Default ossec.conf has two <ossec_config> root elements

[xlammertink]

Wazuh version	Install type	Action performed	Platform
4.14	Manager	Install	Ubuntu 26.04

Using Ansible I'm trying to automate the installation of Ansible. One of the configuration changes I wanted to make was about TLS certificates in agent registration. During this configuration change I noticed that the default /var/ossec/ossec.conf file contains two root elements (<ossec_config>).

The fact that two root elements are used, makes that the configuration does not follow XML specification and makes the XML invalid. As a result it's not possible to use regular XML parsers to read and alter the configuration. In my case I'm unable to use XML modules in my Ansible code to automate the installation and configuration of Wazuh.

I noticed that issue #17 was raised previously, which raises the same concern. This issue was closed with the comment that OSSEC is capable of handling two root elements. However, I think it was not taken into account that this breaks XML parsing.

My proposal is to merge the two <ossec_config> elements into one element.

Simplified version of default ossec.conf file:

<!--
  Wazuh - Manager - Default configuration for ubuntu 26.04
  More info at: https://documentation.wazuh.com
  Mailing list: https://groups.google.com/forum/#!forum/wazuh
-->

<ossec_config>
  <!-- Generic configuration -->
</ossec_config>

<ossec_config>
  <!-- Local file configurations -->
</ossec_config>

Installation of ossec.conf:

wazuh-packages/debs/SPECS/wazuh-manager/debian/postinst

Lines 38 to 39 in 5f5d9f5

	${SCRIPTS_DIR}/gen_ossec.sh conf manager ${OS} ${VER} ${DIR} > ${DIR}/etc/ossec.conf
	${SCRIPTS_DIR}/add_localfiles.sh ${DIR} >> ${DIR}/etc/ossec.conf