# @(#) $Id: hot-ids.bro,v 1.6 2003/05/22 22:47:15 vern Exp $ (LBL)

# If these ids are seen, the corresponding connection is terminated.
const forbidden_ids = {
	"uucp", "daemon", "rewt", "nuucp",
	"EZsetup", "OutOfBox", "4Dgifts",
	"ezsetup", "outofbox", "4dgifts", "sgiweb",
} &redef;

const forbidden_ids_if_no_password = { "lp" } &redef;

const forbidden_id_patterns = /(y[o0]u)(r|ar[e3])([o0]wn.*)/ &redef;

const always_hot_ids = { "lp", "demos", forbidden_ids, } &redef;

# The ones here that aren't in always_hot_ids are only hot upon
# success.
const hot_ids = {
	"root", "system", "smtp", "sysadm", "diag", "sysdiag", "sundiag",
	"sysop", "sysoper",
	always_hot_ids,
} &redef;
