Skip to content

Commit 1eb0983

Browse files
ddpbsdddpbsd
committed
Cleanups
Mostly formatting or sphinx syntax errors.
1 parent 49d7aa3 commit 1eb0983

21 files changed

+125
-110
lines changed

‎about/how_to_help.rst

+2-2
Original file line numberDiff line numberDiff line change
@@ -47,15 +47,15 @@ If you want to support a new language, just copy the English one to your country
4747
Documenting OSSEC:
4848
^^^^^^^^^^^^^^^^^^
4949

50-
The OSSEC documentation is hosted in a `github repository <https://github.com/ossec/ossec-docs>`_.
50+
The OSSEC documentation is hosted in the `ossec-docs <https://github.com/ossec/ossec-docs>`_ github repository.
5151
Issues and pull requests can be submitted on the site.
5252
Emails containing details of issues can also be sent to the `ossec-list <https://groups.google.com/forum/#!forum/ossec-list>`_ google group.
5353

5454

5555
Development of OSSEC:
5656
^^^^^^^^^^^^^^^^^^^^^
5757

58-
The OSSEC code is hosted in a `github repository <https://github.com/ossec/ossec-hids>`_.
58+
The OSSEC code is hosted in the `ossec-hids <https://github.com/ossec/ossec-hids>`_ github repository.
5959
Issues and pull requests can be submited on the site.
6060

6161
Contributing to the development of OSSEC's code base will most likely require knwoledge of **C**,

‎docs/examples/output/granular_email_examples.trst

-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
.. _granular_email_examples:
2-
31
Example 1: Group alerts
42
~~~~~~~~~~~~~~~~~~~~~~~
53

‎docs/examples/output/index.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ Output
99
Granular Email Examples
1010
^^^^^^^^^^^^^^^^^^^^^^^
1111

12-
.. include:: granular_email_examples.trst
12+
.. include:: ./granular_email_examples.trst
1313

1414
Report Output Examples
1515
^^^^^^^^^^^^^^^^^^^^^^

‎docs/examples/output/report_output_examples.trst

-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
1-
.. _report_output_examples:
2-
3-
41
Receive a summary of all authentication success alerts
52
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
63

‎docs/examples/output/syslog_output_examples.trst

-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
.. _syslog_output_examples:
2-
31
Send all alerts to 10.10.10.125:
42
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
53

‎docs/faq/syscheck.rst

-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
.. _faq_syscheck-faq:
2-
31
Syscheck: FAQ
42
-------------
53

‎docs/log_samples/auth/microsoft_rras.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ A description of this format is found `on the Microsoft site <http://www.microso
2121
"RasBox","RAS",10/22/2006,11:57:54,1,"ACME\megaman","acme.net/Users/megaman",,,,,,"192.168.132.45",13,,"192.168.132.45",,,,0,"CONNECT 26400",1,2,4,,0,"311 1 192.168.132.45 07/31/2006 21:35:14 754",,,,,,,,,,,,,,,,,,,,,,,,,,,,"MSRASV5.00",311,,,,
2222
2323
24-
You can find information on the IAS standard log format `here <http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/sag_ias_log1a.html>`_ and `here <http://www.radiusreporting.com/IAS-Standard-Attribute-Table.html>`_
24+
You can find information on the IAS standard log format here on `Microsoft's site <http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/sag_ias_log1a.html>`_ and here `on radiusreporting <http://www.radiusreporting.com/IAS-Standard-Attribute-Table.html>`_
2525

2626

2727

‎docs/log_samples/email/postfix.rst

+1-2
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,7 @@ Insufficient storage:
3434
.. code-block:: console
3535
3636
Sep 4 01:14:35 vector postfix/smtpd[15337]: NOQUEUE: reject: MAIL from 89.pool85-60-78.dynamic.orange.es[85.60.78.89]: 452 4.3.1 Insufficient system storage; proto=ESMTP helo=<89.pool85-60-78.dynamic.orange.es>
37-
Sep 4 02:24:39 vector postfix/smtpd[16863]: NOQUEUE: reject: MAIL from 217-133-56-239.b2b.tiscali.it[217.133.56.239]: 452 4.3.1 Insufficient system storage; proto=ESMTP
38-
helo=<217-133-56-239.b2b.tiscali.it>
37+
Sep 4 02:24:39 vector postfix/smtpd[16863]: NOQUEUE: reject: MAIL from 217-133-56-239.b2b.tiscali.it[217.133.56.239]: 452 4.3.1 Insufficient system storage; proto=ESMTP helo=<217-133-56-239.b2b.tiscali.it>
3938
Jun 29 17:28:38 linuxserver postfix/smtpd[27712]: NOQUEUE: reject: MAIL from localhost[127.0.0.1]: 452 Insufficient system storage; proto=ESMTP helo=<localhost>
4039
4140

‎docs/log_samples/security_devices/iplog.rst

+72-45
Original file line numberDiff line numberDiff line change
@@ -261,6 +261,7 @@ Nov 18 19:28:07 ICMP/UDP: smurf attack mode expired for 201.223.41.0 - received
261261
<font color="red">Nov 14 15:57:56 TCP: Bogus TCP flags set by 10.10.160.2:60873 (dest port 25)</font>
262262

263263
='''OSSEC (HIDS) + iplog (sensor) implementation'''=
264+
264265
*Work in progress
265266
*TODO: improve regex, decoders and rules. p0f complementation?
266267
*Configuration tested in FreeBSD 6.1 and archlinux gimmick
@@ -282,11 +283,13 @@ Nov 14 18:30:30 TCP: Xmas scan detected [ports 636,256,554,389,1723,53,443,21,33
282283

283284
'''a working decoder is:'''
284285

285-
<decoder name="iplog-scan">
286-
<prematch>\S+ scan detected</prematch>
287-
<regex offset="after_prematch">\S+ \S+ from (\S+)</regex>
288-
<order>srcip</order>
289-
</decoder>
286+
.. code-block:: xml
287+
288+
<decoder name="iplog-scan">
289+
<prematch>\S+ scan detected</prematch>
290+
<regex offset="after_prematch">\S+ \S+ from (\S+)</regex>
291+
<order>srcip</order>
292+
</decoder>
290293
291294
292295
'''For this log:'''
@@ -295,23 +298,27 @@ Nov 14 18:35:00 UDP: scan/flood detected [ports 33161,41107,63571,48714,25271,..
295298

296299
'''a proppossed decoder is (not tested):'''
297300

298-
<decoder name="iplog-flood">
299-
<prematch>scan/flood detected</prematch>
300-
<regex offset="after_prematch">\S+ \S+ from (\S+)</regex>
301-
<order>srcip</order>
302-
</decoder>
301+
.. code-block:: xml
302+
303+
<decoder name="iplog-flood">
304+
<prematch>scan/flood detected</prematch>
305+
<regex offset="after_prematch">\S+ \S+ from (\S+)</regex>
306+
<order>srcip</order>
307+
</decoder>
303308
304309
'''For this log:'''
305310

306311
Nov 14 19:09:33 ICMP: ping flood detected from 10.10.150.1
307312

308313
'''a proppossed decoder is (not tested):'''
309314

310-
<decoder name="iplog-pingflood">
311-
<prematch>ping flood detected from</prematch>
312-
<regex offset="after_prematch">(\S+)</regex>
313-
<order>srcip</order>
314-
</decoder>
315+
.. code-block:: xml
316+
317+
<decoder name="iplog-pingflood">
318+
<prematch>ping flood detected from</prematch>
319+
<regex offset="after_prematch">(\S+)</regex>
320+
<order>srcip</order>
321+
</decoder>
315322
316323
'''For this log:'''
317324
(necesary to include???????) i Think no (very paranoic)
@@ -320,11 +327,13 @@ Nov 14 18:57:18 UDP: traceroute from 10.10.150.2
320327

321328
'''a proppossed decoder is (not tested):'''
322329

323-
<decoder name="iplog-traceroute">
324-
<prematch>pingtraceroute from</prematch>
325-
<regex offset="after_prematch">(\S+)</regex>
326-
<order>srcip</order>
327-
</decoder>
330+
.. code-block:: xml
331+
332+
<decoder name="iplog-traceroute">
333+
<prematch>pingtraceroute from</prematch>
334+
<regex offset="after_prematch">(\S+)</regex>
335+
<order>srcip</order>
336+
</decoder>
328337
329338
330339
@@ -335,55 +344,71 @@ Nov 14 15:57:56 TCP: Bogus TCP flags set by 10.10.160.2:60873 (dest port 25)
335344

336345
'''a proppossed decoder is (not tested):'''
337346

338-
<decoder name="iplog-bogustcp">
339-
<prematch>Bogus TCP flags set by</prematch>
340-
<regex offset="after_prematch">(\S+):\d+</regex>
341-
<order>srcip</order>
342-
</decoder>
347+
.. code-block:: xml
348+
349+
<decoder name="iplog-bogustcp">
350+
<prematch>Bogus TCP flags set by</prematch>
351+
<regex offset="after_prematch">(\S+):\d+</regex>
352+
<order>srcip</order>
353+
</decoder>
343354
344355
=='''iplog rules'''==
345356

346357
Only for working decoders
347358

348-
cd ~/ossec/rules
349-
touch iplog_rules.xml
350-
chown root:ossec iplog_rules.xml
351-
chmod 550 iplog_rules.xml
359+
.. code-block:: console
360+
361+
cd ~/ossec/rules
362+
touch iplog_rules.xml
363+
chown root:ossec iplog_rules.xml
364+
chmod 550 iplog_rules.xml
352365
353366
in iplog_rules.xml include:
354367

355-
<group name="syslog,errors,">
356-
<rule id="99990" level="6">
357-
<decoded_as>iplog-scan</decoded_as>
358-
<description>iplog scan detect</description>
359-
</rule>
368+
.. code-block:: xml
369+
370+
<group name="syslog,errors,">
371+
<rule id="99990" level="6">
372+
<decoded_as>iplog-scan</decoded_as>
373+
<description>iplog scan detect</description>
374+
</rule>
360375
</group>
361376
362377
=='''ossec.conf'''==
363378

364-
cd ~/ossec/etc
365-
vi ossec.conf
379+
.. code-block:: console
380+
381+
cd ~/ossec/etc
382+
vi ossec.conf
366383
367384
include in the correct place:
368385

369-
<include>iplog_rules.xml</include>
386+
.. code-block:: xml
387+
388+
<include>iplog_rules.xml</include>
370389
371390
and
372391

373-
<localfile>
374-
<log_format>syslog</log_format>
375-
<location>/var/log/iplog</location>
376-
</localfile>
392+
.. code-block:: xml
393+
394+
<localfile>
395+
<log_format>syslog</log_format>
396+
<location>/var/log/iplog</location>
397+
</localfile>
377398
378399
or wherever you put your iplog logs
379400

380401
start iplog
381402

382-
iplog -d
403+
.. code-block:: console
404+
405+
iplog -d
383406
384407
restart ossec
385408

386-
~/ossec/bin/ossec-control restart
409+
.. code-block:: console
410+
411+
~/ossec/bin/ossec-control restart
387412
388413
test with nmap (see before)
389414

@@ -392,8 +417,10 @@ test with nmap (see before)
392417
=='''Firewall Drop: FreeBSD-IPFW'''==
393418
add to your ipfw script the follow lines, if you are using the 00001 rule number disoccupying:
394419

395-
/sbin/ipfw add 00001 deny ip from table\(00002\) to any
396-
/sbin/ipfw add 00001 deny ip from any to table\(00002\)
420+
.. code-block:: console
421+
422+
/sbin/ipfw add 00001 deny ip from table\(00002\) to any
423+
/sbin/ipfw add 00001 deny ip from any to table\(00002\)
397424
398425
Change ~/ossec/active-response/bin/firewall-drop.sh to adjust to the red lines
399426

‎docs/log_samples/vpn/racoon.rst

+10-20
Original file line numberDiff line numberDiff line change
@@ -10,27 +10,17 @@ Good login:
1010

1111
.. code-block:: console
1212
13-
2006-08-10 19:22:40: INFO: respond new phase 1 negotiation:
14-
111.111.111.194[500]<=>83.36.51.44[500]
13+
2006-08-10 19:22:40: INFO: respond new phase 1 negotiation: 111.111.111.194[500]<=>83.36.51.44[500]
1514
2006-08-10 19:22:40: INFO: begin Aggressive mode.
16-
2006-08-10 19:22:40: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-
17-
ike-02
18-
2006-08-10 19:22:41: INFO: ISAKMP-SA established 111.111.111.194
19-
[500]-83.36.51.44[500] spi:3ac2d5023f433d3e:e2d682b6f4fc4830
20-
2006-08-10 19:22:42: INFO: respond new phase 2 negotiation:
21-
111.111.111.194[0]<=>83.36.51.44[0]
22-
2006-08-10 19:22:42: INFO: no policy found, try to generate the
23-
policy : 10.0.1.5/32[0] 10.15.13.224/27[0] proto=any dir=in
24-
2006-08-10 19:22:42: INFO: IPsec-SA established: ESP/Tunnel
25-
83.36.51.44->111.111.111.194 spi=188599340(0xb3dcc2c)
26-
2006-08-10 19:22:42: INFO: IPsec-SA established: ESP/Tunnel
27-
111.111.111.194->83.36.51.44 spi=19221256(0x1254b08)
28-
2006-08-10 19:22:42: ERROR: such policy does not already exist:
29-
10.0.1.5/32[0] 10.15.13.224/27[0] proto=any dir=in
30-
2006-08-10 19:22:42: ERROR: such policy does not already exist:
31-
10.0.1.5/32[0] 10.15.13.224/27[0] proto=any dir=fwd
32-
2006-08-10 19:22:42: ERROR: such policy does not already exist:
33-
10.15.13.224/27[0] 10.0.1.5/32[0] proto=any dir=out
15+
2006-08-10 19:22:40: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
16+
2006-08-10 19:22:41: INFO: ISAKMP-SA established 111.111.111.114[500]-83.36.51.44[500] spi:3ac2d5023f433d3e:e2d682b6f4fc4830
17+
2006-08-10 19:22:42: INFO: respond new phase 2 negotiation: 111.111.111.194[0]<=>83.36.51.44[0]
18+
2006-08-10 19:22:42: INFO: no policy found, try to generate the policy : 10.0.1.5/32[0] 10.15.13.224/27[0] proto=any dir=in
19+
2006-08-10 19:22:42: INFO: IPsec-SA established: ESP/Tunnel 83.36.51.44->111.111.111.194 spi=188599340(0xb3dcc2c)
20+
2006-08-10 19:22:42: INFO: IPsec-SA established: ESP/Tunnel 111.111.111.194->83.36.51.44 spi=19221256(0x1254b08)
21+
2006-08-10 19:22:42: ERROR: such policy does not already exist: 10.0.1.5/32[0] 10.15.13.224/27[0] proto=any dir=in
22+
2006-08-10 19:22:42: ERROR: such policy does not already exist: 10.0.1.5/32[0] 10.15.13.224/27[0] proto=any dir=fwd
23+
2006-08-10 19:22:42: ERROR: such policy does not already exist: 10.15.13.224/27[0] 10.0.1.5/32[0] proto=any dir=out
3424
3525
3626
This line indicates that the initial phase 1 auth (pskeys or certificates) have been exchanged correctly:

‎docs/log_samples/web/servers/nginx.rst

+4-1
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,17 @@ Log Samples from Nginx
22
by default nginx writes logs to access.log and error.log, similarly to apache.
33

44
= access log samples =
5+
56
.. code-block:: console
7+
68
66.75.252.36 - - [14/Aug/2008:04:54:45 +0000] "GET /wiki/skins/common/shared.css?116 HTTP/1.1" 200 818 "http:// example.com/wiki/index.php?title=Main_Page" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_4; en-us) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.2 Safari/525.20.1"
79
66.75.252.36 - - [14/Aug/2008:04:54:45 +0000] "GET /wiki/skins/common/commonPrint.css?116 HTTP/1.1" 200 1980 "http://example.com/wiki/index.php?title=Main_Page" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_4; en-us) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.2 Safari/525.20.1"
810

911

1012
= error log samples =
13+
1114
.. code-block:: console
15+
1216
2008/08/14 12:59:05 [error] 7419#0: *625 directory index of "/var/www/example.com/wiki/skins/" is forbidden, client: 66.249.71.183, server: example.com, request: "GET /wiki/skins/ HTTP/1.1", host: "example.com"
1317
2008/08/14 14:37:31 [error] 7418#0: *820 open() "/var/www/example.com/robots.txt" failed (2: No such file or directory), client: 66.249.71.184, server: example.com, request: "GET /robots.txt HTTP/1.1", host: "example.com"
1418
15-

‎docs/manual/installation/install-source-unattended.rst

-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ Example preloaded-vars.conf:
2222

2323
.. code-block:: console
2424
25-
2625
# preloaded-vars.conf, Daniel B. Cid (dcid @ ossec.net).
2726
#
2827
# Use this file to customize your installations.

‎docs/manual/installation/installation-requirements.rst

+2-2
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ FreeBSD
154154
-------
155155

156156
If you want to build and install OSSEC on FreeBSD you can work together with
157-
its `Ports Collection <https://www.freebsd.org/ports>`_.
157+
its `FreeBSD Ports Collection <https://www.freebsd.org/ports>`_.
158158

159159
There you can find and setup **ossec-hids-agent**, **ossec-hids-local** or
160160
**ossec-hids-server**.
@@ -176,7 +176,7 @@ want to install them you must work with
176176
OpenBSD
177177
-------
178178

179-
As OpenBSD also has its own `Ports Collection <https://www.openbsd.org/faq/ports/ports.html>`_,
179+
As OpenBSD also has its own `OpenBSD Ports Collection <https://www.openbsd.org/faq/ports/ports.html>`_,
180180
you can build and install OSSEC using it if you want.
181181

182182
It only offers **security/ossec-hids**, so:

‎docs/manual/notes/iptables_configuration.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,10 @@ For deny rules, the following action should be set:
3434
They will generate the following log (or similar):
3535

3636
.. code-block:: console
37+
3738
Jan 11 20:44:49 xxx kernel: [89463.101343] DROP IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=33772 DF PROTO=TCP SPT=43961 DPT=81 WINDOW=32767 RES=0x00 SYN URGP=0
3839

3940

4041
Note that ossec will based its action based on the "DROP" or ALLOW that you configured.
4142
For more information about iptables log, take a look `here <http://logi.cc/linux/netfilter-log-format.php3>`_ .
4243

43-

0 commit comments

Comments
 (0)