I try to learn about Ossec, but, when i access to the Ossec web UI in the Main tab, Ossec shows me:
"unable to retrieve alerts"
I see the alerts.log file and i can read different problems.
Why i can't see the alerts in the web?
For more information:
Ossec Installation: /var/ossec
Ossec permissions: ossec:ossec
Ossec web UI installation: /var/www/
Ossec web UI permission: apache:apache
The ossec user is in apache group.
Thanks for all, and sorry, my english is bad
The answer to my cuestion.
The problem is Selinux, you can make 2 things:
Option 1 - Disable Selinux:
#vi /etc/selinux/config
change this
SELINUX=enforcing
for
SELINUX=disabled
and reboot the system.
Option 2 - Permit with Selinux options.
If you need Selinux active, you can say to Selinux that permit this actions.
Install:
yum install setroubleshoot
Execute this:
sealert -a /var/log/audit/audit.log
This shows, the aplications that Selinux is denying, also in this file, you can see the solution, see the example:
SELinux is preventing /usr/sbin/httpd from getattr access on the archivo /var/ossec/queue/syscheck/syscheck.
***** Sugerencia de complemento catchall_labels (83.8 confidence) **********
Sidesea permitir que httpd tenga getattr acceso al syscheck file
Entoncesnecesita modificar la etiqueta en /var/ossec/queue/syscheck/syscheck
Hacer
# semanage fcontext -a -t FILE_TYPE '/var/ossec/queue/syscheck/syscheck'
donde FILE_TYPE es uno de los siguientes: dirsrv_config_t,
httpd_mediawiki_htaccess_t, fail2ban_var_lib_t, abrt_var_run_t, krb5_conf_t,
udev_tbl_t, httpd_tmp_t, smokeping_var_lib_t, shell_exec_t,
httpd_w3c_validator_htaccess_t, mysqld_etc_t, cvs_data_t, calamaris_www_t,
dirsrvadmin_tmp_t, cobbler_etc_t, sysctl_crypto_t, httpd_cache_t, httpd_tmpfs_t,
httpd_helper_exec_t, iso9660_t, dbusd_etc_t, dirsrv_share_t, var_lib_t,
user_cron_spool_t, configfile, httpd_squirrelmail_t, cfengine_var_log_t,
httpd_php_exec_t, httpd_nagios_htaccess_t, abrt_t, httpd_mediawiki_tmp_t, lib_t,
samba_var_t, dirsrv_var_log_t, zarafa_var_lib_t, abrt_helper_exec_t, net_conf_t,
ld_so_t, cert_type, etc_runtime_t, git_system_content_t, dirsrv_var_run_t,
puppet_var_lib_t, public_content_t, httpd_var_lib_t, httpd_var_run_t, logfile,
anon_inodefs_t, sysctl_kernel_t, httpd_modules_t, user_tmp_t,
httpd_awstats_htaccess_t, httpd_dirsrvadmin_htaccess_t, textrel_shlib_t,
httpd_user_htaccess_t, chroot_exec_t, httpd_sys_content_t, public_content_rw_t,
httpd_suexec_exec_t, application_exec_type, httpd_bugzilla_htaccess_t,
httpd_cobbler_htaccess_t, rpm_script_tmp_t, httpd_nutups_cgi_htaccess_t,
mailman_data_t, mailman_cgi_exec_t, httpd_apcupsd_cgi_htaccess_t, gitosis_var_lib_t,
system_dbusd_var_lib_t, dirsrvadmin_config_t, httpd_cvs_htaccess_t,
httpd_git_htaccess_t, httpd_sys_htaccess_t, httpd_squid_htaccess_t,
squirrelmail_spool_t, httpd_munin_htaccess_t, dirsrvadmin_unconfined_script_exec_t,
mailman_archive_t, httpd_prewikka_htaccess_t, passenger_var_lib_t,
passenger_var_run_t, cobbler_var_lib_t, user_home_t, bin_t, rpm_tmp_t, httpd_t,
lib_t, puppet_tmp_t, ld_so_cache_t, usr_t, abrt_var_cache_t,
httpd_rotatelogs_exec_t, locale_t, httpd_unconfined_script_exec_t,
httpd_smokeping_cgi_htaccess_t, etc_t, fonts_t, nagios_etc_t, nagios_log_t,
sssd_public_t, proc_t, httpd_keytab_t, sysfs_t, krb5_keytab_t, passenger_exec_t,
cluster_conf_t, httpd_config_t, fonts_cache_t, httpd_exec_t, httpd_lock_t,
httpd_log_t, httpd_prewikka_script_exec_t, httpd_munin_ra_content_t,
httpd_munin_rw_content_t, httpd_nutups_cgi_content_t, httpd_sys_script_exec_t,
httpd_dirsrvadmin_script_exec_t, httpd_git_script_exec_t, httpd_cvs_script_exec_t,
httpd_bugzilla_ra_content_t, httpd_bugzilla_rw_content_t,
httpd_nutups_cgi_script_exec_t, root_t, httpd_cvs_ra_content_t,
httpd_cvs_rw_content_t, httpd_git_ra_content_t, httpd_git_rw_content_t,
httpd_nagios_content_t, httpd_sys_ra_content_t, httpd_sys_rw_content_t,
httpd_sys_rw_content_t, httpd_w3c_validator_content_t, httpd_nagios_ra_content_t,
httpd_nagios_rw_content_t, httpd_nutups_cgi_ra_content_t,
httpd_nutups_cgi_rw_content_t, httpd_cobbler_script_exec_t,
httpd_mediawiki_script_exec_t, httpd_smokeping_cgi_script_exec_t,
httpd_apcupsd_cgi_content_t, httpd_git_content_t, httpd_user_content_t,
httpd_apcupsd_cgi_ra_content_t, httpd_apcupsd_cgi_rw_content_t,
httpd_mediawiki_ra_content_t, httpd_mediawiki_rw_content_t,
httpd_smokeping_cgi_content_t, httpd_cvs_content_t, httpd_sys_content_t,
httpd_squid_ra_content_t, httpd_squid_rw_content_t, httpd_prewikka_content_t,
httpd_munin_script_exec_t, httpd_smokeping_cgi_ra_content_t,
httpd_smokeping_cgi_rw_content_t, httpd_w3c_validator_script_exec_t,
httpd_prewikka_ra_content_t, httpd_prewikka_rw_content_t, httpd_user_script_exec_t,
httpd_bugzilla_content_t, httpd_munin_content_t, httpd_squid_content_t,
httpd_mediawiki_content_t, httpd_awstats_script_exec_t,
httpd_dirsrvadmin_ra_content_t, httpd_dirsrvadmin_rw_content_t, krb5_host_rcache_t,
httpd_apcupsd_cgi_script_exec_t, httpd_dirsrvadmin_content_t,
httpd_cobbler_content_t, httpd_squid_script_exec_t,
httpd_w3c_validator_ra_content_t, httpd_w3c_validator_rw_content_t,
httpd_nagios_script_exec_t, httpd_awstats_ra_content_t, httpd_awstats_rw_content_t,
httpd_awstats_content_t, httpd_user_ra_content_t, httpd_user_rw_content_t,
httpd_bugzilla_script_exec_t, httpdcontent,httpd_cobbler_ra_content_t,
httpd_cobbler_rw_content_t.
Luego ejecute:
restorecon -v '/var/ossec/queue/syscheck/syscheck'
***** Sugerencia de complemento catchall (17.1 confidence) *****************
Sicree que de manera predeterminada, httpd debería permitir acceso getattr sobre syscheck file.
Entoncesdebería reportar esto como un error.
Puede generar un módulo de política local para permitir este acceso.
Hacer
permita el acceso momentáneamente executando:
# grep httpd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Explain the comands:
# semanage fcontext -a -t FILE_TYPE '/var/ossec/queue/syscheck/syscheck'
This, permit temporaly this application
# grep httpd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
This 2 commands, permit always this aplication.
And, if you have Desktop, you can go to graphic Selinux aplication, and see the same information.
PD: Sorry, i know that the report is in spanish, but the commands if tje important thing, this commands are the same in spanish or english.
See you soon!