    ossec-hids-2.6-15.fc17.art                                                                    $   >                                  !aI7,UP?   >                 @  d   ?     d      d                                                	           	   R          0          4          P          T          i          m        	                                                       W       X   W  	        W  
        W          W          W           W       \   W       !   W                 (   W                                        !     (     "2     )     ":     *     "y     +     "     ,     "     -     "     8     "   r  9     $P   r  :     9   r  =     RS     D     R[     G     Rd   W  H     S   W  I     U   W  X     Ut     Y     U     \     U   W  ]     W   W  ^     [     b     ]F     d     ]     l     ]     t     ^    W  u     _\   W  v     `   	  w     a   W  x     b   W  y     dL          d     e     d     f     d   C ossec-hids 2.6 15.fc17.art An Open Source Host-based Intrusion Detection System OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection
System (HIDS). It has a powerful correlation and analysis engine, integrating
log analysis, file integrity checking, Windows registry monitoring, centralized
policy enforcement, rootkit detection, real-time alerting and active response.
It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS,
Solaris and Windows.

This package contains common files required for all packages. P*ministry.whq.atomicorp.com   =http://www.ossec.net GPL Atomicorp <support@atomicorp.com> Applications/System http://www.ossec.net/ linux i686 if ! id -g ossec > /dev/null 2>&1; then
  groupadd -r ossec
fi
if ! id -u ossec > /dev/null 2>&1; then
  useradd -g ossec -G ossec       \
	-d /var/ossec \
	-r -s /sbin/nologin ossec
fi
if ! id -u ossecr > /dev/null 2>&1; then
  useradd -g ossec -G ossec       \
	-d /var/ossec \
	-r -s /sbin/nologin ossecr
fi              8  6     <          _   =     -         R                    ;                s      1       <     ,        c      
?    	  v      ;  |  <  4        U    '               A            O    	       {   d      (   (   <   (A큤A큤A큤A큤AhAhAhhhhhhhhhAhhhhhhhhhhhhhAhAhAA聠AAhAAAhA                                                                                                                                                                              P*P*NPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPP*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*P*65bec1e837d94dff7f8db551208d73aeb0dc2fef6a6407ea7c91c4ee6f430528  b697413cf6e55da97ca296ebd72cd8db53eef2c007869d389075d5d2391e14a0 e9c1d327b2e97725bbcb54f63bec73a12ec07b8d44ad17020238e84970a2d2cf 484df679efd5a5a186c40942cd2fcac511c8d3742d6a7896b4b90f59f7f581bf 92612a256f5ba0a382513b2cd6b6259e3565dccf5d91adfee1967803de50e5c4  9fe9080ce777f1a6ae7b30897d0fb608ae624bfb348ecf0c0c860ddbdf86e5f0 0ec9577297c751ff97badc51306be8111040caa25081fd2e30c0fe38e44c7f68 1e0f3d6deb94ce7081fae364891cac7758754639e4b88acccc54671eab510266  c988f19452b5542572cae3fff4f0fac802562acc315e5173aa4e083d9e369842 9d9ec8875aec0ac6117dae038f4e015d811720fe4a64b93c15d3583b1340dcf0 20cf243734164073841e9ca712d34f54db876fb5d7ebafdbdb71a9fd5c91fc92 dc0b9539ba19d3b5ddca245f8cf1e3f89a9fd345a6f6fb5dc86f7087acdb45cd 1e0f3d6deb94ce7081fae364891cac7758754639e4b88acccc54671eab510266 098c461918330df3a040ae8b3fdf06ba15ef234deeb7c8da37d9a8cc21d3af8b a81c47faa02a7cddf8962e1301f71a013cdea018cdb0975758487de252499d34 f2271e2698e78b45b32149e10600d4fd15262cbdf44e43a5a4b0d51c9f7f2e8f be8502642e5a5251a50cf8274747caa2b3aae9b819e172e5def48dd3e33e9443 ecce3956f6c2defb4033e497cf965a81ddf825964637324920d58566f6933dc8 3fa00600644e8add5af583ae9f16b64e72ae13bdf65dd5c2cbafa9cbab3e63f9 a76d2a0929c5508ddfd00a8a246c549e4d3855fd5277453d9b61c7f660e8fb48 70f89134f79532f6f642f47a2d0bdf63861d20f4b76f190711bc4e2d3dfcb892 9dfb9bdf2df6d1948877696ffb6ff8f08dbda8a3c3e1fcdead588fc44ce462ca  8ab9eb4987d590c7d1e5e7a62358c957d9d5a5c6e528f835eb2529eb751edd1c a5924d7f5fa4ecfa24bee05187fa22f432069720a914374892e9bd8d2a807d8a 4f73cb6caba37b1f399cb8e835608aa1e41dbb4ccee16ba23f6e878dd8f58899 1e1f01db9177108f64c5e561822f0a259bdfad59aebcf0fe24d0c0e9df5f9756 1e0f3d6deb94ce7081fae364891cac7758754639e4b88acccc54671eab510266 ef970afaee6fc7fa4168b1a3ccdf9808edf5df98b30c195597317e7d59c0bae1 065ae034ecc96615757d45a4af1c9f1770295131a1ead862073eb78329522d4e 1d1e66839dd778872fe2aa7275713c2ffc64486f2b2157b51d044cbfcf5ea9ee cee8fd0b3cee63ba465cf8d4d58de2e155602f678efcc54bb6a6d5a43f496a42 3668a2dd9f579512554f17443a71530e8ac867bf8c9115c53f79b301f05e7836 0458d564b9d237a720b126230bd78175da49c5a19e4e9324dcb0384302654282 785514a76800f7faf6865ba06fe6eea63cf17c2c04bd2dc65c2af5697c808070 810475207bab7ce35d0ca1f3fb2174dbad95ab50f9873a3879889674bcad9b80    c4c02e402256dfdcd58357750535ca49e191e13328eb43b5e746999153958ff1 f9a813e4e53823fc8d43a8ec1a91df67524308156eabdf63c8440086f2394260 7b870cbb4655022c0f68f97a737942d2f26b32644f43d7c38b2d8e3e74b6389c a92731e8b8ef0e0e6ac663e2ab01d92b5809a94f46858f4cbcf7dc01aa92aec1 5781e4c355eee177f8789ce242a75dde4b27f1f313e6eb4b1641227ab2767848 e736dde6929e32461fe51db100d4bff0d80ac2d316e7011aa4ac8294bb94a0a9 7b180716a51e2910f2e2595675e087bb173ba962aa61c0835990f186818704c2 a8a4b349fff82b0c8ab42a00c19289e437f0cdebbeb6b6b5c1cf575e53cbfba9  b3466df217762f4fc91bb1df77aea83c957cf0b43bce3651837700d172ad7851 1cbb5e45f98a4b872a9fe533186676ae110bb4dff25e6418589597590467e39a 44bb5b1b51a13614052f25b721cfaaee094b1a23f2048680c28dac2748c77017 d551c086b902c9192089460ab6ffe03daf15b6841119f65a22a8922e4b6d4533 53203388c00aedefb59511c4e482c0f76cb8cb22f01085d9c1d96278c232bd3d b6deef2fb3eeca969e8c4f491dedec38c80965fc7ed0caa108e48fdeedd344f8 df410bebad94ad7c3b72246240c178727a538b13afbcfd207524a34c2c9617f2 02d696911e55bf3a427f7f010d105b4d47710b2c367c94dbc93f9b5dbc340af1 24fbc3719bff6f041002db8857af4f903f82abcb5d29484b68380db178fe0dac e502a2943a7d783954f784e46dde4b90261ae6a726608c90140221b061ec5608 5df7cc5b85f2d85a5b99e98f0d25e5bd20dae24c6eede74067e0845840f4ca5e 452993375423d3d27cb78247052759d5f9fa2af425fbf239f13b4c13b2ba6713  076f8fe539b132fc462ec518ab3740c9e4e21231dce7dcb6237daa4d3de5e9ab   484b465d99d05f755034d15ed5519bf9738fbd794d8fbaf588a29e0823a6d929  9fb3b973248c76d14a814ba558235f520640d26e9f2fafac03fa2432b16e40f9 25a7f364c19adf32a092b97aa4609675237da4b5f47d17516d5068b18e033b4c aee022646c6b78507bd02bd632efc1d46e65c82589c8823190e83e4c006846d6 00897a8ee5c0159709c28c622ad5e4de85d0e596f770ea8c80be97893f85f675 43ba95564730b7265e456120cef81905316d877cc532344993987b38f1b1e008 1c87cd21a1b8e5e4fca27a2fc19868d161f15635514513586adddbdb196cec6c f97d988840ce05868f7e8eb40582354bb44f1d0e1614241d088a8c440f0fc4ba 4d4d92afaa567f36f7b7e159ea245b23873688c662380971b3f38868637fc9bd 6885d148c45a37180b3a8ee40236fc0519b87a467409e5e9167b9f4fe599054e 58d925aab330df06db3418f50d3f57c2f1f5c892f142c3d59cb9db2de1380a8d 3952a2669d9788a52c0f54d54db7954dd74129e9a34953bcf4864248fbfa5107 b8f7994193cc5fcc7a75988740e117b64462ee62a7d40cff17f72e5d39fb2736                                                                                                                                                                                                                                                                                                                                                                                                                         root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec root ossec ossec root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec root ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec ossec-hids-2.6-15.fc17.art.src.rpm   config(ossec-hids) ossec ossec-hids ossec-hids(x86-32)          @   @   @               @   @   @   
  
  
  
/bin/sh /bin/sh /bin/sh /usr/bin/env /usr/bin/perl /usr/sbin/groupadd /usr/sbin/useradd config(ossec-hids) inotify-tools perl(DBI) perl(Fcntl) perl(strict) rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz)        2.6-15.fc17.art     3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.9.1.3 [ -r /etc/localtime ] && cp -fpL /etc/localtime /var/ossec/etc glibc         P@OiO@OЗOЗO	O OpZ@NNS@NK@N;@N;@N6@N-ZNMMM@M@M@M?MM>MUM@MPL~L8LΫLΫLʷ@LeL@L{LL@LA@LLLzL~@@L|LvW@LmLa?@LRL4l@LT@KtK͗@KKK@K[K@K8@K@K@K@J@JJJ@JJJn@JL@JI@J2C@J2C@J/@J&eI@Io@I)@I4IܑIII@I@I&@III~@H@H|@HcHM@H2@H)GJ@GAzGV@Gm@Fޚ@F@F@FF@Fr@Fq-FIF-@EWEEySEIE
E 	DDY@D@DLSupport <support@atomicorp.com> - 2.6-15 Support <support@atomicorp.com> - 2.6-14 Support <support@atomicorp.com> - 2.6-13 Support <support@atomicorp.com> - 2.6-12 Support <support@atomicorp.com> - 2.6-11 Support <support@atomicorp.com> - 2.6-10 Support <support@atomicorp.com> - 2.6-9 Support <support@atomicorp.com> - 2.6-8 Support <support@atomicorp.com> - 2.6-7 Support <support@atomicorp.com> - 2.6-6 Support <support@atomicorp.com> - 2.6-5 Support <support@atomicorp.com> - 2.6-4 Support <support@atomicorp.com> - 2.6-3 Support <support@atomicorp.com> - 2.6-2 Support <support@atomicorp.com> - 2.6-1 Support <support@atomicorp.com> - 2.6.0-0.10 Support <support@atomicorp.com> - 2.6.0-0.9 Support <support@atomicorp.com> - 2.6.0-0.8 Support <support@atomicorp.com> - 2.6.0-0.7 Support <support@atomicorp.com> - 2.6.0-0.6 Support <support@atomicorp.com> - 2.6.0-0.5 Support <support@atomicorp.com> - 2.6.0-0.4 Support <support@atomicorp.com> - 2.6.0-0.3 Support <support@atomicorp.com> - 2.6.0-0.1 Support <support@atomicorp.com> - 2.5.1-10 Support <support@atomicorp.com> - 2.5.1-9 Support <support@atomicorp.com> - 2.5.1-8 Support <support@atomicorp.com> - 2.5.1-7 Support <support@atomicorp.com> - 2.5.1-6 Support <support@atomicorp.com> - 2.5.1-5 Support <support@atomicorp.com> - 2.5.1-4 Support <support@atomicorp.com> - 2.5.1-3 Support <support@atomicorp.com> - 2.5.1-2 Support <support@atomicorp.com> - 2.5.1-1 Support <support@atomicorp.com> - 2.5-1 Support <support@atomicorp.com> - 2.5-0.9 Support <support@atomicorp.com> - 2.5-0.8 Support <support@atomicorp.com> - 2.5-0.7 Support <support@atomicorp.com> - 2.5-0.6 Support <support@atomicorp.com> - 2.5-0.1 Support <support@atomicorp.com> - 2.4.1-11.2 Support <support@atomicorp.com> - 2.4.1-11.1 Support <support@atomicorp.com> - 2.4.1-10 Support <support@atomicorp.com> - 2.4.1-9 Support <support@atomicorp.com> - 2.4.1-8 Support <support@atomicorp.com> - 2.4.1-7 Support <support@atomicorp.com> - 2.4.1-6 Support <support@atomicorp.com> - 2.4.1-5 Support <support@atomicorp.com> - 2.4.1-4 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.4.1-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.4-5 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.4-4 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.4-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.4-0.2 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.4-0.1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.3-8 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.3-7 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.3-6 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.3-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.2-5 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.2-4 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.2-3 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.2.0.beta2.1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.2.0.beta1.1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.1.1-5 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.1.1-3 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.1.1-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.1-3 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.1-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0-11 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0-10 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0-9 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0-8 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0-7 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0-6 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0-5 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0-4 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0-2 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0.0-0.090225.1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0.0-0.090220.1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0.0-0.090206.1 Scott R. Shinn <scott@atomicrocketturtle.com> - 2.0.0-0.090205.1 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.99-2 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.99-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.6.1-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.6-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.5.1-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.5-3 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.5-2 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.5-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.4-2 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.4-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.3-4 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.3-3 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.3-2 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.3-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.2-8 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.2-7 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.2-5 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.2-4 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.2-3 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.2-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.1-1 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.0-2 Scott R. Shinn <scott@atomicrocketturtle.com> - 1.0 Scott R. Shinn <scott@atomicrocketturtle.com> peter.pramberger@member.fsf.org peter.pramberger@member.fsf.org peter.pramberger@member.fsf.org peter.pramberger@member.fsf.org peter.pramberger@member.fsf.org peter.pramberger@member.fsf.org peter.pramberger@member.fsf.org - Move active response components under the common package - bugfix #xxx, correct ownership permissions on fts dir - Update to init script to suppress spurious execd output
- Add alerts queue to server package with ossec/ossec permissions - Bugfix #XXX, correct any/agentd condition - Moved agentless packages under server - Drop timeid and cat_id indexes from schema - Add new index, timeid to alerts table. - Add cmoraes patch, Adds config options for enabling/disabling rootkit/syscheck options, and agent config profiles
- Add ossec-memleaks patch
- Add agentless directories, and agent.conf
- Bugfix #XXX, ossec-hids.init will now return an exit code on status - Add prelink_cmd support - Bugfix #XXX, display multi-line events in data table correcty - Update to asl-shun.pl purge event to default to 24 hours. - Update to asl-shun.pl to change ordering of block rules
- Revert from 0805 snapshot - Update to 0805 snapshot - Update to 0801 snapshot
- Update asl-shun.pl to log to active-responses.log, blocks now go to the named chain ASL-ACTIVE-RESPONSE, and delete events are more redundant. - Update to OSSEC 2.6 Final - Update to snapshot 110711 - Update to snapshot 110613 - Update to snapshot 110609 - Update to snapshot 110606
- Moved ossecr user creation event to the ossec-hids core package - Update to snapshot 110531 - Update to snapshot 110526 - Update to snapshot 110504 - Bugfix #536, Increase the default sleep time for syscheck - Renamed to 2.6 branch - Add support for the rules/decoders dir system - Update to snapsot 110405
- Update asl-shun to support ossec alert ids - Changed asl-shun sqlite database to /var/ossec/var/blocklist3.sqlite
- asl-shun database format now stores the full alertid - Update to snapshot 101203 - Update to snapshot 101125 - Added alertid support to os_dbd, this involves a schema update - Added dst ip, src prt, and dst prt capture support to os_dbd - Bugfix #XXX, manage_agents was built in client mode for the server package. - Add clamav decoder & ruleset - Update to 2.5.1 final - Update to 2.5 final - Update to 0928 snapshot - Extended no_ar into ossec-dbd - Add no_ar option to disable active response per rule - Update to snapshot 100920 - Update snapshot to 100907 - Snapshot 100901 - Added test fix for os_dbd - Bugfix #376, ossec-control will now properly stop and reload - Update to 0809 snapshot - Relink against native mysql - Add minicon decoder from les fenison - Update to 100707 snapshot
- Feature Request #371, add ossec.log to logrotate - Updated to 100615 snapshot - Updated init and ossec-server scripts to support the new reload feature. - Update to 2.4.1 - Added zabbix reporting active response - Update to 2.4 final
- Lowered courier rule 3910 (failures) from 6 over 240 to 10 over 10
- Lowered courier rule 3911 (success) from 10 over 60 to 30 over 20 - Rebuilt for atomic repo - Update to CVS 100317 - Update to CVS 100311
- Add decoder for denyhosts
- Update asl_rules.xml to include denyhosts rules - Update to CVS 100309 - Added new decoder for smtp_auth
- Added rules to detect smtp_auth brute force attempts
- Added rules to detect imap/pop brute force attempts - Updated ossec-server.conf to be in parity with the ASL config
- Added templates dir for generating configs - Update to 2.3 release - Update to snapshot 091109 - Update to snapshot 091008 - Update to snapshot 090925
- Added timestamp field to the mysql schema
- Bugfix #XXX, for the ossec-client.init script to call the correct (renamed) ossec syscheckd/logcollector daemons
- Appologies for not updating the previous changelogs. Missed a few updates! - Update to snapshot 090827
- Feature Request #225, Added logrotate event to active-response log
- Updated system_audit_rcl.txt to look for the correct php.ini file - Update to 090824, beta 1 release - Update to 090812 snapshot - Rebuild agent daemons with -DCLIENT, added symlink trickery - update to 2.1.1 - update to 090630 snapshot, this has fixes for CentOS/RHEL 4 64-bit environments - update to 2.1 final - update to snapshot 090612 - update to snapshot 090610 - update to snapshot 090603 - Disable postgresql support, to get around an undesirable dependency on EL4 - Update to snapshot 090417 - Update to snapshot 090413 (this adds in inotify support) - Update to snapshot 090410 (this adds in inotify support) - Update to snapshot 090408 - Added authpsa rules back in, this is used to detect brute force attacks
- Added conditional building support for ASL modifications - Update to 2.0 official release - update to snapshot 090225 - update to snapshot 090220 - update to snapshot 090206 - update to snapshot 090205 - update to CVS code 090129, this is not an offical release. Its for testing only - update to CVS code 090126, this is not an offical release. Its for testing only - update to 1.6.1 - update to 1.6 - update to 1.5.1 - added mysql support - Added Stanislaw Polak's excellent ban-hackers script to manage shunning more intelligently. - update to 1.5 - fix on active-response locking bug that prevented some rules from expiring. - update to ossec 1.4 - update snapshot to ossec-hids-071011.tar.gz
- relinked C4, FC4, FC5 against mysql4 - update to snapshot ossec-hids-071006.tar.gz - update to shun blocklist tracking used by ASL
- added authpsa rules + decoder - update to 1.3 - minor adjustment in %post, to check for config file before overwriting it - v6 was first version of the patch.
- added in logging in active-response for better ASL support
- Disabled conf event in %post, to keep from overwriting config files. - changed permissions on queue/syscheck so it can be read by the ossec group (tweak for web gui) - removed the noreplace settings from decoder and the rules
- patch for a more ASL friendly client config - release -2 had a bug. 
- added ASL rules (asl_rules.xml)
- added decoder for the asl style modsecurity logging
- adjusted syslog_rules for qmail-scanner issue (BUG #ASL-18)
- Added http index in asl_rules.xml (BUG #ASL-7) - update to 1.2 - update to 1.1 - configuration change for ASL - updated to 1.0 - import into ART
- changed their naming conventions a bit, 0.9-3 to 0.9.3. Please dont be cross with me. - new version (0.9-3) - new version (0.9-2) - new version (0.9-1a) - new version (0.9-1) - new version (0.9) - some bugfixes - created /bin/sh /bin/sh     $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $   $rx%x&x'x(x)x*x<x>x;x@xJxGxCxHxFxIxExAxBxDx?x=x.x:x/x5x7x2x8x6x9x4x0x1x3x+x,x-rrrruuuuuurrrrrrrrrrrrrrrrrrrruuuuuuuuuuuurrrrrr                                                                                                    2.6-15.fc17.art  2.6-15.fc17.art 2.6-15.fc17.art                                                                                                                                      	   	   	   	   	   	   	   	      
   
   
   
   
   
   
   
   
   
   
   
                                                                        ossec-hids ossec-hids-2.6 BUGS CONFIG INSTALL README doc README.config active-response-internal.txt active-response.txt br INSTALL.br README.config TRANSLATION active-response-internal.txt active-response.txt logs.txt manager.txt rootcheck.txt rule_ids.txt rules.txt logs.txt manage_agents.txt manager.txt nmap.txt pl INSTALL.pl README.config TRANSLATION active-response-internal.txt active-response.txt logs.txt manager.txt rootcheck.txt rule_ids.txt rules.txt rootcheck.txt rule_ids.txt rules.txt ossec active-response bin asl-shun.pl disable-account.sh firewall-drop.sh host-deny.sh ossec-tweeter.sh restart-ossec.sh route-null.sh zabbix-alert.sh agentless main.exp register_host.sh ssh.exp ssh_asa-fwsmconfig_diff ssh_foundry_diff ssh_generic_diff ssh_integrity_check_bsd ssh_integrity_check_linux ssh_nopass.exp ssh_pixconfig_diff sshlogin.exp su.exp bin ossec-configure etc shared agent.conf templates active-response.template apache-logs.template ar-disable-account.template ar-firewall-drop.template ar-host-deny.template ar-routenull.template pgsql-logs.template rootcheck.template rules.template snort-logs.template syscheck.template syslog-logs.template logs queue diff ossec var run /etc/logrotate.d/ /usr/share/doc/ /usr/share/doc/ossec-hids-2.6/ /usr/share/doc/ossec-hids-2.6/doc/ /usr/share/doc/ossec-hids-2.6/doc/br/ /usr/share/doc/ossec-hids-2.6/doc/pl/ /var/ /var/ossec/ /var/ossec/active-response/ /var/ossec/active-response/bin/ /var/ossec/agentless/ /var/ossec/bin/ /var/ossec/etc/ /var/ossec/etc/shared/ /var/ossec/etc/templates/ /var/ossec/queue/ /var/ossec/var/ -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4  -m32 -march=i686 -mtune=atom -fasynchronous-unwind-tables drpm i686-redhat-linux-gnu                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ASCII text ISO-8859 text POSIX shell script, ASCII text executable Perl script, ASCII text executable UTF-8 Unicode text a /usr/bin/env expect script, ASCII text executable directory exported SGML document, ASCII text                                                                                                                                                                                                	   
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              R  R  	R  
R  R  R  R  R  R  R  R  R  R  R  R  R  R  R  R  R  R  R  R  R     xz 2    ?       7zXZ  
 !   #,od"] "k%w!q{"}AHگ,Wax:ds c-{:Txԋb89>rW2Ɠ B+?t?^Dxl+ Ƃ?ZqqaG+K3P;8L67c@DH"̎E7w/#Դx}07#Ǚ-4TMhEVJ`Z2wRg&^#K>y*Hl{P$ɫ#IzϮuc*L?f><٣ԯ*MUF&;lVL#`F9HStRUB,<`M%GOGҧĮfr@UK!r9ʿ/4	A+fȔ0qrҜU6*᫠9U1
9,[v?uL>W$꣫/J.."@NWTRJy8Uxl
9ϦptoP5Eg(̃H)pl0q/_?0	\$mAs*eǘ5b(7f/φ,^r(zlXH$vj3F磳^yDANsN3,켻,PDnxrJ#BX= I_.QM#cl(DHc98t7ov@	YWZ:%Hj.кH<]:3/|YъI,)mʰԉ,缅VcBq3F]2=ӴAJW3.Ae}}P|@[G dES\qb *rt,IyUN~R#p \aN9J-?n}0/W^i@S*LkV+
|=п%%.X 6?վu	hl-'@[Ua<̐xi]\m7% ,TpWNKR}(ɧ3T!99d8<g=aЉ~%.G*!|6J*O2YQ\kL*YA'/IN=X5a֖
49<EgMz9fX.
ͺjFPWX:EXiuf)_l'\7YXL7[LetPyu(O3غ6׹eĈM-'Ӳf0"^˝[>ǯ$c?=wJ`4Kf[!:@C_u\EK~U6iIOԟwǍJZ%Ȟ\*c'0~vo:;5-Bo) re
7::<ZhG}6lkSU iFK>7qNiJRBy0*ӌ?be!YP&vYޖ+ )S\{ ''w=O5 cΜ[J].tVyd՟'sLr,RvyTp)ca&P!{?Yz)7w\<si&|魲+w%j1ri]-F0h<@TLgiX?Rug'Ҵy`qY4_Pw-#pIYN|TzI31?Php>wEDsI{vA6J.6f*?#i([|=}Simp*qtzL,G2 2)nEKfHމ`1|ZG<nN-f&wMyhW-Ǝ#DNֱ#e!\ADo![ۊD^bu2ݜI?X_4|0wcp宇
z4Kf ^>/M ѧLZ04O~KqC1Wҷ%4ViLnA,sےdetg,Ҙwc`0#{S@v̵%Bۓ+9]	uAi$-fxRz#⻳D!+nȺ\7-˦/g.؆)T3*ze3)uk*M+*pWe@C`;3d'TtRQ{4OI{eRMVB/0\d+NW9uh駚1yxҽ+UM;ZםuR<`:<}S*L$dJ=C1l0-R>k;ze(Uk>sQ1Ol3:.Gf[8^ԭ^7<it#5 P3zJQJ@mzbgcӍNO bU6*
JHy:R1CL[G<E=9M7[Kv9ihcG< !r}";|d"	^K'w,x9B}s$yꎇuۍT덏tD\o52SFNrq*-`+7}.[Ei/ꡣ*v~/\FI{tPa!djB#sPn(6~y?lVAE6Xȸ/"iJϙyQ1,I3$1;F0d&;	 fup6D\$m{
W%,=!d5r5dT빋u%4U-ꭷ=;ׂO3YZ	[~;81&I+Aԃw<g	k Rr[Ό)A\vA[-kuDyB<Oۮ	2Wؖ0.@rt )e{CYRDGp׏MfÁAԼTW20&WZ21Y-|	zKל<inFH/Sy#\}Vʗyt?W-mc˯3(ASK"͑w͗sNJ
wXE+s-X[QjGvR;2֜;z}ie 㨇x	Ļ+{᥽?!_KdjݾȩKi5g(T27{)6)6%r4hv@=g)af-bƲmJp'=A#c:qj+{IEQz?fiOb~-8l{_io7M48%--M2[Ou*^jΡڡZ=QVq9-o@^mTXm𪎫.*;vB`%sO'O}=OHn%zWH^E)CrNVTjwTt@cSʇQǵ#.et~2EmL`Fm+6>BZ")؍;j:AK~Tୠ]fKU$Ie8AƾYNG{9R1C%{~%޵EL7vp,H;(U
1H'Iϝ.Β%_R+F8_יA*shA{ANf{]U3oףKxS^,9jF3`[-8l;mSJ2.}:w[7Ŗ{
ۖ$e@S`	d]CfCS/niqHs$zV@`@G9WI] H俠Ї"W2i!޹1%_3}5؁o7J^#YlY(>HVW?\\1)>P+a:^禛'mS:9m,/}L#VSQ2g>4k
_NTFpMЌ!~\J
F;a~:;hSKZe>gGۣ"5J|4iUs"\T,T	'mDSRV{_hv2aC458ԏ!yȢ];58^m9}1a .l%PxD6^^\
ɤ%2!oR6]t's]:!6@CRÉrKʅꍅP#s"l۪zÇ]94J(c'kO4kjID"L&:"C?N&HP>Hr
{BqNu
2nNj#:E^FDOJ99Z&V	_iF^}&|H8eA5GFdҖ-DFgt&9o4uyߘhؼD6nQ(=2%GBZY_BA58KGκʰTM^稦Ye˔e>Xڄ?4JV ,z$daHHI#-UW>d]_(L5üyyoY椱N/MOF>I,7IUVK G@=k!q1E	']N7X{Ѯ ٝD(	d?䅎NC"\13~I wS0_zdxً510+WXp&f5cR]Xm8 vyZQ6jXb0W#J4Z"ĸy x	m\.yhJaX,tfA; `)oK)IKqV& E\9h`rnrSOBMJI./7ABѫU[~(bhIIԮ*'-썊Nm/f'Q"@
`:JgT,HkZ-M᮪+ eyYM|5߬ug(n/6G?)dQv~%,#Bf{g4407IWRDP[BP"S'yQCSE'=^Z`֗&hyu,	/""	on|V=`A. 3Ņ[ӈwN 5FصpqrȤ:)4ݑMr;3w&3lk)8@m!Eb)ThAQkϚJl"E9Z',9q6qCIVt39x6qi @~('-}.~ɰ1\tɇk.Cr<nYӲ1ފdП}̾#qIlmVbۦFc\~1&p:l1,x@hPa>Ԋ-yid4
a7HBFq`A.	ݽy݆gdُ5!"ÕxYy1tfyq,ިcK*#AI0Ղ>beJ\.<\<Xbz_M+
,[,wǞ8GnI8P?
ʓFdI
^`"
g9eA
|nh>pnztAzZLIbvj?af"+Q6v=5ӱоW*^ ;@m
$o~lҒJxMAQq5vs;"sxK$#ݟ=\NOgPr"NĽ9A#;(?:QWpHedҀfMKS<[b>(x~\n\Idhι=CN5ÏiVuVx9p]Z5c٢5)Gq|lz6us\6腣4	6ўO1ekX-	w#|%e`N1A8@@H(ulo`p8]|YZ^&lqUWVkFrG3Iz#b_̛qNήޜ
biN&1kO`_O(E?u^0zjbuu79BJdU"8vj} 8$7ӛ't^: y> Ogn0KK<Px2#֕Vp~t:^i3fAt"	8:N-6u49Jׅ`ݬ͗A5qETRҫWA(-H~ϡqSR @wUER[6g!i` i-ˢyRχbȍJj,Mβ)>U*_77<ڋnmbYO-TO%)F.RA!`eˀ[Uh'2lzpdv2ZO?ehV8"R2B¥}A&{u0ԑLLӅeeFeCqIy/G&~cqm;IBM"{Zia5kC*Sem.Lr>ΖTKTP%,ZFAil֋~bdmhyuSZr'%07ݵ≳-uW,ß09g8GO- >*c:0>30{̔0AYs׾4ZyG|RN8~!nv]K;_@ufdK,+pX]
 H(9nV,L?6;3̲I^(̍lGM:QNx*YQ&Q oǁT796oz\c疮,Sq;n$ޚւ3T</LJ,(<m<X!SpI;˻ʷCn	O+S;}Jaqr{I}<;zz¼f$]rIJp%i(DG]aIwc9U{ZSww"]f>5Kkt%_̽zڄ;e%lzeO	}ߴŞ+i R{/B8?
yS^Eccҋ܁1uNPowa^`'	&vwD6l\N3tt?Od/T<a*/\	 HiX?VpUKOO5nV5HjIFzcB~cJkO)Y/o-F}x8;t#VqӾ_pפݽJkۿ3!I-D40<em䶬>
+}C<%Ε7~7 >&;2HND+kƣ%U4LPs:9IZF $zLIh'G{xqF˲Gڽ&^>|$:Tf)!mɈ3FYi>tc)t+7tՃJZt$|'ONܓeiНlS}ƦdeNK
=$dҞ¢Q
z$3LU`y	+d 
#>9w1F[c@1~l.b<Qf{!sl\XëFhphVkL
72'e&tg0݌,^JڐN%tU*J|$R6]>qp D5@=;lMZ~lO.;B1	{Y)]ko/30SCx#Z'=OE:j@Jy.	W| ]!@JËxB1pLzosL"{Jm/FƠ;8ߐht7fN#(!Qy'1VƽEQC%0CòZTXך B@N85C4fÜF`eبVsL1mcFBs-W3щb>3DFRo&k1%RKǨdxie]:K,Ak{IQ	1@L8\2L{@ Ɏ=dG@/⥣GAַ#z׍gV`2dr^yD [epPSAg3 '-8֨|K&Z+4^Z)T.`8+:;Wc:φIs4?þ4׷kaARo'owWt&ǨHeSiLr?2h	!POS8遭R+ YhFԡB[,&VcS%}8|UM˓ǢeO%F+GBǐ6	ˑ/I y,&ikOٝrϣMB{7$#m݁/>?<Kڈ3l6p{1QVbol?'fHt.<wj26UR@.!t\e,R2&0-B:ULpپv>-Z<1v)\Xr0
uTVzd·G7jYur7f5V3<O]T %nnSnˬ
f7w4lҶ:jE_LZdCspҶIk-'h61+!V׏HP2]oS~h[:[a
zcðn~#XTo֖!ԪktkYU(-4@ȓߪH/=    >y~L̊0.K7 F .d6%    
YZ