[ossec-list] To block based on user

I've been using OSSEC for a while, but only with the default rules. I've experimented, but just not understanding how to make a custom rule kick in when a loser tries guessing passwords to a non-existent user. Basically, if someone uses dovecot and tries a password for the user root (or admin,

Re: [ossec-list] To block based on user

On Wed, Aug 22, 2012 at 6:18 AM, Michael Clark 6f0e8bfb03a6030e6bc5d69cc24da080.ossec-l...@planetmike.com wrote: I've been using OSSEC for a while, but only with the default rules. I've experimented, but just not understanding how to make a custom rule kick in when a loser tries guessing