Hello!
I still use ossec 1.4. My rules are not changed from defaults. I had
noticed, that some attacks are NOT detected. I don't understand why.
Here are example string from syslog:
Sep 2 04:56:39 hp dovecot-auth: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=dovecot ruser= rhost=190.166.205.160
There are a lot of such strings. If ssh is attacked, the rule is
triggered and ip address is being blocked. If dovecot is attacked -
nothing happened. But ruleset includes this:
<rule id="5551" level="10" frequency="6" timeframe="180">
<if_matched_sid>5503</if_matched_sid>
<same_source_ip />
<description>Multiple failed logins in a small period of
time.</description>
<group>authentication_failures,</group>
</rule>
This rule is in pam group and MUST be triggered... level is 10, so
active response must be activeted. But it does not. Why?
--
With respect
Serg.
