101 lines
3.8 KiB
YAML
101 lines
3.8 KiB
YAML
onsuccess: next_stage
|
|
#debug: true
|
|
filter: "evt.Parsed.program == 'sshd'"
|
|
name: crowdsecurity/sshd-logs
|
|
description: "Parse openSSH logs"
|
|
pattern_syntax:
|
|
# The IP grok pattern that ships with crowdsec is buggy and does not capture the last digit of an IP if it is the last thing it matches, and the last octet starts with a 2
|
|
# https://github.com/crowdsecurity/crowdsec/issues/938
|
|
IPv4_WORKAROUND: (?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
|
|
IP_WORKAROUND: (?:%{IPV6}|%{IPv4_WORKAROUND})
|
|
SSHD_AUTH_FAIL: 'pam_%{DATA:pam_type}\(sshd:auth\): authentication failure; logname= uid=%{NUMBER:uid}? euid=%{NUMBER:euid}? tty=ssh ruser= rhost=%{IP_WORKAROUND:sshd_client_ip}( %{SPACE}user=%{USERNAME:sshd_invalid_user})?'
|
|
SSHD_MAGIC_VALUE_FAILED: 'Magic value check failed \(\d+\) on obfuscated handshake from %{IP_WORKAROUND:sshd_client_ip} port \d+'
|
|
SSHD_INVALID_USER: 'Invalid user\s*%{USERNAME:sshd_invalid_user}? from %{IP_WORKAROUND:sshd_client_ip}( port \d+)?'
|
|
SSHD_INVALID_BANNER: 'banner exchange: Connection from %{IP_WORKAROUND:sshd_client_ip} port \d+: invalid format'
|
|
SSHD_PREAUTH_AUTHENTICATING_USER: 'Connection closed by (authenticating|invalid) user %{USERNAME:sshd_invalid_user} %{IP_WORKAROUND:sshd_client_ip} port \d+ \[preauth\]'
|
|
#following: https://github.com/crowdsecurity/crowdsec/issues/1201 - some scanners behave differently and trigger this one
|
|
SSHD_PREAUTH_AUTHENTICATING_USER_ALT: 'Disconnected from (authenticating|invalid) user %{USERNAME:sshd_invalid_user} %{IP_WORKAROUND:sshd_client_ip} port \d+ \[preauth\]'
|
|
SSHD_BAD_KEY_NEGOTIATION: 'Unable to negotiate with %{IP_WORKAROUND:sshd_client_ip} port \d+: no matching (host key type|key exchange method) found.'
|
|
nodes:
|
|
- grok:
|
|
name: "SSHD_FAIL"
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: ssh_failed-auth
|
|
- meta: target_user
|
|
expression: "evt.Parsed.sshd_invalid_user"
|
|
- grok:
|
|
name: "SSHD_PREAUTH_AUTHENTICATING_USER_ALT"
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: ssh_failed-auth
|
|
- meta: target_user
|
|
expression: "evt.Parsed.sshd_invalid_user"
|
|
- grok:
|
|
name: "SSHD_PREAUTH_AUTHENTICATING_USER"
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: ssh_failed-auth
|
|
- meta: target_user
|
|
expression: "evt.Parsed.sshd_invalid_user"
|
|
- grok:
|
|
name: "SSHD_DISC_PREAUTH"
|
|
apply_on: message
|
|
- grok:
|
|
name: "SSHD_BAD_VERSION"
|
|
apply_on: message
|
|
- grok:
|
|
name: "SSHD_INVALID_USER"
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: ssh_failed-auth
|
|
- meta: target_user
|
|
expression: "evt.Parsed.sshd_invalid_user"
|
|
- grok:
|
|
name: "SSHD_INVALID_BANNER"
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: ssh_failed-auth
|
|
- meta: extra_log_type
|
|
value: ssh_bad_banner
|
|
- grok:
|
|
name: "SSHD_USER_FAIL"
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: ssh_failed-auth
|
|
- meta: target_user
|
|
expression: "evt.Parsed.sshd_invalid_user"
|
|
- grok:
|
|
name: "SSHD_AUTH_FAIL"
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: ssh_failed-auth
|
|
- meta: target_user
|
|
expression: "evt.Parsed.sshd_invalid_user"
|
|
- grok:
|
|
name: "SSHD_MAGIC_VALUE_FAILED"
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: ssh_failed-auth
|
|
- meta: target_user
|
|
expression: "evt.Parsed.sshd_invalid_user"
|
|
- grok:
|
|
name: "SSHD_BAD_KEY_NEGOTIATION"
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: ssh_bad_keyexchange
|
|
statics:
|
|
- meta: service
|
|
value: ssh
|
|
- meta: source_ip
|
|
expression: "evt.Parsed.sshd_client_ip"
|