ossec

copy this:

 #!/bin/sh

case "$1" in
start)
  /var/ossec/bin/ossec-control start
;;
stop)
  /var/ossec/bin/ossec-control stop
;;
restart)
  $0 stop && sleep 3
  $0 start
;;
reload)
  $0 stop
  $0 start
;;
*)
echo "Usage: $0 {start|stop|restart|reload}"
exit 1
esac

Ctrl+o (save) Crtl+x (exit)

sudo chmod +x /etc/init.d/ossec
sudo update-rc.d ossec defaults

Test: sudo /etc/init.d/ossec start

Hope this helps.

You must log in to answer this question.