Merge pull request #1840 from ddpbsd/unbound

Unbound DNSSEC failure rules

Author: atomicturtle

etc/ossec.conf

@@ -33,6 +33,7 @@
     <include>opensmtpd_rules.xml</include>
     <include>openbsd-dhcpd_rules.xml</include>
     <include>nsd_rules.xml</include>
+    <include>unbound_rules.xml</include>
   </rules>  
 
   <syscheck>

etc/rules/unbound_rules.xml

@@ -50,4 +50,16 @@
     <description>Maybe critical URL requested</description>
   </rule>
 
+  <rule id="53774" level="0">
+    <if_sid>53760</if_sid>
+    <match>info: validation failure</match>
+    <description>DNSSEC validation failure</description>
+  </rule>
+
+  <rule id="53775" level="1">
+    <if_sid>53774</if_sid>
+    <match>no keys have a DS with algorithm</match>
+    <description>Algorithm mismatch.</description>
+  </rule>
+
 </group>

etc/templates/config/rules.template

@@ -66,5 +66,6 @@
     <include>openbsd-dhcpd_rules.xml</include>
     <include>dnsmasq_rules.xml</include>
     <include>nsd_rules.xml</include>
+    <include>unbound_rules.xml</include>
     <include>local_rules.xml</include>
   </rules>