ossec-wui

ossec-wui copied to clipboard

The OSSEC Web UI is currently unmaintained and deprecated. If you are interested in maintaining the project, please contact the OSSEC team (open an issue, send a message to the mailing list, etc).

We recommend using Kibana, Splunk, or similar projects for monitoring alerts.

OSSEC Web UI v0.8 Copyright (c) 2006-2013 Trend Micro Inc.

1- How to install.

1.0 - Prerequisites

- Apache with PHP (>= 4.1 or >= 5.0) installed.
- OSSEC (version >= 0.9-3) already installed.

1.1- Clone the web ui script:

# git clone https://github.com/ossec/ossec-wui.git

1.2- Move the folder to somewhere acessible by your web server:

# mv ossec-wui* /var/www/htdocs/ossec-wui

1.3- Run the setup script (assign username/password...):

# cd /var/www/htdocs/ossec-wui
# ./setup.sh
...

1.4- If selinux is enabled, ossec-wui is normally unable to access various ossec log files. One way to fix this is to install a selinux targeted policy.

 Create a TE file (eg. 
 /etc/seliinux/targeted/ossec-wui/ossec-wui.te) with the following 
 content:

module ossec-wui 1.0;

require {
type var_log_t;
    type httpd_t;
    type var_t;
    class file { read getattr open };
}

#============= httpd_t ==============
allow httpd_t var_log_t:file read;
allow httpd_t var_t:file { read getattr open };

 Then run the following commands as root:

checkmodule -M -m ossec-wui.te -o ossec-wui.mod
semodule_package -o ossec-wui.pp -m ossec-wui.mod
semodule -i ossec-wui.pp 

1.5- If you have a large ossec install, you may want to re-configure PHP to support longer lasting scripts and higher memory utilization. The following entries on php.ini can be increased:

 max_execution_time = 180
 max_input_time = 180
 memory_limit = 30M

1.6- Try to access the UI.

 http://anyhost/ossec-wui/

1.7- Report any problems or suggestions to our mailing list.