<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>[blog.rayfoo] &#187; audit trail</title>
	<atom:link href="http://blog.rayfoo.info/tag/audit-trail/feed" rel="self" type="application/rss+xml" />
	<link>http://blog.rayfoo.info</link>
	<description>Here&#039;s where I write stuff, and you read what I wrote.</description>
	<lastBuildDate>Fri, 30 Jul 2010 04:30:47 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=abc</generator>
		<item>
		<title>SSH brute force connection attempts #fail</title>
		<link>http://blog.rayfoo.info/2009/10/ssh-brute-force-connection-attempts-fail</link>
		<comments>http://blog.rayfoo.info/2009/10/ssh-brute-force-connection-attempts-fail#comments</comments>
		<pubDate>Tue, 20 Oct 2009 02:18:17 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[audit trail]]></category>
		<category><![CDATA[blacklist]]></category>
		<category><![CDATA[brute forcing]]></category>
		<category><![CDATA[fail]]></category>
		<category><![CDATA[hardening]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[SSH]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=273</guid>
		<description><![CDATA[Collected these over the past few months, reverse chronological order. Seeing different machines attempting to connect hundreds of times a day each is just, wow. Some might say that a SSH blacklist daemon might help, but it only increases the time taken for a brute force attempt, and is of no use against a botnet [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2009/10/ssh-brute-force-connection-attempts-fail/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Monitoring WordPress using syslog and OSSEC</title>
		<link>http://blog.rayfoo.info/2009/10/monitoring-wordpress-using-syslog-and-ossec</link>
		<comments>http://blog.rayfoo.info/2009/10/monitoring-wordpress-using-syslog-and-ossec#comments</comments>
		<pubDate>Tue, 06 Oct 2009 16:35:58 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[audit trail]]></category>
		<category><![CDATA[OSSEC]]></category>
		<category><![CDATA[plugin]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[syslog]]></category>
		<category><![CDATA[web application]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=202</guid>
		<description><![CDATA[This has got to be one of the unconventional (yet interesting) ideas I&#8217;ve come across. It involves the use of a plugin (currently maintained at OSSEC) to get WordPress to send syslog events for OSSEC to parse.  It is a good idea since it is good to monitor any web applications running for anomalies, but [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2009/10/monitoring-wordpress-using-syslog-and-ossec/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
