797097 - New OSSEC RPMs and Puppet

Status: RESOLVED WONTFIX

(Cloud Services :: Operations: Miscellaneous, task)

Description

[Michael Henry [:tinfoil]]

I updated OSSEC, and placed the update into our Mozilla repository.

More importantly, we updated the puppet configuration which accounts for differences in the packaging - otherwise ossec will break when upgraded.  Please see ossec puppet module as a template, and change as you need (it should just work):  sysadmins/puppet/trunk/modules/ossec

Let me know if you have any strange behavior or bugs that we may not have fixed yet.   This should not have a conflict with postfix or anything else.

Thanks!

Comment 1

[:Atoll]

(In reply to Michael Henry [:tinfoil] from comment #0)
> Let me know if you have any strange behavior or bugs that we may not have
> fixed yet.   This should not have a conflict with postfix or anything else.

The conflict with postfix in the current weave deployment is because Postfix requires UID 459, but sometimes ossec installs first and gets that UID, because our puppet code is incorrect. This is no fault of ossec, but still requires disabling and removing ossec temporarily to fix.

Comment 2

[Michael Henry [:tinfoil]]

Ossec is dead, long live ossec