OSSEC HIDS Notification.
2013 Nov 21 15:10:43

Received From: localhost->/var/log/auth.log
Rule: 2502 fired (level 10) -> "User missed the password more than one time"
Portion of the log(s):

Nov 21 15:10:41 localhost sshd[3594]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.147.74.xxx user=root

--END OF NOTIFICATION

我是服务器上唯一的(合法的)用户,我的/ etc / ssh / sshd_config中没有设置PermitRootLogin.因此,每当有人未能以root身份进行搜索时,向我发送警报是毫无意义的.

我发现OSREC规则2502在/var/ossec/rules/syslog_rules.xml中定义为：

<rule id="2502" level="10">
    <match>more authentication failures;|REPEATED login failures</match>
    <description>User missed the password more than one time</description>
    <group>authentication_Failed,</group>
  </rule>

我不想完全禁用此规则,因为知道是否有尝试登录失败到我的用户名是非常有帮助的.当有问题的用户名是root时,我只是不需要给我发电子邮件.