[ossec-list] Re: Can't get OSSEC to fire active response for custom proftpd rule

[Steve West <stevewest15@xxxxxxxxx>]

Daniel Cid wrote:

Hi Steve,

Are the alerts being generated based on your rule?

No. I don't see anything in /var/ossec/logs/alerts/alerts.log regarding my attempts. I have ossec monitoring my proftpd logs /var/log/proftpd/current but maybe my log file format is not compatible w/ ossec. Here is a sample of my proftpd log file entries which should have invoked my custom rule:

@40000000471f54bc2f83d75c localhost (70.108.23.105[70.108.23.105]) - FTP session opened.
@40000000471f54bc352c4ff4 localhost (70.108.23.105[70.108.23.105]) - no such user 'anonymous'
@40000000471f54bc352cc13c localhost (70.108.23.105[70.108.23.105]) - USER anonymous: no such user found from 70.108.23.105 [70.108.23.105] to xxx.xxx.xxx.:21
@40000000471f54be1b68039c localhost (70.108.23.105[70.108.23.105]) - FTP session closed.
@40000000471f54be228d6bbc localhost (70.108.23.105[70.108.23.105]) - FTP session opened.
@40000000471f54be251d9834 localhost (70.108.23.105[70.108.23.105]) - mod_delay/0.5: delaying for 26 usecs
@40000000471f54be29cd1a6c localhost (70.108.23.105[70.108.23.105]) - no such user 'anonymous'
@40000000471f54be29cd782c localhost (70.108.23.105[70.108.23.105]) - USER anonymous: no such user found from 70.108.23.105 [70.108.23.105] to xxx.xxx.xxx.:21
@40000000471f54be29ce4f04 localhost (70.108.23.105[70.108.23.105]) - mod_delay/0.5: delaying for 46 usecs
@40000000471f54c62ad67034 localhost (70.108.23.105[70.108.23.105]) - FTP session closed.

Could it be that my multilog file format is responsible?

thx,

SW

Youneed to make sure that the srcip is present
in the alert (meaning that it was decoded properly), otherwise the
active response is not
going to fire.

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net

On 10/24/07, Steve West <stevewest15@xxxxxxxxx> wrote:
  

Michael Starks wrote:
    

Try 21 or 22 invalid logins in 60 seconds.

-Mike

      

Hi Mike,

Thanks for the suggestion! I try over 25 invalid logins and still ossec
active response doesn't fire. Not really sure why but I think it might
be related to my rule or the underlaying proftpd group rule 11200.

SW