Failure to create ossec user and group on Snow Leopard

[Harold Rodriguez]

Hi,

I've found a minor issue when installing OSSEC on Mac OS X 10.6 Snow
Leopard. Not sure if this has already been reported, apologies if it
has.

When running install.sh I've noticed that InstallAgent.sh and
InstallServer.sh fail to call the os105-addusers.sh which is required
to add users/groups needed by OSSEC. The reason for the failure is
that it's grepping for "10.5" when it runs /usr/bin/sw_vers.

# Creating for 10.5
/usr/bin/sw_vers 2>/dev/null| grep "ProductVersion" | grep
"10.5." > /dev/null 2>&1
if [ $? = 0 ]; then
chmod +x ./init/osx105-addusers.sh
./init/osx105-addusers.sh
else
chmod +x ./init/darwin-addusers.pl
./init/darwin-addusers.pl
fi

On Snow Leopard this fails since sw_vers returns "10.6" so it calls
darwin-addusers.pl. The darwin-addusers.pl calls niload and nireport
which don't exist on OS 10.5 and 10.6. It may be better to just check
for the existence of dscl or niload rather than calling sw_vers:

/usr/bin/which niload > /dev/null 2>&1
if [[ $? -eq 1 ]]; then
# does not exist, assume 10.5 or greater
chmod +x ./init/osx105-addusers.sh
./init/osx105-addusers.sh
else
chmod +x ./init/darwin-addusers.pl
./init/darwin-addusers.pl
fi


Cheers,
Harold

[Daniel Cid]

Hi Harold,

Thanks for the report. It has been fixed on the latest snapshot. I
just used grep -E looking
for both versions instead (grep -E "10.5.|10.6").

http://www.ossec.net/files/snapshots/ossec-hids-090918.tar.gz

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net