Merge pull request #762 from ddpbsd/sshd

Tweak the sshd rules and tests
ossec · Mar 8, 2016 · 4b4569a · 4b4569a
2 parents 43a9a27 + ccf56dd
commit 4b4569a
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/contrib/ossec-testing/tests/sshd.ini b/contrib/ossec-testing/tests/sshd.ini
@@ -88,6 +88,6 @@ decoder = sshd
 [ssh no matching key exchange]
 log 1 pass = Sep 16 05:46:56 junction sshd[1961]: fatal: Unable to negotiate with 108.229.36.174: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1 [preauth]
 
-rule = 5750
-alert = 2
+rule = 5752
+alert = 0
 decoder = sshd
diff --git a/etc/rules/sshd_rules.xml b/etc/rules/sshd_rules.xml
@@ -350,7 +350,7 @@
 
   <rule id="5751" level="1">
     <decoded_as>sshd</decoded_as>
-    <if_sid>1002</if_sid>
+    <if_sid>5700</if_sid>
     <match>no hostkey alg [preauth]</match>
     <description>No hostkey alg.</description>
   </rule>