Hey,
Make sure active response is enabled in ossec.conf:
<active-response>
<disabled>no</disabled>
</active-response>
Also, what does your <active-response> element look like for
responding to the proftpd rule? Check out the manual for
active-response config examples:
http://www.ossec.net/main/manual/#active-response
Cheers,
cnk
On Tue, Jul 15, 2008 at 2:55 PM, José Carlos Colzani
<[EMAIL PROTECTED]> wrote:
>
> Hi people,
>
> I have ossec 5.1, and i received multiples brute force attack in my
> server, and ossec dont block it.
> In my ossec.conf the rule proftpd is enable.
> Here is my /var/log/proftpd.log file. ( Sorry by my bad english )
>
> -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
> Jul 14 04:44:46 opala proftpd[30812] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): mod_delay/0.5: delaying for
> 14871 usecs
> Jul 14 04:44:46 opala proftpd[30813] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): no such user 'guest'
> Jul 14 04:44:46 opala proftpd[30813] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): USER guest: no such user found
> from sieapp.ufpel.edu.br [200.17.161.73]
> to 192.168.2.5:21
> Jul 14 04:44:46 opala proftpd[30813] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): mod_delay/0.5: delaying for 86
> usecs
> Jul 14 04:44:46 opala proftpd[30815] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): FTP session opened.
> Jul 14 04:44:46 opala proftpd[30814] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): no such user 'guest'
> Jul 14 04:44:46 opala proftpd[30814] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): USER guest: no such user found
> from sieapp.ufpel.edu.br [200.17.161.73]
> to 192.168.2.5:21
> Jul 14 04:44:46 opala proftpd[30813] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): FTP session closed.
> Jul 14 04:44:46 opala proftpd[30812] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): FTP session closed.
> Jul 14 04:44:46 opala proftpd[30815] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): mod_delay/0.5: delaying for 33
> usecs
> Jul 14 04:44:46 opala proftpd[30814] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): FTP session closed.
> Jul 14 04:44:47 opala proftpd[30816] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): FTP session opened.
> Jul 14 04:44:47 opala proftpd[30817] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): FTP session opened.
> Jul 14 04:44:47 opala proftpd[30818] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): FTP session opened.
> Jul 14 04:44:47 opala proftpd[30815] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): no such user 'guest'
> Jul 14 04:44:47 opala proftpd[30815] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): USER guest: no such user found
> from sieapp.ufpel.edu.br [200.17.161.73]
> to 192.168.2.5:21
> Jul 14 04:44:47 opala proftpd[30816] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): mod_delay/0.5: delaying for 21
> usecs
> Jul 14 04:44:47 opala proftpd[30817] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): mod_delay/0.5: delaying for 129
> usecs
> Jul 14 04:44:47 opala proftpd[30818] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): mod_delay/0.5: delaying for 113
> usecs
> Jul 14 04:44:47 opala proftpd[30815] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): FTP session closed.
> Jul 14 04:44:47 opala proftpd[30819] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): FTP session opened.
> Jul 14 04:44:47 opala proftpd[30816] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): no such user 'guest'
> Jul 14 04:44:47 opala proftpd[30816] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): USER guest: no such user found
> from sieapp.ufpel.edu.br [200.17.161.73]
> to 192.168.2.5:21
> Jul 14 04:44:47 opala proftpd[30816] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): mod_delay/0.5: delaying for 129
> usecs
> Jul 14 04:44:47 opala proftpd[30817] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): no such user 'guest'
> Jul 14 04:44:47 opala proftpd[30817] opala.xxxxxx.edu.br
> (sieapp.ufpel.edu.br[200.17.161.73]): USER guest: no such user found
> from sieapp.ufpel.edu.br [200.17.161.73]
> -----------------------------------------------------------------------------------------------------------------------------
>
>
> --
> José Carlos Colzani - Brusque SC
> E-mail - linoxman em gmail com br
> User linux - #241077
>
