RootCheck disableing

[eyal gershon]

Hey,

I tried to disabled the rootcheck on one of the servers.

I have added the following line to the agent.conf file - 

<rootcheck>

    <disabled>yes</disabled>

</rootcheck>

and after I am restarting the service I get the following output - 

Starting ossec-hids: 2016/04/14 06:16:27 ossec-rootcheck: Rootcheck disabled. Exiting.

ossec-syscheckd: WARN: Rootcheck module disabled.

and a few min later I see in the logs that the rootcheck is running again.

any one have an idea why did I miss?

[dan (ddp)]

Which log messages are you seeing specifically?

> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[eyal gershon]

2016/04/14 06:03:17 ossec-rootcheck: INFO: Started (pid: 30101).

2016/04/14 06:06:05 ossec-rootcheck: INFO: Starting rootcheck scan.

2016/04/14 06:06:05 ossec-rootcheck: No rootcheck_files file configured.

2016/04/14 06:06:05 ossec-rootcheck: No rootcheck_trojans file configured.

2016/04/14 06:17:38 ossec-rootcheck: INFO: Ending rootcheck scan.

The start of the scan is right after the restart of the ossed-hids restart from the original post

[Pedro S]

I have reproduced your configuration on my labs, rootcheck is not starting again. Could you re-verify that agent.conf file is right on your agent?

[joe.co...@wazuh.com]

Also try using verify-agent-conf. It might help with trouble shooting.

http://ossec-docs.readthedocs.org/en/latest/programs/verify-agent-conf.html

[eyal gershon]

I ran the verify agent tool,

It did not return any errors

[eyal gershon]

I checked again the logs - 

2016/04/16 18:37:27 ossec-rootcheck: INFO: Starting rootcheck scan.

2016/04/16 18:37:27 ossec-rootcheck: No rootcheck_files file configured.

2016/04/16 18:37:27 ossec-rootcheck: No rootcheck_trojans file configured.

2016/04/16 18:45:52 ossec-rootcheck: INFO: Ending rootcheck scan.

The log says the check did run,

Is there another configuration file I might be missing?

[joe.co...@wazuh.com]

Interesting... that should be the only config that you need to update in order to disable the root check. I tried it in my lab and disabled it properly as well. 

[Santiago Bassett]

Hi Eyal,

try setting syscheck.debug=2 in internal_options.conf file. It looks like there are some rootchecks that still run, unless you set those to no, like check_pids, check_dev, check_ports,... see more info at:

[Santiago Bassett]

was meaning to paste this link before sending last email: 

http://ossec-docs.readthedocs.org/en/latest/manual/rootcheck/manual-rootcheck.html

[eyal gershon]

Thanks for all the Help,

I managed to disable the rootcheck manually.

It appeared that I had a problem with publishing the document and the permissions of the file.