I have just installed the current stable release of OSSEC (2.8.1) for Ubuntu, but at the end of the installation I noticed that it said:
- System is Debian (Ubuntu or derivative).
- Init script modified to start OSSEC HIDS during boot.
- Configuration finished properly.
- To start OSSEC HIDS:
/var/ossec/bin/ossec-control start
- To stop OSSEC HIDS:
/var/ossec/bin/ossec-control stop
- The configuration can be viewed or modified at /var/ossec/etc/ossec.conf
So what is OSSEC HIDS
, is it the actual program or something else? If it is the actual program then does this mean that I need to add the command /var/ossec/bin/ossec-control start
to the list of startup applications?
Information Update:
I have found that unless I run this command to manually start OSSEC HIDS:
sudo /var/ossec/bin/ossec-control start
That if I run the command to check the status:
sudo /var/ossec/bin/ossec-control status
This is the output:
ossec-monitord not running...
ossec-logcollector not running...
ossec-syscheckd not running...
ossec-analysisd not running...
ossec-maild not running...
ossec-execd not running...
So it does not seem that it starts automatically, how can I get it to do this then? I have also found that I cannot add this to the list of startup applications as the start command requires sudo
to be executed.
OS Information:
Description: Ubuntu 14.10
Release: 14.10
/etc/rc.local
, where thesudo
wouldn't be needed.sudo
at the start of the command?/var/ossec/bin/ossec-control start
to/etc/rc.local
, and without thesudo
. Commands inrc.local
are run as root.#!/bin/sh -e
at least? And should I just leave theexit 0
there?exit 0
in there, should I put my command before or after it, or does it not matter?