deluser rule and decoder
fix to segfault introduced by ar-fix-resourceleaks
Merge pull request #85 from ChristianBeer/hotfix-ar-fix-resourceleaks

fix to segfault introduced by pull request #81
Merge branch 'openbsd-adduser'
These decoders were experimental, and never worked well. They're now
horrifically out of date. Let's not give people false hope.
Merge pull request #86 from ddpbsd/master

OpenBSD deluser rule and remove bro-ids garbage
Fix comment in win32/ui/common.c
Merge pull request #87 from awiddersheim/patch-1

Fix comment in win32/ui/common.c
Fix a paste-o and close the description tag in the OpenBSD deluser rule. Reported on github pull request #86 by aquerubin
Merge remote-tracking branch 'ddpbsd/master'
it's amazing I manage to get anything working.
fix problem with umlaut in date string when pre-decoding the log message

only works for German months!
Fix the client status exit code to reflect the status of the ossec client processes.
Fix win32 OS detection

This starts to add support for 2012. Change the log message to be
more flexible with what it spits back out to the user after the
checkVista() function is run.

Although this helps with 2012 detection it is not perfect. With the
addition of Windows 8.1/2012 R2 the documentation provided by
Microsoft indicates that the GetVersionEx APIs have been deprecated.
This means that if you are on an 8.1 machine and run GetVersionEx it
will return the Windows 8 version (6.2.0.0). In order to get the
correct version you must target your application for Windows 8.1.

I am just trying to fix installations on 2012 and 2012 R2 so this
code works well enough for now but should be revisited at some point
so that it will work with future Windows versions.
Add to .gitignore

Added temporary vim files and left over files from patches being run.
Remove annoying win32ui dialog box

If you close the win32ui, the win32ui is running with Administrative
privileges, everything to run the win32 agent is configured and the
Agent service is not running a dialog box will pop informing the user
the service is not running and ask them if they would like to start it.

This to me is an annoyance more than anything. It is likely the user
went into the win32ui to stop the service to begin with and knows it is
stopped.
Add better version handling to win32ui

The delimiter of just '-' (no spaces) was not as strict as it could
be making adding things like releases to the version file, 2.7.1-1
for example not possible. This makes the delimiter " - " (with spaces)
which allows for that type of flexibility.
Add install date to win32ui

This adds the install date to the lower right status area in the
win32ui. It also gets rid of the sizegrip that was getting added
by the status data area. It gave the impression that the window
could be resized which it can't. It also took up space in the
status area.
Fix win32 setup log message

When installing the win32 agent it does a call to checkVista() which
logs a message. The problem is no name is set so (null) is placed
where the executable name should be. This sets the name so that
the executable name is displayed instead of (null).
Fix permissions and privilege detection

When using the win32ui to change the server IP or import the
authentication key the permissions on ossec.conf and client.keys
were not set correctly resulting in any system user being able to
read the contents of these files.

This brought on some additional problems where the win32ui was unable
to properly detect if it was running with Administrative privileges.
The previous logic would attempt to read/write a .test file in the
OSSEC directory but thanks to a mixture of UAC redirection, an
unsigned binary and not requiring Administrative privileges these
tests would always pass. That means the win32ui would be able to run
without Administrative privileges.

This solution still isn't the best. It would be better if proper
win32 APIs were used to set permissions and determine if the win32ui
was started with the proper privileges. This is just an iterim
solution to get something out the door.