OSSEC HIDS apt-get update doesn't work (ossec-hids-agent_2.8.2-1wheezy_amd64.deb)

Submitted by Nikolaus Polak on Mon, 07/13/2015 - 16:18

Seems that the OSSEC HIDS packages (for Debian/Ubuntu at least) have somewhere an error in updating the Linux user rights. I had the error only in German and instead of trying to translate it 100% I cut most of the German words simply away:

Starting upgrade from ossec-hids-agent 2.8.1-1wheezy (to .../ossec-hids-agent_2.8.2-1wheezy_amd64.deb) ...
Replacement for ossec-hids-agent unpacking ...
Removing user »ossec« ...
Warning: The group »ossec« has no members anymore.
userdel: Group ossec is the primary group of another user and will not be removed.
/usr/sbin/delgroup: »ossecm« still has »ossec« as primary group!
dpkg: Warning: Subprozess old post-removal-script returned error code 7
dpkg: Error ... /var/cache/apt/archives/ossec-hids-agent_2.8.2-1wheezy_amd64.deb (--unpack):
E: Sub-process /usr/bin/dpkg returned an error code (1)

How to fix? My solution is perhaps not the best, but working: I've removed manually the OSSEC-generated users, added a new one (which gets removed during the update then):

# userdel ossecm
# userdel ossecr
# useradd ossec -g ossec

After these 3 lines retry the upgrade, should work :)