Ossec rule fore detecting full mailboxes

Requests for RPMS, or new coding projects related to server administration, Plesk, security, or anything else you can think of.
biggles
Forum Regular
Forum Regular
Posts: 806
Joined: Tue Jul 15, 2008 2:38 pm
Location: Sweden
Contact:

Ossec rule fore detecting full mailboxes

Unread post by biggles »

When a users mailbox is full I would like to get an ossec notification. One way of noticing it is by checkg for the following message in the maillog:

Code: Select all

qmail-local-handlers[29736]: cannot reinject message to 'username@customerdomain.se'
For me this would be a great ASL enhancement.

PS I guess I could just write a local rule for it, but there are probably others who could benefit from this...
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: Ossec rule fore detecting full mailboxes

Unread post by scott »

Great idea, I added that to the list
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: Ossec rule fore detecting full mailboxes

Unread post by mikeshinn »

PS I guess I could just write a local rule for it, but there are probably others who could benefit from this...
BTW, this reminds me, we're interested in what you guys think we can do encourage and support community contributions, such as ossec rules, modsec rules, etc.
BruceLee
Forum Regular
Forum Regular
Posts: 879
Joined: Sat Mar 28, 2009 6:58 pm
Location: Germany

Re: Ossec rule fore detecting full mailboxes

Unread post by BruceLee »

Hopefully I understand your invitation correct.
I don't know if it's useful or not, if it's a good addition or not, or if ASL covers all of it (I think it does cover all security related things)...but mentioning it does not hurt: http://www.greensql.net
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: Ossec rule fore detecting full mailboxes

Unread post by scott »

We actually added that one to the list back in 1.0 days :P
Post Reply