On Tue, May 26, 2015 at 1:14 PM, Abdul Baqui <mabaqu...@gmail.com> wrote: > After installing OSSEC, and keeping default ossec.conf and all rules, what > changes do I need to make so that OSSEC sends mail for multiple > authentication failures, successful login after multiple authentication > failures? I want OSSEC to send mail alerts when a user fails to login 4 > times, and then logs in correctly the 5th time. What do I need modify? > I've tried debugging, the failures log, but mail is not sent. So, I want to > start from scratch. >
I think there's an example of these types of rules in the sshd_rules.xml file. > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
