X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;f=etc%2Frules%2Fftpd_rules.xml;h=3db50b62f3a922601ae3b695a9b1a85eaff32a6f;hb=db2a2e0952d5d340d1b4fecb92b604caae2c553e;hp=813ae81fbfe53dbe6d5570088e4c8fed943bd7ce;hpb=914feba5d54f979cd5d7e69c349c3d01f630042a;p=ossec-hids.git

diff --git a/etc/rules/ftpd_rules.xml b/etc/rules/ftpd_rules.xml
index 813ae81..3db50b6 100755
--- a/etc/rules/ftpd_rules.xml
+++ b/etc/rules/ftpd_rules.xml
@@ -1,4 +1,4 @@
-<!-- @(#) $Id: ftpd_rules.xml,v 1.6 2008/08/05 18:54:23 dcid Exp $
+<!-- @(#) $Id$
   -  Official ftpd rules for OSSEC.
   -  Author: Ahmet Ozturk
   -  License: http://www.ossec.net/en/licensing.html
@@ -89,6 +89,13 @@
     <description>FTP authentication failure.</description>
     <group>authentication_failed,</group>
   </rule>
+
+  <rule id="11113" level="5">
+    <if_sid>11100</if_sid>
+    <regex>^login \S+ from \S+ failed</regex>
+    <description>FTP authentication failure.</description>
+    <group>authentication_failed,</group>
+  </rule>
 </group> <!-- SYSLOG,FTPD -->