I added a testing decoder/rules for it in the latest snapshot: http://www.ossec.net/files/snapshots/ossec-hids-101125.tar.gz
Diff here: http://bitbucket.org/dcid/ossec-hids/changeset/0db70d4431e2 It should fire alerts like that now: ** Alert 1290703467.17021198: - syslog,access_control, 2010 Nov 25 12:44:27 hostname->/var/log/messages Rule: 2509 (level 5) -> 'OpenLDAP authentication failed.' Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=3 RESULT tag=97 err=49 text= Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 fd=64 ACCEPT from IP=10.10.248.27:33957 (IP=10.10.241.77:389) Basically I extracted the conn=(\d+) and set that as the id, so we can correlate connections. After that, I used if_match_sid to get the ACCEPT events... What we need now is to fix the decoder to extract the IP, user, etc and put it all together. At least a start :) Thanks, -- Daniel B.Cid dcid ( at ) ossec.net On Wed, Nov 24, 2010 at 3:49 PM, dan (ddp) <[email protected]> wrote: > Heh, of course shortly after I sent that I think I found one that > makes more sense. :P > > On Wed, Nov 24, 2010 at 11:17 AM, dan (ddp) <[email protected]> wrote: >> Does anyone have a useful and working guide to setting up ldap for >> user auth? Pretty much everything I've found while trying to get this >> thing running doesn't work. >> >
