X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?p=ossec-hids.git;a=blobdiff_plain;f=etc%2Frules%2Fdropbear_rules.xml;h=813dfd00a5621a03f96ff49c52e8a0658d103afb;hp=8609234b15982c7b705b877e368b14cab13a2f3e;hb=3f728675941dc69d4e544d3a880a56240a6e394a;hpb=927951d1c1ad45ba9e7325f07d996154a91c911b

diff --git a/etc/rules/dropbear_rules.xml b/etc/rules/dropbear_rules.xml
old mode 100755
new mode 100644
index 8609234..813dfd0
--- a/etc/rules/dropbear_rules.xml
+++ b/etc/rules/dropbear_rules.xml
@@ -37,8 +37,15 @@
     <group>authentication_failed,</group>
   </rule>
 
+  <rule id="51093" level="5">
+    <if_sid>51000</if_sid>
+    <match>attempt for nonexistent user</match>
+    <description>Bad password attempt for non existent user.</description>
+    <group>authentication_failed,</group>
+  </rule>
+
   <rule id="51004" level="10" frequency="6" timeframe="120" ignore="60">
-    <if_matched_sid>51003</if_matched_sid>
+    <if_matched_group>authentication_failed</if_matched_group>
     <same_source_ip />
     <description>dropbear brute force attempt.</description>
     <group>authentication_failures,</group>
@@ -78,6 +85,20 @@
     <description>User successfully logged in using a password.</description>
     <group>authentication_success,</group>
   </rule>
+
+  <rule id="51010" level="0">
+    <if_sid>51000</if_sid>
+    <match>Pubkey auth succeeded</match>
+    <description>User successfully logged in using a public key.</description>
+    <group>authentication_success,</group>
+  </rule>
+
+  <rule id="51011" level="1">
+    <decoded_as>dropbear</decoded_as>
+    <if_sid>1002</if_sid>
+    <match>Error listening: Address already in use</match>
+    <description>Dropbear cannot listen on port.</description>
+  </rule>      
  
    
 </group> <!-- SYSLOG,LOCAL -->