[ossec-list] Re: Possible kernel level rootkit and wui0.2

[Sebastian Esch <sebastian@xxxxxxx>]

william maddler wrote:
> Sebastian Esch wrote:
>   
> > hi all!
> >
> > I just set up an new virtuozzo virtual server with debian3.1 and plesk 
> > 8.1.1.
> > since i used ossec before i installed the new version including the wui. 
> > 2 problems:
> >
> > 1. I get messages saying:
> >
> > Received From: xxxxxxxxxxx->rootcheck
> > Rule: 14 fired (level 8) -> "Rootkit detection engine message"
> > Portion of the log(s):
> >
> > Process 'xxxxx' hidden from /proc. Possible kernel level rootkit.
> >     
>
> Could it be related to the virtual machine management system? I dunno,
> just guessing, you could deduce that from process name/path/owner maybe.
>
>   

probably will be...
> > serveral times
> >
> > 2. after i installed the wui following the installguide in the wiki i get the following message:
> >
> >
> >
> >             Unable to access ossec directory.
> >
> >
> > I checked the directory in the conf-file and it is correct.
> >     
>
> directory ownership/permissions? Maybe webui is running as 'www-data'
> and ossec dir is owned by 'ossec', and no permission to access dir?
>   
ok. I checked the permissions and the group ossec has permission to read 
and execute the dir and the files (/var/ossec/*) and i added www-data to 
the group ossec in /etc/group but it still doesn't work

ossec:x:number:www-data

any other ideas?

>   
> > thank you very much for any help.
> >
> > greetings
> >
> > sebastian
> >
> >     
>
>