611.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule:

--
Sid: 611

--
Summary: 
This event is generated when a remote login attempt using rlogin fails.

--
Impact: 
Someone has tried to login using rlogin and failed

-- 
Detailed Information: 
This rule generates an event when a login failure message generated by rlogind is seen. rlogin is used on UNIX systems for remote connectivity and remote command execution.  

Multiple events may indicate that an attacker is attempting a brute force password guessing attack.

--
Attack Scenarios: 
An attacker finds a machine with rlogin service running and proceeds to guess the password remotely by connecting multiple times.

--
Ease of Attack: 
Simple, no exploit software required

--
False Positives: 
A legitimate user may generate an event by entering an incorrect password.

--
False Negatives:
None Known

--
Corrective Action: 
Investigate logs on the target host for further details and more signs of suspicious activity

Use ssh for remote access instead of rlogin.

--
Contributors: 
Original rule by Max Vision <[e-mail]> modified from a signature written by Ron Gula
Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
Sourcefire Research Team
Nigel Houghton <[e-mail]>

-- 
Additional References:

CVE:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0651

Arachnids:
http://www.whitehats.com/info/IDS392

--