[ossec-list] Re: Dont block force brute atack in ftp server

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Jose,

Can you show us a few samples of your proftpd logs? Also, look at the
ossec alerts log
and the active responses log to make sure that it really didn't block
the attack. By
default it will unblock the ip after 10 minutes...

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net

On 7/17/07, José Colzani <linoxman@xxxxxxxxxxxx> wrote:
>
> Hi people, first sorry by my english, i,m brazilian, and speack portuguese.
>
> I have used ossec in all my servers, and today my ftp server was have a brute force atack, and the ossec dont log this atack. Why ?
>
> In my ossec.conf i have the lines include for the proftpd.log and the location tag, appoint for the correct log file /var/log/proftpd.log
>
> Thank You for all.
>
>
>
> José Carlos Colzani - Brusque SC
> E-mail - linoxman em yahoo.com.br linoxman em gmail.com.br
> GNU/Linux - 2.6.20.16 / Kubuntu 7.04
> User linux #241077
>
>
>
>
>
> ____________________________________________________________________________________
> Novo Yahoo! Cadê? - Experimente uma nova busca.
> http://yahoo.com.br/oqueeuganhocomisso
>