Re: [Prelude Universal SIM system] #340: New ruleset for PPP/PPTPD/L2TP

#340: New ruleset for PPP/PPTPD/L2TP
-------------------------+--------------------------------------------------
 Reporter:  Shurick      |       Owner:  pollux            
     Type:  enhancement  |      Status:  assigned          
 Priority:  normal       |   Milestone:  Prelude-LML 0.9.15
Component:  prelude-lml  |     Version:  0.9               
 Severity:  normal       |    Keywords:                    
-------------------------+--------------------------------------------------
Changes (by pollux):

  * owner:  => pollux
  * status:  new => assigned


Comment:

 Overall looks good, just a few comments:

  * The line preceding the rule should use the following format:
 {{{
 #LOG: Dec  4 23:01:36 beorc ppp[24796]: tun2: Phase: Chap Input: RESPONSE
 (49 bytes from afonyashin)
 }}}
 instead of
 {{{
 #Dec  4 23:01:36 beorc ppp[24796]: tun2: Phase: Chap Input: RESPONSE (49
 bytes from afonyashin)
 }}}
 This allows automated tools to run tests (and check that signature really
 matches the line)

  * in rule 2, you have the following:
 {{{
  assessment.impact.completion=succeeded; \
  assessment.impact.description=Authenticated successfully; \
 }}}
 This is redundant. You should use something like 'Authentication attempt'
 in description, the completion will tell the result by itself

  * not all your rules have an 'id' field

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/340#comment:1>
Prelude Universal SIM system <http://www.prelude-ids.com>
Prelude Universal SIM system
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel