Hi Daniel, first of all: thanks a lot for the wiki-link and your efforts. :-) OSSEC works very fine in my differential environment. Only the FTP-handling gives me a lot of trouble.
proftpd-Logging on my site: =========================== Jul 11 08:18:54 myserver proftpd[27260] myserver.a-home.de (192.168.7.2[192.168.7.2]): FTP session opened. Jul 11 08:18:54 myserver proftpd[27260] myserver.a-home.de (192.168.7.2[192.168.7.2]): mod_delay/0.5: delaying for 126 usecs Jul 11 08:18:58 myserver proftpd[27260] myserver.a-home.de (192.168.7.2[192.168.7.2]): USER peter: Login successful. Jul 11 08:18:58 myserver proftpd[27260] myserver.a-home.de (192.168.7.2[192.168.7.2]): Preparing to chroot to directory '/home/peter' vsftpd-Logging on my site: ========================== Jul 9 12:24:14 newserver vsftpd: Wed Jul 9 12:24:14 2008 [pid 30082] CONNECT: Client "192.168.7.2" Jul 9 12:24:14 newserver vsftpd: Wed Jul 9 12:24:14 2008 [pid 30082] FTP response: Client "192.168.7.2", "220 (vsFTPd 2.0.4)" Jul 9 12:24:14 newserver vsftpd: Wed Jul 9 12:24:14 2008 [pid 30082] FTP command: Client "192.168.7.2", "USER ann" Jul 9 12:24:14 newserver vsftpd: Wed Jul 9 12:24:14 2008 [pid 30082] [ann] FTP response: Client "192.168.7.2", "331 Pleas e specify the password." Jul 9 12:24:17 newserver vsftpd: Wed Jul 9 12:24:17 2008 [pid 30082] [ann] FTP command: Client "192.168.7.2", "PASS <pass word>" Jul 9 12:24:17 newserver vsftpd: Wed Jul 9 12:24:17 2008 [pid 30081] [ann] FAIL LOGIN: Client "192.168.7.2" Jul 9 12:24:17 newserver vsftpd: Wed Jul 9 12:24:17 2008 [pid 30082] [ann] FTP response: Client "192.168.7.2", "530 Login incorrect." Comparing Logging on my site and the log-samples in your wiki: ============================================================== *** proftpd I doesn't find any hints for my problem. :-( But when i adding a ":" after the PID [27260]: and send a echo with a self-modifed proftpd Logging-line: OSSEC recognizes it in the alert.log *** vsftpd Sorry, but I doesn't find any hints for my problem too. What can I do? I have tried this on both linux-distributions SLES (SuSE) and Debian with the same result. Than i have installed pure-ftp and OSSEC works right from the start hand in hand with pure-ftp. A stupid question: Maybe are there invisible control characters (tabs) in the Logging-lines? Has everyone else the same problems? Greetings Joachim Daniel Cid schrieb: > Hi Joachim, > > Can you share the logs that were created by vsftpd and proftpd on your > tests? We support these > two formats very well and it works on my setup. Maybe you have a > difference version or format? > > This is how we expect them: > http://www.ossec.net/wiki/index.php/ProFTPD > http://www.ossec.net/wiki/index.php/Vsftpd > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > > > On Thu, Jul 10, 2008 at 3:13 AM, Joachim Krais > <[EMAIL PROTECTED]> wrote: >> Hello group, hello Daniel, >> >> we use these ftp-Daemons: >> * vsftp (problem with OSSEC) >> * proftp (problem with OSSEC) >> * pure-ftp (works fine with OSSEC) >> >> The distributions are SLES9SP4 and Debian. >> >> Ossec 1.5.1 was installed with local-settings, active-response, >> firewall-functions. We establish connections to these servers in >> the following ways: >> * correctly (user and password exists) >> * uncorrectly - simulates an attack: (user or password doesn't exist) >> >> We set up a tail -f to /var/ossec/log/alerts/alerts.log. >> >> SSH-Logins for example are correctly identified by OSSEC, but OSSEC >> doesn't unfortunately show us ftp-attacks (vsftp and proftp) in the >> alert.log >> >> Messages from pure-ftp are already correctly found by OSSEC. :-) >> >> Where is the problem? >> >> Greetings >> >> Joachim >> >> >>
