Re: [ossec-list] Help with rule for qmail and cmd5checkpw

2013-04-17 Thread Nick
The check's in the mail Dan! No seriously, thanks very much for your help. -Nick On Wednesday, April 17, 2013 8:59:35 AM UTC-6, dan (ddpbsd) wrote: > > I should start charging for the basic stuff. > > On Wed, Apr 17, 2013 at 10:37 AM, Nick > > wrote: > > Guys/Dan, > > > > I have this custom

Re: [ossec-list] Help with rule for qmail and cmd5checkpw

2013-04-17 Thread dan (ddp)
I should start charging for the basic stuff. On Wed, Apr 17, 2013 at 10:37 AM, Nick wrote: > Guys/Dan, > > I have this custom encoder & rules running for cmd5checkpw and it seems to > be working well. > > Of course, now I have another brute force attack going on that OSSEC doesn't > seem to be ca

Re: [ossec-list] Help with rule for qmail and cmd5checkpw

2013-04-17 Thread Nick
Guys/Dan, I have this custom encoder & rules running for cmd5checkpw and it seems to be working well. Of course, now I have another brute force attack going on that OSSEC doesn't seem to be catching: Apr 17 07:00:33 clients15 smtp_auth: FAILED: rob...@redacted.com - password incorrect from 62

Re: [ossec-list] Help with rule for qmail and cmd5checkpw

2013-04-08 Thread dan (ddp)
On Mon, Apr 8, 2013 at 1:47 PM, Nick wrote: > Guys, > > I am running OSSEC on a few CentOS 5 servers running Plesk and Qmail. It > appears that OSSEC doesn't catch an SMTP brute force authentication attempt. > > Here's an example from our logs: > > Apr 8 09:01:02 admin cmd5checkpw: SMTP connect f

[ossec-list] Help with rule for qmail and cmd5checkpw

2013-04-08 Thread Nick
Guys, I am running OSSEC on a few CentOS 5 servers running Plesk and Qmail. It appears that OSSEC doesn't catch an SMTP brute force authentication attempt. Here's an example from our logs: Apr 8 09:01:02 admin cmd5checkpw: SMTP connect from host-91-143-69-232.2i3.net [91.143.69.232] Apr 8 09