X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;f=etc%2Frules%2Fpam_rules.xml;h=f70a813985e7c407b1bb40f72ac7258d1daaa19c;hb=a4a3f9220d3e22c2dc07396619b97f8134c09788;hp=03aab460bd855de1a6a14cc077b2be816d1a3a06;hpb=914feba5d54f979cd5d7e69c349c3d01f630042a;p=ossec-hids.git

diff --git a/etc/rules/pam_rules.xml b/etc/rules/pam_rules.xml
index 03aab46..f70a813 100755
--- a/etc/rules/pam_rules.xml
+++ b/etc/rules/pam_rules.xml
@@ -1,4 +1,4 @@
-<!-- @(#) $Id: pam_rules.xml,v 1.10 2009/11/04 20:09:22 dcid Exp $
+<!-- @(#) $Id$
   -  Official Unix Pam rules for OSSEC.
   -
   -  Copyright (C) 2009 Trend Micro Inc.
@@ -6,7 +6,7 @@
   -
   -  This program is a free software; you can redistribute it
   -  and/or modify it under the terms of the GNU General Public
-  -  License (version 3) as published by the FSF - Free Software
+  -  License (version 2) as published by the FSF - Free Software
   -  Foundation.
   -
   -  License details: http://www.ossec.net/en/licensing.html
@@ -57,7 +57,7 @@
   <rule id="5522" level="0">
     <if_sid>5502</if_sid>
     <program_name>^CRON$</program_name>
-    <match>^pam_unix(cron:session): session closed for user root$</match>
+    <match>^pam_unix(cron:session): session closed for user </match>
     <description>Ignoring Annoying Ubuntu/debian cron login events.</description>
   </rule>