Hi Daniel, Hello group
Thank you for new vsftp, i'll try it.
But first a little mismatch in sendmail_rules.
I found it as I search why sendmal (smf-sav) not properly works:
<!-- Rules for SMF-SAV -->
<rule id="3190" level="0">
<decoded_as>smf-sav-reject</decoded_as>
<description>Grouping of the smf-sav sendmail milter rules.</
description>
<group>smf-sav,</group>
</rule>
<rule id="3191" level="6">
<if_sid>3190</if_sid>
<match>^sender check failed|^sender check tmpfailed</match>
^
^^^^^^^^^^^^
<description>SMF-SAV sendmail milter unable to verify </
description>
<description>address (REJECTED).</description>
<group>smf-sav,spam,</group>
</rule>
they loss the "e" in tempfailed.
First new log samples:
-------------------------------
Jul 13 04:27:18 www smf-sav[1883]: sender check failed: <[EMAIL PROTECTED]
>, 88.205.140.33, ip-88-205-140-33.dsl.surnet.ru, [00:00:11]
Jul 13 05:06:29 www smf-sav[1883]: sender check tempfailed: <[EMAIL
PROTECTED]
>, 92.101.131.52, shpd-92-101-131-52.vologda.ru, [00:00:01]
Jul 6 10:11:57 www smf-sav[1883]: sender check failed (cached): <[EMAIL
PROTECTED]
>, 91.146.176.140, pool176-140.cable.tolna.net
Jul 13 08:03:04 www smf-sav[1883]: sender check tempfailed (cached):
<[EMAIL PROTECTED]>, 87.103.236.97, [87.103.236.97]
i added/changed in the decoder.xml:
-------------------------------------
<decoder name="smf-sav-reject">
<program_name>^smf-sav</program_name>
<prematch>sender check failed: \S+, </prematch>
<regex offset="after_prematch">^(\d+.\d+.\d+.\d+),</regex>
<order>srcip</order>
</decoder>
<decoder name="smf-sav-reject">
<program_name>^smf-sav</program_name>
<prematch>sender check failed \(cached\): \S+, </prematch>
<regex offset="after_prematch">^(\d+.\d+.\d+.\d+),</regex>
<order>srcip</order>
</decoder>
<decoder name="smf-sav-reject">
<program_name>^smf-sav</program_name>
<prematch>sender check tempfailed: \S+, </prematch>
<regex offset="after_prematch">^(\d+.\d+.\d+.\d+),</regex>
<order>srcip</order>
</decoder>
<decoder name="smf-sav-reject">
<program_name>^smf-sav</program_name>
<prematch>sender check tempfailed \(cached\): \S+, </prematch>
<regex offset="after_prematch">^(\d+.\d+.\d+.\d+),</regex>
<order>srcip</order>
</decoder>
Samples from logtest with the logfile-samples from above:
-------------------------------------------------------------------------------
1.) **Phase 3: Completed filtering (rules).
Rule id: '3191'
Level: '6'
Description: 'SMF-SAV sendmail milter unable to verify address
(REJECTED).'
2.) **Phase 3: Completed filtering (rules).
Rule id: '3190'
Level: '0'
Description: 'Grouping of the smf-sav sendmail milter rules.'
3.) **Phase 3: Completed filtering (rules).
Rule id: '3191'
Level: '6'
Description: 'SMF-SAV sendmail milter unable to verify address
(REJECTED).'
**Alert to be generated.
4.) **Phase 3: Completed filtering (rules).
Rule id: '3190'
Level: '0'
Description: 'Grouping of the smf-sav sendmail milter rules.'
thats what i've made - it works (more or less) for me!!
why Rule 3190 and next run 3191?
didn't found out!!
cheers
Jochen
(Joachim Vorrath)
Am 16.07.2008 um 17:51 schrieb Daniel Cid:
>
> Hi Joachim,
>
> For the proftpd and vsftpd, I made a few changes to support them
> properly (with
> your old format). Try this version (just choose to update) and it
> should work:
>
> http://www.ossec.net/files/snapshots/ossec-hids-080716.tar.gz
>
>
> Thanks,
>
> --
> Daniel B. Cid
> dcid ( at ) ossec.net
>
>
______________________________________
XamimeLT - installed on mailserver for domain at vorrath-net.de
Queries to: postmaster at vorrath-net.de
