[ossec-list] Re: Possible kernel level rootkit and wui0.2

[william maddler <news@xxxxxxxxxxx>]

Sebastian Esch wrote:
> hi all!
> 
> I just set up an new virtuozzo virtual server with debian3.1 and plesk 
> 8.1.1.
> since i used ossec before i installed the new version including the wui. 
> 2 problems:
> 
> 1. I get messages saying:
> 
> Received From: xxxxxxxxxxx->rootcheck
> Rule: 14 fired (level 8) -> "Rootkit detection engine message"
> Portion of the log(s):
> 
> Process 'xxxxx' hidden from /proc. Possible kernel level rootkit.

Could it be related to the virtual machine management system? I dunno,
just guessing, you could deduce that from process name/path/owner maybe.

> 
> serveral times
> 
> 2. after i installed the wui following the installguide in the wiki i get the following message:
> 
> 
> 
>             Unable to access ossec directory.
> 
> 
> I checked the directory in the conf-file and it is correct.

directory ownership/permissions? Maybe webui is running as 'www-data'
and ossec dir is owned by 'ossec', and no permission to access dir?

> 
> thank you very much for any help.
> 
> greetings
> 
> sebastian
>