LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 07-09-2013, 11:18 AM   #1
glennbtn
Member
 
Registered: Dec 2009
Posts: 117

Rep: Reputation: 18
Custom ossec rules


Hi All

We constantly have people trying to hack the admin login on our website. We created a redirect giving a 302 error but would like to block them using a ossec custom rule and iptables. If anyone could help here it would be great as I don't really have a clue about this. The line from our custom apache log is below (just changed out domain name)

mydomain.com:80 2.231.203.177- - [09/Jul/2013:14:28:51 +0100] "POST /dir/modules/mod_feed/tmpl/file.php HTTP/1.1" 302 484 "-" "Mozilla/5.0"

Thanks

Glenn
 
Old 07-09-2013, 10:25 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590
Maybe start by reading http://www.ossec.net/ossec-docs/OSSEC-book-ch4.pdf, then find a suitable similar rule in apache_rules.xml, copy it to your local_rules.xml and modify it and then run your log line through 'ossec-logtest'?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
custom rules in OSSEC 2.6 vikas027 Linux - Software 3 07-13-2012 11:01 AM
[SOLVED] what custom rules do you use with spamassasin?? yeayu Linux - Software 1 10-25-2011 05:15 PM
Need custom Snort rules written abefroman LQ Job Marketplace [Archive] 1 05-26-2008 12:05 AM
Location for Custom udev Rules Toods Slackware 7 11-19-2007 01:42 PM
Mailscanner custom rules. David ward Linux - Software 1 11-17-2005 02:10 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 06:12 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration