[ossec-list] Permissions and ownership of /etc/hosts.deny

["Drew Myers" <drew.myers@xxxxxxxxxxxxxxxxx>]

Hi,

I'm new to OSSEC.

I recently received an email indicating some sort of a rootkit attempt
on one of my servers, due to improper permissions on /etc/hosts.deny.
Here's the applicable portion of the message:

> Rule: 14 fired (level 8) -> "Rootkit detection engine message"
Portion of the log(s):

>File '/etc/hosts.deny' is owned by root and has written permissions to
anyone.

When I checked, the file was owned by root:ossec, with permissions of
0666.  After much investigation and comparison with other systems in my
environment, I can find no indication of anything amiss.  My key
binaries all appear to be untouched (checksums, permissions, sizes all
match), so it appears the only real "change" is the ownership and
permissions of /etc/hosts.deny itself.

I would expect the permissions for this file should be 0644 and
root.root.  Am I wrong?

Is this a known issue, or have I screwed up my configuration somehow? Do
I need to correct a script and submit a patch?

Thanks,

Drew