[Ossec-list] [ossecm@xxxxxxxxxxxxxxxx: OSSEC Hids Notification - Alert level 12]

[kayvan at sylvan.com (Kayvan A. Sylvan)]

How about anchoring the regexp like this?

<var name="SYS_USERS">^(apache|mysql|www|nobody|nogroup|portmap|named|rpc|mail|ftp|shutdown|bin|daemon|postfix|shell|info|guest|psql)$</var>

Best regards,

			---Kayvan

On Mon, May 08, 2006 at 02:53:45PM -0300, Daniel Cid wrote:
> Hi Kayvan,
> 
> This is a terrible behavior. If you can go to your
> /var/ossec/rules/attack_rules.xml
> and remove the user "bin" from the SYS_USERS variable, it should fix
> the problem.