PREIN

/bin/sh

/usr/share/rpm-helper/add-user ossec-hids $1 ossecm /var/lib/ossec /sbin/nologin 
/usr/share/rpm-helper/add-user ossec-hids $1 ossece /var/lib/ossec /sbin/nologin 
/usr/share/rpm-helper/add-user ossec-hids $1 ossecr /var/lib/ossec /sbin/nologin

PREUN

/bin/sh

if [ $1 = 0 ]; then
  /usr/share/rpm-helper/del-service ossec-hids $1 ossec-hids 

  rm -f /var/lib/ossec/etc/localtime
  rm -f /var/lib/ossec/etc/ossec.conf
  rm -f /var/lib/ossec/bin/ossec-control
fi

POSTIN

/bin/sh

echo "TYPE=\"server\"" >> /etc/ossec-init.conf

if [ ! -f /var/lib/ossec/etc/ossec.conf ]; then
  ln -sf ossec-server.conf /var/lib/ossec/etc/ossec.conf
fi

ln -sf ossec-server.sh /var/lib/ossec/bin/ossec-control

touch /var/lib/ossec/logs/ossec.log
chown ossec:ossec /var/lib/ossec/logs/ossec.log
chmod 0664 /var/lib/ossec/logs/ossec.log

/usr/share/rpm-helper/add-service ossec-hids $1 ossec-hids