On Sun, Feb 5, 2012 at 12:56 PM, lucas kauffman <lucas.kauff...@gmail.com> wrote: > Hello, > > I'm quite new to OSSEC, and there are two things I can't find out: > > How do I increase the frequency of the rule when someone is blocked because > of a 400 error (failed to login through htaccess in Apache2). I looked for > the rule, but it doesn't show a frequency, is there a default frequency ? >
If a rule doesn't mention a frequency only 1 occurrence is enough to trigger it. To add a frequency you would either overwrite the rule (adding a frequency), or if_sid the old rule to a new one with a frequency. > Also if an IP is blocked, how can I unblock it through ossec ? Or do I have > to do it manually and delete the entries for hosts.deny and iptables ? > > Thank you ! > >
