OSSECWUI:Install - OSSEC Wiki http://www.ossec.net/wiki/index.

php/OSSECWUI:Install

From OSSEC Wiki

OSSEC Web User Interface (wui) Install

By Daniel B. Cid (http://www.ossec.net/dcid/)

Prerequisites

Apache with PHP (>= 4.1 or >= 5.0) installed. (with posix support) OR Lighttpd (>= 1.x) with PHP-cgi
(php4-cgi or php5-cgi) in FastCGI
OSSEC (version >= 0.9-3) already installed.

Installation steps

To install on Mac OS, follow the instructions here: Web_UI_(Mac_OS_X_10.4.9)

To install using Lighttpd, follow the instructions here: Web_UI_(Lighttpd)

1- Download the web ui package:

$ wget http://www.ossec.net/files/ui/ossec-wui-0.3.tar.gz

2- Verify the checksum and signature of the package, you can find the GPG key at http://www.ossec.net/main/pgp/ :

$ wget http://www.ossec.net/files/ui/ossec-wui-0.3-checksum.txt
$ wget http://www.ossec.net/files/ui/ossec-wui-0.3.tar.gz.sig
$ md5 ossec-wui-0.3.tar.gz
MD5 (ossec-wui-0.3.tar.gz) = c79fa486e9a20fb06a517541033af304
$ sha1 ossec-wui-0.3.tar.gz
SHA1 (ossec-wui-0.3.tar.gz) = e00bff680721982ee55295a5292eb4e2a638b820
$ gpg --verify ossec-wui-0.3.tar.gz.sig ossec-wui-0.3.tar.gz
gpg: Signature made Tue Mar 04 14:27:59 2008 AST using RSA key ID 6B30327E
gpg: Good signature from "Daniel B. Cid (Ossec development) <dcid@ossec.net>"
Primary key fingerprint: 86C6 D33B C52E 19BF DDAE 57EB 4E57 14E2 6B30 327E

3- Decompress/untar and move the files to somewhere accessible by your web server:

$ tar -zxvf ossec-wui-0.3.tar.gz

# mv ossec-wui-0.3 /var/www/htdocs/ossec-wui

4- Run the setup script

# cd /var/www/htdocs/ossec-wui
# ./setup.sh
...

5- Add your web server user (apache, www or nobody) to the ossec group:

1 of 2 12/04/2009 8:34 PM
OSSECWUI:Install - OSSEC Wiki http://www.ossec.net/wiki/index.php/OSSECWUI:Install

# vi /etc/group
..
From:
ossec:x:1002:
To (if your web server user is www):
ossec:x:1002:www

6- Fix the permissions for the tmp directory and restart Apache (for the new permissions to work)

# chmod 770 tmp/

# chgrp www tmp/
# apachectl restart

7- If you have a large ossec install, you may want to re-configure PHP to support longer lasting scripts and higher
memory utilization. The following entries on php.ini can be increased:

max_execution_time = 180
max_input_time = 180
memory_limit = 30M

8- You should now be able to access the UI:

http ://anyhost/ossec-wui/

9- Report any problems or suggestions to our mailing list:

http://www.ossec.net/en/mailing_lists.html

Retrieved from "http://www.ossec.net/wiki/index.php/OSSECWUI:Install"

About OSSEC Wiki

Contact us

2 of 2 12/04/2009 8:34 PM