X-Git-Url: http://ftp.carnet.hr/pub/carnet-debian/scm?a=blobdiff_plain;f=etc%2Frules%2Fopenbsd_rules.xml;h=6675e9e8b3d34af2e86a7a3992985b4aab331b08;hb=HEAD;hp=171b7a0c424e4ae17de8525afaeeaef728f0d69b;hpb=6ef2f786c6c8ead94841b5f93baf9f43421f08c8;p=ossec-hids.git

diff --git a/etc/rules/openbsd_rules.xml b/etc/rules/openbsd_rules.xml
old mode 100755
new mode 100644
index 171b7a0..6675e9e
--- a/etc/rules/openbsd_rules.xml
+++ b/etc/rules/openbsd_rules.xml
@@ -197,6 +197,102 @@
     <description>hotplugd could not open a file.</description>
   </rule>
 
+  <rule id="51531" level="3">
+    <decoded_as>open-userdel</decoded_as>
+    <match>user removed: name=</match>
+    <description>User account deleted.</description>
+    <group>account_changed,</group>
+  </rule>
+
+  <rule id="51532" level="0">
+    <decoded_as>ntpd</decoded_as>
+    <match>bad peer from </match>
+    <description>Bad ntp peer.</description>
+  </rule>
+
+  <rule id="51533" level="1">
+    <program_name>^dhclient$</program_name>
+    <if_sid>1002</if_sid>
+    <match>receive_packet failed on </match>
+    <description>dhclient receive_packet failed.</description>
+  </rule>
+
+  <rule id="51534" level="1">
+    <if_sid>51533</if_sid>
+    <match>Input/output error$</match>
+    <description>dhclient receive_packet failed due to I/O error.</description>
+  </rule>
+
+  <rule id="51535" level="1">
+    <program_name>^dhclient$</program_name>
+    <if_sid>1002</if_sid>
+    <match>SIOCDIFADDR failed </match>
+    <description>SIOCDIFADDR failed</description>
+  </rule>
+
+  <rule id="51536" level="1">
+    <if_sid>51535</if_sid>
+    <match> Device not configured$</match>
+    <description>dhclient: device not configured.</description>
+  </rule>
+
+</group>
+
+<group name="local,syslog,openbsd,doas">
+
+  <rule id="51550" level="0">
+    <decoded_as>doas</decoded_as>
+    <description>doas grouping</description>
+  </rule>
+
+  <rule id="51551" level="1">
+    <if_sid>51550</if_sid>
+    <match>cannot stat</match>
+    <description>doas cannot stat a file.</description>
+  </rule>
+
+  <rule id="51552" level="2">
+    <if_sid>51551</if_sid>
+    <match>: Permission denied$</match>
+    <description>doas cannot stat a file due to permissions.</description>
+  </rule>
+
+  <rule id="51553" level="5">
+    <if_sid>51550</if_sid>
+    <match>path not secure$</match>
+    <description>A critical path for doas does not have secure permissions.</description>
+  </rule>
+
+  <rule id="51554" level="5">
+    <if_sid>51550</if_sid>
+    <match>failed command for </match>
+    <description>Failed doas command.</description>
+  </rule>
+
+  <rule id="51555" level="1">
+    <if_sid>51550</if_sid>
+    <match>ran command</match>
+    <description>A command was run using doas.</description>
+  </rule>
+
+  <rule id="51556" level="2">
+    <if_sid>51555</if_sid>
+    <match> as root </match>
+    <description>A doas command was run as root.</description>
+  </rule>
+
+  <rule id="51557" level="5">
+    <if_sid>51550</if_sid>
+    <match>failed auth for</match>
+    <description>doas authentication failed.</description>
+  </rule>
+
+  <rule id="51558" level="4">
+    <program_name>sendsyslog</program_name>
+    <match>^dropped </match>
+    <description>sendsyslog dropped log messages.</description>
+  </rule>
+
 </group> <!-- SYSLOG,LOCAL -->