hi, Sure ossec could block this ip, but you'd need to write you own decoder in decoders.xml to grab the srcip. The following should do, if you want to extract the user name you'd have to play with the regex a little. And probably you need a higher level rule to generate an active response.
<decoder name="perdition"> <program_name>^perdition</program_name> </decoder> <decoder name="perdition-auth"> <use_own_name>true</use_own_name> <parent>perdition</parent> <prematch>^Auth: </prematch> <regex offset="after_prematch">^(\d+.\d+.\d+.\d+)</regex> <order>srcip</order> </decoder> regards. mjp On May 11, 7:15 am, "[email protected]" <[email protected]> wrote: > Hi All, > > I'm looking at implementing OSSEC on our pop server to stop some > recent exploits. How do you block an IP when the mail logs don't show > you the source IP. > > ** Alert 1242018464.1287777: - > syslog,access_control,authentication_failed, > 2009 May 11 15:07:44 pop1->/var/log/maillog > Rule: 2501 (level 5) -> 'User authentication failure.' > Src IP: (none) > User: (none) > May 11 15:07:43 pop1 perdition[29955]: Auth: 216.250.166.73->203.10.110.88 > user="thomasmoore" server="mx1.netspace.net.au" > > port="110" status="failed: Re-Authentication Failure" > > In this example there is no source IP. The IP I want to block is > 216.250.166.73 - so can Ossec help block this IP??? > > Thanks. > > Andy
