need help with ossec
ovitorio at hotmail.com
Fri Mar 7 22:42:30 UTC 2008
I've tried to edit "ossec.conf" file in /var/ossec/etc but was not
allowed to save changes.
Before editing the file I had stopped OSSEC executing "sudo
/etc/init.d/ossec stop". Then tried both "gksudo gedit
/var/ossec/etc/ossec.conf" and "sudo -s" and then as root tried to
edit the file.
In both cases in Gedit I get Save option disabled with no way to save
changes. In Vim I was prompted for an attempt to save a read-only
file and then bash reported an error.
It look obvious to me that OSSEC rightfully protects its files and
this is the problem. Thus I'm not looking for a work around (like
removing read-only attrib, etc.) here but rather for the right way to
do things. But so far I've not found anything related to the case in
OSSEC's documentation and wiki.
Anybody uses OSSEC here and can help?
More information about the ubuntu-users