X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;f=etc%2Frules%2Fftpd_rules.xml;h=4172a36a6ddecf65d76a7d180f27d27aa9ce70b0;hb=6ef2f786c6c8ead94841b5f93baf9f43421f08c8;hp=813ae81fbfe53dbe6d5570088e4c8fed943bd7ce;hpb=914feba5d54f979cd5d7e69c349c3d01f630042a;p=ossec-hids.git

diff --git a/etc/rules/ftpd_rules.xml b/etc/rules/ftpd_rules.xml
index 813ae81..4172a36 100755
--- a/etc/rules/ftpd_rules.xml
+++ b/etc/rules/ftpd_rules.xml
@@ -1,4 +1,5 @@
-<!-- @(#) $Id: ftpd_rules.xml,v 1.6 2008/08/05 18:54:23 dcid Exp $
+<!-- @(#) $Id: ./etc/rules/ftpd_rules.xml, 2011/09/08 dcid Exp $
+
   -  Official ftpd rules for OSSEC.
   -  Author: Ahmet Ozturk
   -  License: http://www.ossec.net/en/licensing.html
@@ -89,6 +90,13 @@
     <description>FTP authentication failure.</description>
     <group>authentication_failed,</group>
   </rule>
+
+  <rule id="11113" level="5">
+    <if_sid>11100</if_sid>
+    <regex>^login \S+ from \S+ failed</regex>
+    <description>FTP authentication failure.</description>
+    <group>authentication_failed,</group>
+  </rule>
 </group> <!-- SYSLOG,FTPD -->