Hi Joachim, I fixed those on the following snapshot:
http://www.ossec.net/files/snapshots/ossec-hids-080725.tar.gz Can you try it out and let us know if it is all ok? Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Wed, Jul 16, 2008 at 2:49 PM, Joachim Vorrath <[EMAIL PROTECTED]> wrote: > > Hi Daniel, Hello group > > Thank you for new vsftp, i'll try it. > > But first a little mismatch in sendmail_rules. > I found it as I search why sendmal (smf-sav) not properly works: > > <!-- Rules for SMF-SAV --> > <rule id="3190" level="0"> > <decoded_as>smf-sav-reject</decoded_as> > <description>Grouping of the smf-sav sendmail milter rules.</ > description> > <group>smf-sav,</group> > </rule> > > <rule id="3191" level="6"> > <if_sid>3190</if_sid> > <match>^sender check failed|^sender check tmpfailed</match> > > ^ > ^^^^^^^^^^^^ > <description>SMF-SAV sendmail milter unable to verify </ > description> > <description>address (REJECTED).</description> > <group>smf-sav,spam,</group> > </rule> > > they loss the "e" in tempfailed. > > First new log samples: > ------------------------------- > Jul 13 04:27:18 www smf-sav[1883]: sender check failed: <[EMAIL PROTECTED] > >, 88.205.140.33, ip-88-205-140-33.dsl.surnet.ru, [00:00:11] > Jul 13 05:06:29 www smf-sav[1883]: sender check tempfailed: <[EMAIL > PROTECTED] > >, 92.101.131.52, shpd-92-101-131-52.vologda.ru, [00:00:01] > Jul 6 10:11:57 www smf-sav[1883]: sender check failed (cached): <[EMAIL > PROTECTED] > >, 91.146.176.140, pool176-140.cable.tolna.net > Jul 13 08:03:04 www smf-sav[1883]: sender check tempfailed (cached): > <[EMAIL PROTECTED]>, 87.103.236.97, [87.103.236.97] > > i added/changed in the decoder.xml: > ------------------------------------- > <decoder name="smf-sav-reject"> > <program_name>^smf-sav</program_name> > <prematch>sender check failed: \S+, </prematch> > <regex offset="after_prematch">^(\d+.\d+.\d+.\d+),</regex> > <order>srcip</order> > </decoder> > > <decoder name="smf-sav-reject"> > <program_name>^smf-sav</program_name> > <prematch>sender check failed \(cached\): \S+, </prematch> > <regex offset="after_prematch">^(\d+.\d+.\d+.\d+),</regex> > <order>srcip</order> > </decoder> > > <decoder name="smf-sav-reject"> > <program_name>^smf-sav</program_name> > <prematch>sender check tempfailed: \S+, </prematch> > <regex offset="after_prematch">^(\d+.\d+.\d+.\d+),</regex> > <order>srcip</order> > </decoder> > > <decoder name="smf-sav-reject"> > <program_name>^smf-sav</program_name> > <prematch>sender check tempfailed \(cached\): \S+, </prematch> > <regex offset="after_prematch">^(\d+.\d+.\d+.\d+),</regex> > <order>srcip</order> > </decoder> > > Samples from logtest with the logfile-samples from above: > ------------------------------------------------------------------------------- > > 1.) **Phase 3: Completed filtering (rules). > Rule id: '3191' > Level: '6' > Description: 'SMF-SAV sendmail milter unable to verify address > (REJECTED).' > > 2.) **Phase 3: Completed filtering (rules). > Rule id: '3190' > Level: '0' > Description: 'Grouping of the smf-sav sendmail milter rules.' > > 3.) **Phase 3: Completed filtering (rules). > Rule id: '3191' > Level: '6' > Description: 'SMF-SAV sendmail milter unable to verify address > (REJECTED).' > **Alert to be generated. > > 4.) **Phase 3: Completed filtering (rules). > Rule id: '3190' > Level: '0' > Description: 'Grouping of the smf-sav sendmail milter rules.' > > > thats what i've made - it works (more or less) for me!! > why Rule 3190 and next run 3191? > didn't found out!! > > cheers > > Jochen > (Joachim Vorrath) > > > > > > Am 16.07.2008 um 17:51 schrieb Daniel Cid: > >> >> Hi Joachim, >> >> For the proftpd and vsftpd, I made a few changes to support them >> properly (with >> your old format). Try this version (just choose to update) and it >> should work: >> >> http://www.ossec.net/files/snapshots/ossec-hids-080716.tar.gz >> >> >> Thanks, >> >> -- >> Daniel B. Cid >> dcid ( at ) ossec.net >> >> > > > ______________________________________ > XamimeLT - installed on mailserver for domain at vorrath-net.de > Queries to: postmaster at vorrath-net.de >
