OSSEC 1.5.1 doesn't seem to recognize repeated login attempts.
Vsftpd_rules.xml recognizes the "CONNECT: Client" entry but the ensuing
"FTP command: Client .... USER" entries get a pass. Given that there
could be just a single "CONNECT: Client" entry but several thousand of
the "FTP command: Client" entries which represent a clear attack, I need
some way to activate active-response in this situation. I've tried the
following in the server's local_rules.xml with no luck. Any help would
be much appreciated.
<rule id="100008" level="3">
<if_sid>11400</if_sid>
<match>FTP command: Client</match>
<group>connection attempt</group>
<description>FTP session open attempt.</description>
</rule>
<rule id="100009" level="10" frequency="10" timeframe="60">
<if_matched_sid>100008</if_matched_sid>
<same_source_ip />
<description>Multiple FTP connection attempts from </description>
<description>same source IP.</description>
<group>recon,</group>
</rule>
Thu Sep 4 18:59:51 2008 [pid 8465] CONNECT: Client "222.73.247.58"
Thu Sep 4 18:59:51 2008 [pid 8465] FTP response: Client
"222.73.247.58", "220 WARNING: FOR AUTHORIZED USE ONLY"
Thu Sep 4 18:59:51 2008 [pid 8465] FTP command: Client "222.73.247.58",
"USER root"
Thu Sep 4 18:59:51 2008 [pid 8465] [root] FTP response: Client
"222.73.247.58", "530 This FTP server is anonymous only."
Thu Sep 4 18:59:51 2008 [pid 8465] FTP command: Client "222.73.247.58",
"USER root"
Thu Sep 4 18:59:51 2008 [pid 8465] [root] FTP response: Client
"222.73.247.58", "530 This FTP server is anonymous only."
Thu Sep 4 18:59:51 2008 [pid 8465] FTP command: Client "222.73.247.58",
"USER root"
Thu Sep 4 18:59:51 2008 [pid 8465] [root] FTP response: Client
"222.73.247.58", "530 This FTP server is anonymous only."
Thu Sep 4 18:59:52 2008 [pid 8465] FTP command: Client "222.73.247.58",
"USER root"
Thu Sep 4 18:59:52 2008 [pid 8465] [root] FTP response: Client
"222.73.247.58", "530 This FTP server is anonymous only."
Thu Sep 4 18:59:52 2008 [pid 8465] FTP command: Client "222.73.247.58",
"USER root"
Thu Sep 4 18:59:52 2008 [pid 8465] [root] FTP response: Client
"222.73.247.58", "530 This FTP server is anonymous only."
Thu Sep 4 18:59:52 2008 [pid 8465] FTP command: Client "222.73.247.58",
"USER root"
Thu Sep 4 18:59:52 2008 [pid 8465] [root] FTP response: Client
"222.73.247.58", "530 This FTP server is anonymous only."
Thanks,
Doug
