Re: [ossec-list] Ubuntu

[Ryan Schulze]

I had a look at the Makeall file, and if the header (dev) files for magic are found, it is compiled with libmagic, if they aren't found it isn't. So by default it does try to compile with libmagic, but if it can't find the required files to do so, it falls back to not using libmagic.

On 7/27/2015 4:47 AM, theresa mic-snare wrote:

Hi James,

i'm now really interested in this...





Am Mittwoch, 22. Juli 2015 17:00:02 UTC+2 schrieb James Edwards:

    I think this is a compiler issue... I checked my RHEL compilation
    and it used gcc-4.4.7, so I downgraded from gcc-4.8 on Ubuntu to
    gcc-4.4 and am able to get this to successfully compile with libmagic.

    On another note, it is worth noting that I was able to
    successfully compile OSSEC from git using gcc-4.8 with libmagic
    support.

    Thanks,
    James

    On Wednesday, July 22, 2015 at 7:43:21 AM UTC-4, dan (ddpbsd) wrote:


        On Jul 20, 2015 3:27 PM, "James Edwards" <x86bs...@gmail.com>
        wrote:
        >
        > Hi All,
        >
        > I'm trying to compile OSSEC on Ubuntu 14.04 with libmagic
        support and I keep running into the following error when
        compiling syscheck (same error running Makeall as well):
        >
        > [root@hostname]/tmp/ossec-hids-2.8.2/src/syscheckd# make

        config.c seechanges.c run_realtime.c create_db.c run_check.c
        ../config/lib_config.a ../rootcheck/rootcheck_lib.a
        ../shared/lib_shared.a ../os_xml/os_xml.a
        ../os_regex/os_regex.a ../os_net/os_net.a
        ../os_crypto/os_crypto.a -o ossec-syscheckd
        > /tmp/cc9nExX5.o: In function `init_magic':
        > /tmp/ossec-hids-2.8.2/src/syscheckd/syscheck.c:43: undefined
        reference to `magic_open'

        Which file provides magic_open?

        > /tmp/ossec-hids-2.8.2/src/syscheckd/syscheck.c:47: undefined
        reference to `magic_error'
        > /tmp/ossec-hids-2.8.2/src/syscheckd/syscheck.c:50: undefined
        reference to `magic_load'
        > /tmp/ossec-hids-2.8.2/src/syscheckd/syscheck.c:52: undefined
        reference to `magic_error'
        > /tmp/ossec-hids-2.8.2/src/syscheckd/syscheck.c:54: undefined
        reference to `magic_close'
        > /tmp/ccLsn7RT.o: In function `is_text':
        > /tmp/ossec-hids-2.8.2/src/syscheckd/seechanges.c:24:
        undefined reference to `magic_buffer'
        > /tmp/ossec-hids-2.8.2/src/syscheckd/seechanges.c:28:
        undefined reference to `magic_error'
        > collect2: error: ld returned 1 exit status
        > make: *** [syscheck] Error 1
        >
        > libmagic-dev 5.14-2ubuntu3.3 is installed and I see the
        following magic.h header files:
        >
        > /usr/include/linux/magic.h
        > /usr/include/magic.h
        >
        > Any advice on how to resolve this?
        >
        > Thanks,
        > James
        >
        > --
        >
        > ---
        > You received this message because you are subscribed to the
        Google Groups "ossec-list" group.
        > To unsubscribe from this group and stop receiving emails
        from it, send an email to ossec-list+...@googlegroups.com.
        > For more options, visit https://groups.google.com/d/optout.

--

---

Would you mind sharing the RHEL binaries with me? I would love to try the OSSEC enabled libmagic version on my CentOS test server. out of curiosity: is there any disadvantage that comes with libmagic? why is it not enabled by default? > cc -g -Wall -I../ -I../headers -DUSEINOTIFY -DUSE_MAGIC -DARGV0=\"ossec-syscheckd\" -DOSSECHIDS -lmagic syscheck.c You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com

<mailto:ossec-list+unsubscr...@googlegroups.com>.
For more options, visit https://groups.google.com/d/optout.

--


To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--- You received this message because you are subscribed to the Google Groups "ossec-list" group.

smime.p7s
Description: S/MIME Cryptographic Signature