[ossec-list] active response not working for frequency and SSH

2013-01-14 Thread Michiel van Es
Hello, We want to firewall-drop failed logins with SSH after 3 failed passwords. We have the following config in /var/ossec/etc/ossec.conf (OSSEC 2.6) for the commands and active responses: command namehost-deny/name executablehost-deny.sh/executable expectsrcip/expect

Re: [ossec-list] active response not working for frequency and SSH

2013-01-14 Thread dan (ddp)
On Mon, Jan 14, 2013 at 8:51 AM, Michiel van Es vanesmich...@gmail.com wrote: Hello, We want to firewall-drop failed logins with SSH after 3 failed passwords. We have the following config in /var/ossec/etc/ossec.conf (OSSEC 2.6) for the commands and active responses: command

Re: [ossec-list] active response not working for frequency and SSH

2013-01-14 Thread Michiel van Es
Op maandag 14 januari 2013 15:36:05 UTC+1 schreef dan (ddpbsd) het volgende: On Mon, Jan 14, 2013 at 8:51 AM, Michiel van Es vanesm...@gmail.comjavascript: wrote: Hello, We want to firewall-drop failed logins with SSH after 3 failed passwords. We have the following config in

Re: [ossec-list] active response not working for frequency and SSH

2013-01-14 Thread dan (ddp)
On Mon, Jan 14, 2013 at 10:23 AM, Michiel van Es vanesmich...@gmail.com wrote: Op maandag 14 januari 2013 15:36:05 UTC+1 schreef dan (ddpbsd) het volgende: On Mon, Jan 14, 2013 at 8:51 AM, Michiel van Es vanesm...@gmail.com wrote: Hello, We want to firewall-drop failed logins with SSH

Re: [ossec-list] active response not working for frequency and SSH

2013-01-14 Thread dan (ddp)
On Mon, Jan 14, 2013 at 10:28 AM, dan (ddp) ddp...@gmail.com wrote: On Mon, Jan 14, 2013 at 10:23 AM, Michiel van Es vanesmich...@gmail.com wrote: Op maandag 14 januari 2013 15:36:05 UTC+1 schreef dan (ddpbsd) het volgende: On Mon, Jan 14, 2013 at 8:51 AM, Michiel van Es