X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?p=ossec-hids.git;a=blobdiff_plain;f=debian%2Fossec-hids%2Fusr%2Fshare%2Fdoc%2Fossec-hids%2Fcontrib%2Fossec-testing%2Ftests%2Fdovecot.ini;fp=debian%2Fossec-hids%2Fusr%2Fshare%2Fdoc%2Fossec-hids%2Fcontrib%2Fossec-testing%2Ftests%2Fdovecot.ini;h=0000000000000000000000000000000000000000;hp=691bc82b1ab463e090da6488b6894b1e4dba9e9f;hb=946517cefb8751a43a89bda4220221f065f4e5d1;hpb=3f728675941dc69d4e544d3a880a56240a6e394a

diff --git a/debian/ossec-hids/usr/share/doc/ossec-hids/contrib/ossec-testing/tests/dovecot.ini b/debian/ossec-hids/usr/share/doc/ossec-hids/contrib/ossec-testing/tests/dovecot.ini
deleted file mode 100644
index 691bc82..0000000
--- a/debian/ossec-hids/usr/share/doc/ossec-hids/contrib/ossec-testing/tests/dovecot.ini
+++ /dev/null
@@ -1,81 +0,0 @@
-[auth failed]
-log 1 pass = Dec 19 06:21:06 ny dovecot: imap-login: Disconnected (auth failed, 7 attempts in 111 secs): user=<thousands>, method=PLAIN, rip=109.201.200.201, lip=67.205.141.203, session=<+hgd5vxDBMZtycjJ>
-log 2 pass = Jan 11 03:45:09 hostname dovecot: auth-worker(default): sql(username,1.2.3.4): unknown user
-log 3 pass = Jan 11 03:42:09 hostname dovecot: auth(default): pam(user@example.com,1.2.3.4): pam_authenticate() failed: User not known to the underlying authentication module
-
-rule = 9705
-alert = 5
-decoder = dovecot
-
-[dovecot is starting]
-log 1 pass = Jun 17 10:15:24 hostname dovecot: Dovecot v1.2.rc3 starting up (core dumps disabled)
-
-rule = 9703
-alert = 3
-decoder = dovecot
-
-[fatal error]
-log 1 pass = Jun 17 10:15:24 hostname dovecot: Fatal: auth(default): Support not compiled in for passdb driver 'ldap'
-log 2 pass = Jun 17 10:15:24 hostname dovecot: Fatal: Auth process died too early - shutting down
-
-rule = 9704
-alert = 2
-decoder = dovecot
-
-[user authentication failure]
-log 1 pass = Jun 23 15:04:05 Info: imap-login: Login: user=<username>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.5 Authentication Failure:
-
-rule = 9770
-alert = 0
-decoder = dovecot-info
-
-[dovecot auth failed]
-log 1 pass = Jan 11 03:42:09 hostname dovecot: auth-worker(default): sql(user@example.com,1.2.3.4): Password mismatch
-
-rule = 9702
-alert = 5
-decoder = dovecot
-
-[XXX nothing]
-log 1 fail = Jan 07 14:46:28 Warn: auth(default): userdb(username,::ffff:127.0.0.1): user not found from userdb
-log 3 fail = May 31 09:43:57 Info: pop3-login: Aborted login (1 authentication attempts): user=<username>, method=PLAIN, rip=::ffff:1.2.3.4, lip=::ffff:1.2.3.5, secured
-
-rule = 1002
-alert = 2
-decoder =
-
-[XXX unknown 1002]
-log 1 pass = Mar 13 15:25:07 Info: auth(default): pam(user@example.com,::ffff:1.2.3.4): pam_authenticate() failed: User not known to the underlying authentication module
-
-rule = 9771
-alert = 5
-decoder = dovecot-info
-
-[session disconnected]
-log 1 pass = Jul  4 17:30:51 hostname dovecot[2992]: pop3-login: Disconnected: rip=1.2.3.4, lip=1.2.3.5
-
-rule = 9706
-alert = 3
-decoder = dovecot
-
-[aborted login]
-log 1 pass = Jan 30 09:37:55 hostname dovecot: pop3-login: Aborted login: user=<username>, method=PLAIN, rip=::ffff:1.2.3.4, lip=::ffff:1.2.3.5
-
-rule = 9707
-alert = 5
-decoder = dovecot
-
-[XXX logged out]
-log 1 fail = Jun 23 15:04:06 Info: IMAP(username): Disconnected: Logged out bytes=59/566
-
-rule = 1002
-alert = 2
-decoder = dovecot-info
-
-[unknown user]
-log 1 pass = Mar 13 15:25:07 Info: auth(default): passwd-file(user@example.com,::ffff:1.2.3.4): unknown user
-
-rule = 9771
-alert = 5
-decoder = dovecot-info
-