[Ossec-list] vsftpd rule

[daniel.cid at gmail.com (Daniel Cid)]

Hi Joachim,

We don't have any rules for vsftpd.  If you want, you can write them
yourself or provide some logs to us, so we can do it.

If you want to do yourself, just look at ./etc/rules/proftpd_rules.xml or
pureftpd_rules.xml. They can give you some examples on how to
do it. Also, look at ./etc/decoders.xml for some examples on how
to extract the srcip and usernames from the logs.

You can also forward some log samples to us so we can write it...

Thanks!

--
Daniel B. Cid
dcid @ ( at ) ossec.net



On 5/30/06, Joachim Vorrath <joachim.vorrath at vorrath-net.de> wrote:
> Hello iist,
>
> has everybody a rule for vsftpd?
> or where can i became help to create a rule?
>
> regards
>
> Jochen
>
>
> ______________________________________
> XamimeLT - installed on mailserver for domain @vorrath-net.de
> Queries to: postmaster at vorrath-net.de
> _______________________________________________
> ossec-list mailing list
> ossec-list at ossec.net
> http://mailman.underlinux.com.br/mailman/listinfo/ossec-list
>