Ubuntu 14.10 black screen after installing ossec-wui

[Pedro Pereira]

Well, it's as good as it sounds...after installing apache2 libapache2-mod-php5 and apache2-utils, e rebooted and now i dont have GUI, only command line.
Any thoughts?

[Pedro Pereira]

EDIT: Problem not in apache. It's when i move the ossec-wui folder into /var/www/html...i think...

[Pedro Pereira]

Problem is in the ossec-wui...i have 3 new users and i just cannot login...i input the password and it returns to the logon screen. Any solutions?

[dan (ddp)]

On Wed, Apr 29, 2015 at 5:42 AM, Pedro Pereira <perei...@gmail.com> wrote:
> Problem is in the ossec-wui...i have 3 new users and i just cannot login...i
> input the password and it returns to the logon screen. Any solutions?
>

Are you talking about a gdm login screen? Did you select the correct user?
Can you ssh into the system?
I don't think the wui should affect system login.

> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Pedro Pereira]

Yup, it did mess up the user accounts... i commented the htpasswd section of the script but it still created 3 new accounts, dunno why. The workaround the logon loop is to restore the /tmp permissions ownership, you where right. Somehow, the ossec-wui script changes the permissions in the /tmp/ folder of ubuntu, not the /var/ossec/tmp permission or even the /var/www/ossec-wui/tmp. I thinks there's a bug in the script, permission changing wise. I followed this :http://ubuntuforums.org/showthread.php?t=2050685

For now, it seems to work. But i still cannot comprehend why did it create the accounts ossec, ossecr and ossecm...Can you guys check out the script and give me a hand?

Thanks for the advice!

You received this message because you are subscribed to a topic in the Google Groups "ossec-list" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/ossec-list/tCMIqTz2QEs/unsubscribe.
To unsubscribe from this group and all its topics, send an email to ossec-list+...@googlegroups.com.

[Antonio Querubin]

On Wed, 29 Apr 2015, Pedro Pereira wrote:

> Yup, it did mess up the user accounts... i commented the htpasswd section
> of the script but it still created 3 new accounts, dunno why. The
> workaround the logon loop is to restore the /tmp permissions ownership, you
> where right. Somehow, the ossec-wui script changes the permissions in the
> /tmp/ folder of ubuntu, not the /var/ossec/tmp permission or even the
> /var/www/ossec-wui/tmp. I thinks there's a bug in the script, permission
> changing wise. I followed this :
> http://ubuntuforums.org/showthread.php?t=2050685
> For now, it seems to work. But i still cannot comprehend why did it create
> the accounts ossec, ossecr and ossecm...Can you guys check out the script
> and give me a hand?

The ossec-hids install.sh adds those users. That's normal.

The problem is with the ossec-wui setup.sh clobbering the /tmp
permissions. It needs some fixing...

Antonio Querubin
e-mail: to...@lavanauts.org
xmpp: antonio...@gmail.com

[dan (ddp)]

On Wed, Apr 29, 2015 at 8:45 AM, Pedro Pereira <perei...@gmail.com> wrote:
> Yup, it did mess up the user accounts... i commented the htpasswd section of
> the script but it still created 3 new accounts, dunno why. The workaround
> the logon loop is to restore the /tmp permissions ownership, you where
> right. Somehow, the ossec-wui script changes the permissions in the /tmp/
> folder of ubuntu, not the /var/ossec/tmp permission or even the
> /var/www/ossec-wui/tmp. I thinks there's a bug in the script, permission
> changing wise. I followed this
> :http://ubuntuforums.org/showthread.php?t=2050685

Where did you run setup.sh from? The script doesn't seem too
complicated, or robust. So if you ran it from the wrong location, it
could probably cause some issues. Running it as root also seems silly,
but I'm sure it's documented that way. (I also see some non-portable
options being used, but that wouldn't affect ubuntu)

> For now, it seems to work. But i still cannot comprehend why did it create
> the accounts ossec, ossecr and ossecm...Can you guys check out the script
> and give me a hand?

Those are ossec accounts, and have very little to do with the wui.

[Pedro Pereira]

I ran the script frowm the /var/www/ossec-wui location with su (sudo su).

I input the options:
username: ubuntu (same as computer)
pass:1234
retype pass:1234
webserver: apache
directory: pressed enter (it was the default /var/ossec)

And thats pretty much it!! After that i needed to fix the /tmp permissions in order to login.
Any thoughts?Oh, by the way, i commented the part of the code referring to htpasswd. Is there any problem if that part is skipped?It seems to work normal enough though...

[Antonio Querubin]

On Thu, 30 Apr 2015, Pedro Pereira wrote:

> webserver: apache
> directory: pressed enter (it was the default /var/ossec)

It's not really the default - it's just an example. And of course
many people (including me) miss that distinction and just press enter.
And /tmp is clobbered.

[Pedro Pereira]

Thank you!I will try that method, inputing the ossec directory manually!
Thanks again for all the help provided!!You guys have been the most helpfull!