X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;ds=sidebyside;f=debian%2Fossec-hids%2Fvar%2Fossec%2Frules%2Fpostfix_rules.xml;fp=debian%2Fossec-hids%2Fvar%2Fossec%2Frules%2Fpostfix_rules.xml;h=44f9e13b1def63e80bd474c23688149ecb416aa4;hb=3f728675941dc69d4e544d3a880a56240a6e394a;hp=0000000000000000000000000000000000000000;hpb=927951d1c1ad45ba9e7325f07d996154a91c911b;p=ossec-hids.git
diff --git a/debian/ossec-hids/var/ossec/rules/postfix_rules.xml b/debian/ossec-hids/var/ossec/rules/postfix_rules.xml
new file mode 100644
index 0000000..44f9e13
--- /dev/null
+++ b/debian/ossec-hids/var/ossec/rules/postfix_rules.xml
@@ -0,0 +1,162 @@
+
+
+6
+
+
+
+ postfix-reject
+ Grouping of the postfix reject rules.
+
+
+
+ 3300
+ ^554$
+ Attempt to use mail server as relay
+ (client host rejected).
+ spam,
+
+
+
+ 3300
+ ^550$
+ Rejected by access list
+ (Requested action not taken).
+ spam,
+
+
+
+ 3300
+ ^450$
+ Sender domain is not found
+ (450: Requested mail action not taken).
+ spam,
+
+
+
+ 3300
+ ^503$
+ Improper use of SMTP command pipelining
+ (503: Bad sequence of commands).
+ spam,
+
+
+
+ 3300
+ ^504$
+ Recipient address must contain FQDN
+ (504: Command parameter not implemented).
+ spam,
+
+
+
+ 3301, 3302
+ blocked using
+ IP Address deny-listed by anti-spam (blocked).
+ spam,
+
+
+
+ postfix
+ Grouping of the postfix rules.
+
+
+
+ 3320
+ defer service failure|Resource temporarily unavailable|
+ ^fatal: the Postfix mail system is not running
+ Postfix process error.
+ service_availability,
+
+
+
+ 3320
+ authentication failed
+ Postfix SASL authentication failure.
+ authentication_failed,
+
+
+
+ 3300
+ ^452
+ Postfix insufficient disk space error.
+ service_availability,
+
+
+
+ 3320
+ ^daemon started
+ Postfix started.
+
+
+
+ 3320
+ ^terminating on signal
+ Postfix stopped.
+ service_availability,
+
+
+
+ 3301
+
+ Multiple relaying attempts of spam.
+ multiple_spam,
+
+
+
+ 3302
+
+ Multiple attempts to send e-mail from a
+ rejected sender IP (access).
+ multiple_spam,
+
+
+
+ 3303
+
+ Multiple attempts to send e-mail from
+ invalid/unknown sender domain.
+ multiple_spam,
+
+
+
+ 3304
+
+ Multiple misuse of SMTP service
+ (bad sequence of commands).
+ multiple_spam,
+
+
+
+ 3305
+
+ Multiple attempts to send e-mail to
+ invalid recipient or from unknown sender domain.
+ multiple_spam,
+
+
+
+ 3306
+
+ Multiple attempts to send e-mail from
+ deny-listed IP address (blocked).
+ multiple_spam,
+
+
+
+ 3332
+
+ Multiple SASL authentication failures.
+ authentication_failures,
+
+
+
+ ^clamsmtpd:
+ Grouping of the clamsmtpd rules.
+
+