9282aab
diff -Nru src/file-server.c src/file-server.c
9282aab
--- ./src/file-server.c	2016-09-15 08:49:20.170000884 +0200
9282aab
+++ ./src/file-server.c	2017-01-28 18:18:06.634761198 +0100
9282aab
@@ -346,6 +346,9 @@
9282aab
         ssize_t ret;
9282aab
         struct stat st;
9282aab
 
9282aab
+	if ( config.dry_run )
9282aab
+		return 0;
9282aab
+
9282aab
         if ( fstat(fileno(monitor->metadata_fd), &st) < 0 ) {
9282aab
                 prelude_log(PRELUDE_LOG_WARN, "fstat failed : %s.\n", strerror(errno));
9282aab
                 return -1;
9282aab
@@ -416,6 +419,9 @@
9282aab
         off_t offset = 0, available = 65535;
9282aab
         unsigned char msum[METADATA_SIZE], *sumptr = msum;
9282aab
 
9282aab
+	if ( config.dry_run )
9282aab
+		return 0;
9282aab
+
9282aab
         filename = lml_log_source_get_name(monitor->source);
9282aab
 
9282aab
         ret = file_metadata_read(monitor, &offset, &sumptr);
9282aab
@@ -477,6 +483,9 @@
9282aab
         int fd;
9282aab
         char file[PATH_MAX], path[PATH_MAX], *ptr;
9282aab
 
9282aab
+	if ( config.dry_run )
9282aab
+		return 0;
9282aab
+
9282aab
         strncpy(file, lml_log_source_get_name(monitor->source), sizeof(file));
9282aab
 
9282aab
         while ( (ptr = strchr(file, '/')) )
9282aab
diff -Nru src/prelude-lml.c src/prelude-lml.c
9282aab
--- ./src/prelude-lml.c	2016-09-15 08:49:20.171000884 +0200
9282aab
+++ ./src/prelude-lml.c	2017-01-28 18:19:25.373006781 +0100
9282aab
@@ -361,6 +361,7 @@
9282aab
         ev_timer evt;
9282aab
         struct timeval end;
9282aab
         struct sigaction action;
9282aab
+	const char *env;
9282aab
 
9282aab
         /*
9282aab
          * Initialize libev.
9282aab
@@ -389,7 +390,11 @@
9282aab
         if ( ret < 0 )
9282aab
                 return ret;
9282aab
 
9282aab
-        ret = log_plugins_init(LOG_PLUGIN_DIR, lml_root_optlist);
9282aab
+	env = getenv("PRELUDE_LML_PLUGIN_DIR");
9282aab
+	if ( !env )
9282aab
+		env = LOG_PLUGIN_DIR;
9282aab
+
9282aab
+        ret = log_plugins_init(env, lml_root_optlist);
9282aab
         if (ret < 0)
9282aab
                 return ret;
9282aab
 
9282aab
diff -Nru src/regex.c src/regex.c
9282aab
--- ./src/regex.c	2016-09-15 08:49:20.172000884 +0200
9282aab
+++ ./src/regex.c	2017-01-28 18:17:45.931222693 +0100
9282aab
@@ -156,16 +156,20 @@
9282aab
         FILE *fd;
9282aab
         size_t len;
9282aab
         char buf[1024];
9282aab
-        const char *errptr;
9282aab
+        const char *errptr, *env;
9282aab
         int line = 0, erroff;
9282aab
         regex_table_item_t *rt;
9282aab
         pcre_extra *regex_regex_extra = NULL;
9282aab
         char *regex, *options, *source, *plugin;
9282aab
         pcre *regex_regex = NULL, *source_regex = NULL;
9282aab
 
9282aab
-        fd = fopen(REGEX_CONF, "r");
9282aab
+	env = getenv("PRELUDE_LML_REGEX_CONF");
9282aab
+	if ( !env )
9282aab
+		env = REGEX_CONF;
9282aab
+
9282aab
+        fd = fopen(env, "r");
9282aab
         if ( ! fd ) {
9282aab
-                prelude_log(PRELUDE_LOG_ERR, "couldn't open config file %s.\n", REGEX_CONF);
9282aab
+                prelude_log(PRELUDE_LOG_ERR, "couldn't open config file %s.\n", env);
9282aab
                 return -1;
9282aab
         }
9282aab
 
9282aab
diff -Nru tests/Makefile.in tests/Makefile.in
9282aab
--- ./tests/Makefile.in	2016-09-15 09:03:00.925000884 +0200
9282aab
+++ ./tests/Makefile.in	2017-01-28 18:22:00.268558881 +0100
9282aab
@@ -1362,7 +1362,10 @@
9282aab
 	cd $(top_srcdir)/prelude-lml && make
9282aab
 
9282aab
 check-am:
9282aab
-	$(srcdir)/loggrep.py $(top_srcdir)/plugins/pcre/ruleset/*.rules | $(top_srcdir)/src/prelude-lml --quiet --dry-run --metadata=nowrite,head --batch-mode --no-resolve --pcre --dump-unmatched --config $(srcdir)/prelude-lml.conf 2>&1 | $(GREP) -Fvf $(srcdir)/ignored
9282aab
+	rm -rf plugins && mkdir plugins
9282aab
+	cp $(top_srcdir)/plugins/*/.libs/*.so plugins
9282aab
+	./loggrep.py regex.test | PRELUDE_LML_PLUGIN_DIR=plugins PRELUDE_LML_REGEX_CONF=plugins.rules $(top_srcdir)/src/prelude-lml --quiet --dry-run --metadata=nowrite,head --batch-mode --no-resolve --pcre --dump-unmatched --config $(srcdir)/prelude-lml.conf 2>&1 | $(GREP) -Fvf $(srcdir)/ignored
9282aab
+	rm -rf plugins
9282aab
 
9282aab
 -include $(top_srcdir)/git.mk
9282aab
 
9282aab
diff -Nru tests/plugins.rules tests/plugins.rules
9282aab
--- ./tests/plugins.rules	1970-01-01 01:00:00.000000000 +0100
9282aab
+++ ./tests/plugins.rules	2017-01-28 18:20:24.857682680 +0100
9282aab
@@ -0,0 +1 @@
9282aab
+  * 		Pcre		-			*
9282aab
diff -Nru tests/prelude-lml.conf tests/prelude-lml.conf
9282aab
--- ./tests/prelude-lml.conf	2016-09-15 08:49:20.172000884 +0200
9282aab
+++ ./tests/prelude-lml.conf	2017-01-28 18:20:30.037567378 +0100
9282aab
@@ -3,51 +3,5 @@
9282aab
 prefix-regex = "^(?P<timestamp>.{15}) (?P<hostname>\S+) (?:(?P<process>\S+?)(?:\[(?P<pid>[0-9]+)\])?: )?"
9282aab
 file = -
9282aab
 
9282aab
-[format=apache]
9282aab
-time-format = "%d/%b/%Y:%H:%M:%S"
9282aab
-prefix-regex = "(?P<hostname>\S+) \S+ \S+ \[(?P<timestamp>.{20}) [+-].{4}\] "
9282aab
-file = -
9282aab
-
9282aab
-[format=apache-error]
9282aab
-#[Sat Mar 12 22:56:12 2005] [error] [client 127.0.0.1]
9282aab
-time-format = "%a %b %d %H:%M:%S %Y"
9282aab
-prefix-regex = "^\[(?P<timestamp>.{24})\]"
9282aab
-file = -
9282aab
-
9282aab
-[format=checkpoint]
9282aab
-time-format = "%d%b%Y %H:%M:%S"
9282aab
-prefix-regex = "^(?P<timestamp>.{20})"
9282aab
-file = -
9282aab
-
9282aab
-[format=squid]
9282aab
-#2005/11/28 06:00:44|
9282aab
-time-format = "%Y/%m/%d %H:%M:%S"
9282aab
-prefix-regex = "^(?P<timestamp>.{19})\| "
9282aab
-file = -
9282aab
-
9282aab
-[format=honeyd]
9282aab
-#2006-08-18-12:21:12.1239
9282aab
-time-format = "%Y-%m-%d-%H:%M:%S"
9282aab
-prefix-regex = "^(?P<timestamp>.{19})\."
9282aab
-file = -
9282aab
-
9282aab
-[format=honeytrap]
9282aab
-#[2007-05-26 16:48:09]
9282aab
-time-format = "%Y-%m-%d %H:%M:%S"
9282aab
-prefix-regex = "^\[(?P<timestamp>.{19})\]"
9282aab
-file = -
9282aab
-
9282aab
-[format=kojoney]
9282aab
-#2007/04/12 21:57 CEST
9282aab
-time-format = "%Y/%m/%d %H:%M"
9282aab
-prefix-regex = "^(?P<timestamp>.{16}) "
9282aab
-file = -
9282aab
-
9282aab
-[format=rishi]
9282aab
-#2007-05-20 12:49:57,644
9282aab
-time-format = "%Y-%m-%d %H:%M:%S"
9282aab
-prefix-regex = "^(?P<timestamp>.{19}),"
9282aab
-file = -
9282aab
-
9282aab
 [Pcre]
9282aab
-ruleset=../plugins/pcre/ruleset/pcre.rules
9282aab
+ruleset=./regex.test
9282aab
diff -Nru tests/regex.test tests/regex.test
9282aab
--- ./tests/regex.test	1970-01-01 01:00:00.000000000 +0100
9282aab
+++ ./tests/regex.test	2017-01-28 18:20:17.921837067 +0100
9282aab
@@ -0,0 +1,340 @@
9282aab
+#FULLNAME: SSH
9282aab
+#VERSION: 1.0
9282aab
+#DESCRIPTION: SSH, is a cryptographic (encrypted) network protocol to allow remote login and other network services to operate securely over an unsecured network.
9282aab
+
9282aab
+#####
9282aab
+#
9282aab
+# Copyright (C) 2002,2004 Nicolas Delon <nicolas@prelude-siem.org>
9282aab
+# Copyright (C) 2005 G Ramon Gomez <gene at gomezbrothers dot com>
9282aab
+# All Rights Reserved
9282aab
+#
9282aab
+# This program is free software; you can redistribute it and/or modify
9282aab
+# it under the terms of the GNU General Public License as published by
9282aab
+# the Free Software Foundation; either version 2, or (at your option)
9282aab
+# any later version.
9282aab
+#
9282aab
+# This program is distributed in the hope that it will be useful,
9282aab
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
9282aab
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
9282aab
+# GNU General Public License for more details.
9282aab
+#
9282aab
+# You should have received a copy of the GNU General Public License along
9282aab
+# with this program; if not, write to the Free Software Foundation, Inc.,
9282aab
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
9282aab
+#
9282aab
+#####
9282aab
+
9282aab
+###################
9282aab
+# Logging succeed #
9282aab
+###################
9282aab
+
9282aab
+#LOG:Dec  8 14:45:17 itguxweb1 sshd[32112]: Accepted publickey for root from 12.34.56.78 port 56634 ssh2
9282aab
+regex=for root from|user root; \
9282aab
+ id=1907; \
9282aab
+ assessment.impact.type=admin; \
9282aab
+ assessment.impact.severity=medium; \
9282aab
+ silent; chained
9282aab
+
9282aab
+#LOG:Dec  8 14:45:17 itguxweb1 sshd[32112]: Accepted publickey for root from 12.34.56.78 port 56634 ssh2
9282aab
+#LOG:Jan 14 03:30:44 mail sshd[20298]: Accepted publickey for root from fec0:0:201::3 port 63018 ssh2
9282aab
+#LOG:Jan 14 03:30:44 mail sshd[20298]: Accepted publickey for john from fec0:0:201::3 port 63018 ssh2
9282aab
+#LOG:Dec 10 10:33:19 itguxweb2 sshd[29738]: Accepted password for ekwong from 12.34.56.78 port 39852 ssh2
9282aab
+regex=Accepted (\S+) for (\S+) from (\S+) port (\d+); \
9282aab
+ classification.text=Remote Login; \
9282aab
+ optgoto=1907; \
9282aab
+ id=1908; \
9282aab
+ revision=3; \
9282aab
+ analyzer(0).name=sshd; \
9282aab
+ analyzer(0).manufacturer=OpenSSH; \
9282aab
+ analyzer(0).class=Authentication; \
9282aab
+ assessment.impact.severity=low; \
9282aab
+ assessment.impact.completion=succeeded; \
9282aab
+ assessment.impact.type=user; \
9282aab
+ assessment.impact.description=User $2 logged in from $3 port $4 using the $1 method; \
9282aab
+ source(0).node.address(0).address=$3; \
9282aab
+ source(0).service.port=$4; \
9282aab
+ source(0).service.iana_protocol_name=tcp; \
9282aab
+ source(0).service.iana_protocol_number=6; \
9282aab
+ target(0).service.port=22; \
9282aab
+ target(0).service.name=ssh; \
9282aab
+ target(0).service.iana_protocol_name=tcp; \
9282aab
+ target(0).service.iana_protocol_number=6; \
9282aab
+ target(0).user.category=os-device; \
9282aab
+ target(0).user.user_id(0).type=target-user; \
9282aab
+ target(0).user.user_id(0).name=$2; \
9282aab
+ additional_data(0).type=string; \
9282aab
+ additional_data(0).meaning=Authentication method; \
9282aab
+ additional_data(0).data=$1; \
9282aab
+ last;
9282aab
+
9282aab
+
9282aab
+################
9282aab
+# Login failed #
9282aab
+################
9282aab
+
9282aab
+#LOG:Dec  9 16:00:35 itguxweb2 sshd[24541]: Failed password for root from 12.34.56.78 port 1806
9282aab
+#LOG:Dec  9 21:29:56 devel5 sshd[17554]: Failed password for akarade from 12.34.56.78 port 4214
9282aab
+regex=Failed (\S+) for (\S+) from (\S+) port (\d+); \
9282aab
+ optgoto=1907; \
9282aab
+ classification.text=Remote Login; \
9282aab
+ id=1902; \
9282aab
+ revision=3; \
9282aab
+ analyzer(0).name=sshd; \
9282aab
+ analyzer(0).manufacturer=OpenSSH; \
9282aab
+ analyzer(0).class=Authentication; \
9282aab
+ assessment.impact.severity=medium; \
9282aab
+ assessment.impact.completion=failed; \
9282aab
+ assessment.impact.type=user; \
9282aab
+ assessment.impact.description=Someone tried to login as $2 from $3 port $4 using the $1 method; \
9282aab
+ source(0).node.address(0).address=$3; \
9282aab
+ source(0).service.port=$4; \
9282aab
+ source(0).service.iana_protocol_name=tcp; \
9282aab
+ source(0).service.iana_protocol_number=6; \
9282aab
+ target(0).service.port=22; \
9282aab
+ target(0).service.name=ssh; \
9282aab
+ target(0).service.iana_protocol_name=tcp; \
9282aab
+ target(0).service.iana_protocol_number=6; \
9282aab
+ target(0).user.category=os-device; \
9282aab
+ target(0).user.user_id(0).type=target-user; \
9282aab
+ target(0).user.user_id(0).name=$2; \
9282aab
+ additional_data(0).type=string; \
9282aab
+ additional_data(0).meaning=Authentication method; \
9282aab
+ additional_data(0).data=$1; \
9282aab
+ last
9282aab
+
9282aab
+
9282aab
+##############################################
9282aab
+# Invalid (not existing) user tried to login #
9282aab
+##############################################
9282aab
+
9282aab
+#LOG:Jan 20 14:10:02 blah sshd[25443]: Invalid user admin from 213.201.222.134
9282aab
+regex=(Illegal|Invalid) user (\S+) from (\S+); \
9282aab
+ classification.text=User login failed with an invalid user; \
9282aab
+ id=1904; \
9282aab
+ revision=2; \
9282aab
+ analyzer(0).name=sshd; \
9282aab
+ analyzer(0).manufacturer=OpenSSH; \
9282aab
+ analyzer(0).class=Authentication; \
9282aab
+ assessment.impact.severity=medium; \
9282aab
+ assessment.impact.completion=failed; \
9282aab
+ assessment.impact.type=user; \
9282aab
+ assessment.impact.description=Someone tried to login with the invalid user "$2" from $3; \
9282aab
+ source(0).node.address(0).address=$3; \
9282aab
+ source(0).service.iana_protocol_name=tcp; \
9282aab
+ source(0).service.iana_protocol_number=6; \
9282aab
+ target(0).service.port=22; \
9282aab
+ target(0).service.name=ssh; \
9282aab
+ target(0).service.iana_protocol_name=tcp; \
9282aab
+ target(0).service.iana_protocol_number=6; \
9282aab
+ target(0).user.category=os-device; \
9282aab
+ target(0).user.user_id(0).type=target-user; \
9282aab
+ target(0).user.user_id(0).name=$2; \
9282aab
+ last
9282aab
+
9282aab
+##################################################################################
9282aab
+# User listed in DenyGroups or DenyUsers (sshd_config directives) tried to login #
9282aab
+##################################################################################
9282aab
+
9282aab
+#LOG:Jan  6 22:50:24 localhost sshd[15489]: User nobody not allowed because none of user's groups are listed in AllowGroups
9282aab
+regex=User (\S+) not allowed because (.*)listed in (\w+); \
9282aab
+ classification.text=User login failed with a denied user; \
9282aab
+ id=1905; \
9282aab
+ revision=3; \
9282aab
+ analyzer(0).name=sshd; \
9282aab
+ analyzer(0).manufacturer=OpenSSH; \
9282aab
+ analyzer(0).class=Authentication; \
9282aab
+ assessment.impact.severity=medium; \
9282aab
+ assessment.impact.completion=failed; \
9282aab
+ assessment.impact.type=user; \
9282aab
+ assessment.impact.description=User $1 failed to login because $2 listed in $3; \
9282aab
+ source(0).service.iana_protocol_name=tcp; \
9282aab
+ source(0).service.iana_protocol_number=6; \
9282aab
+ target(0).service.port=22; \
9282aab
+ target(0).service.name=ssh; \
9282aab
+ target(0).service.iana_protocol_name=tcp; \
9282aab
+ target(0).service.iana_protocol_number=6; \
9282aab
+ target(0).user.category=os-device; \
9282aab
+ target(0).user.user_id(0).type=target-user; \
9282aab
+ target(0).user.user_id(0).name=$1; \
9282aab
+ additional_data(0).type=string; \
9282aab
+ additional_data(0).meaning=ACL; \
9282aab
+ additional_data(0).data=$3; \
9282aab
+ additional_data(1).type=string; \
9282aab
+ additional_data(1).meaning=Failure reason; \
9282aab
+ additional_data(1).data=$2 listed in $3; \
9282aab
+ last
9282aab
+
9282aab
+##################################################################
9282aab
+# Sshd did not receive the identification string from the client #
9282aab
+# (maybe a ssh server recognition)                               #
9282aab
+##################################################################
9282aab
+
9282aab
+#LOG:Jun 10 09:51:57 server sshd[9100]: Did not receive identification string from 1.2.3.4
9282aab
+regex=Did not receive identification string from (\S+); \
9282aab
+ classification.text=Server recognition; \
9282aab
+ id=1906; \
9282aab
+ revision=2; \
9282aab
+ analyzer(0).name=sshd; \
9282aab
+ analyzer(0).manufacturer=OpenSSH; \
9282aab
+ analyzer(0).class=Authentication; \
9282aab
+ assessment.impact.severity=medium; \
9282aab
+ assessment.impact.completion=failed; \
9282aab
+ assessment.impact.type=recon; \
9282aab
+ assessment.impact.description=$1 is probably making a server recognition; \
9282aab
+ source(0).node.address(0).address=$1; \
9282aab
+ source(0).service.iana_protocol_name=tcp; \
9282aab
+ source(0).service.iana_protocol_number=6; \
9282aab
+ target(0).service.port=22; \
9282aab
+ target(0).service.name=ssh; \
9282aab
+ target(0).service.iana_protocol_name=tcp; \
9282aab
+ target(0).service.iana_protocol_number=6; \
9282aab
+ additional_data(0).type=string; \
9282aab
+ additional_data(0).meaning=Failure reason; \
9282aab
+ additional_data(0).data=Did not receive identification string; \
9282aab
+ last
9282aab
+
9282aab
+#########################################################################
9282aab
+# Forbidden root login                                                  #
9282aab
+# (directive PermitRootLogin and keyword "no" or "forced-commands-only" #
9282aab
+# of the sshd_config file)                                              #
9282aab
+#########################################################################
9282aab
+
9282aab
+#LOG:Jan  5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM 1.2.3.4
9282aab
+regex=ROOT LOGIN REFUSED FROM (\S+); \
9282aab
+ classification.text=Admin login; \
9282aab
+ id=1909; \
9282aab
+ revision=2; \
9282aab
+ analyzer(0).name=sshd; \
9282aab
+ analyzer(0).manufacturer=OpenSSH; \
9282aab
+ analyzer(0).class=Authentication; \
9282aab
+ assessment.impact.severity=medium; \
9282aab
+ assessment.impact.completion=failed; \
9282aab
+ assessment.impact.type=admin; \
9282aab
+ assessment.impact.description=Root tried to login while it is forbidden; \
9282aab
+ source(0).node.address(0).address=$1; \
9282aab
+ source(0).service.iana_protocol_name=tcp; \
9282aab
+ source(0).service.iana_protocol_number=6; \
9282aab
+ target(0).service.port=22; \
9282aab
+ target(0).service.name=ssh; \
9282aab
+ target(0).service.iana_protocol_name=tcp; \
9282aab
+ target(0).service.iana_protocol_number=6; \
9282aab
+ target(0).user.category=os-device; \
9282aab
+ target(0).user.user_id(0).type=target-user; \
9282aab
+ target(0).user.user_id(0).name=root; \
9282aab
+ last
9282aab
+
9282aab
+
9282aab
+# Re: Generic Message Exchange Authentication For SSH
9282aab
+#               <draft-ietf-secsh-auth-kbdinteract-06.txt>
9282aab
+#LOG:Jan 14 08:19:21 ras sshd[22774]: input_userauth_request: invalid user remote-mail
9282aab
+regex=input_userauth_request: (illegal|invalid) user (\S+); \
9282aab
+ classification.text=Invalid user in authentication request; \
9282aab
+ id=1910; \
9282aab
+ revision=3; \
9282aab
+ analyzer(0).name=sshd; \
9282aab
+ analyzer(0).manufacturer=OpenSSH; \
9282aab
+ analyzer(0).class=Authentication; \
9282aab
+ assessment.impact.severity=medium; \
9282aab
+ assessment.impact.completion=failed; \
9282aab
+ assessment.impact.type=user; \
9282aab
+ assessment.impact.description=General purpose authentication request was blocked. Reason: invalid user $2; \
9282aab
+ source(0).service.iana_protocol_name=tcp; \
9282aab
+ source(0).service.iana_protocol_number=6; \
9282aab
+ target(0).service.port=22; \
9282aab
+ target(0).service.name=ssh; \
9282aab
+ target(0).service.iana_protocol_name=tcp; \
9282aab
+ target(0).service.iana_protocol_number=6; \
9282aab
+ target(0).user.category=os-device; \
9282aab
+ target(0).user.user_id(0).type=target-user; \
9282aab
+ target(0).user.user_id(0).name=$2; \
9282aab
+ additional_data(0).type=string; \
9282aab
+ additional_data(0).meaning=Failure reason; \
9282aab
+ additional_data(0).data=$1 user; \
9282aab
+ last
9282aab
+
9282aab
+# Re: Generic Message Exchange Authentication For SSH
9282aab
+#               <draft-ietf-secsh-auth-kbdinteract-06.txt>
9282aab
+# This rule catches several other combinations that can be output by
9282aab
+# input_userauth_request() in auth2.c
9282aab
+#LOG:Jan 14 08:19:21 ras sshd[22774]: input_userauth_request: invalid user remote-mail
9282aab
+regex=input_userauth_request: (.+); \
9282aab
+ classification.text=Invalid user in authentication request; \
9282aab
+ id=1911; \
9282aab
+ revision=2; \
9282aab
+ analyzer(0).name=sshd; \
9282aab
+ analyzer(0).manufacturer=OpenSSH; \
9282aab
+ analyzer(0).class=Authentication; \
9282aab
+ assessment.impact.severity=medium; \
9282aab
+ assessment.impact.completion=failed; \
9282aab
+ assessment.impact.type=user; \
9282aab
+ assessment.impact.description=General purpose authentication request was blocked. Reason: $1; \
9282aab
+ source(0).service.iana_protocol_name=tcp; \
9282aab
+ source(0).service.iana_protocol_number=6; \
9282aab
+ target(0).service.port=22; \
9282aab
+ target(0).service.name=ssh; \
9282aab
+ target(0).service.iana_protocol_name=tcp; \
9282aab
+ target(0).service.iana_protocol_number=6; \
9282aab
+ target(0).user.category=os-device; \
9282aab
+ last
9282aab
+
9282aab
+#LOG:Dec  9 18:48:29 itguxweb2 sshd[29536]: Failed password for illegal user ROOT from 12.34.56.78 port 2886
9282aab
+#LOG:Jan 14 08:19:21 ras sshd[22774]: Failed none for invalid user remote-mail from 192.168.1.22 port 65407 ssh2
9282aab
+#LOG:Jan 14 11:29:17 ras sshd[18163]: Failed publickey for invalid user fred from fec0:0:201::3 port 62788 ssh2
9282aab
+#LOG:Jan 14 11:29:17 ras sshd[18163]: Failed publickey for invalid user fred from 1.2.3.4 port 62788 ssh2
9282aab
+#LOG:Jan 14 11:29:17 ras sshd[18163]: Failed publickey for invalid user fred from hostname port 62788 ssh2
9282aab
+regex=Failed (\S+) for (illegal|invalid) user (\S+) from (\S+) port (\d+); \
9282aab
+ classification.text=Remote Login; \
9282aab
+ optgoto=1907; \
9282aab
+ id=1912; \
9282aab
+ revision=3; \
9282aab
+ analyzer(0).name=sshd; \
9282aab
+ analyzer(0).manufacturer=OpenSSH; \
9282aab
+ analyzer(0).class=Authentication; \
9282aab
+ assessment.impact.severity=medium; \
9282aab
+ assessment.impact.completion=failed; \
9282aab
+ assessment.impact.type=admin; \
9282aab
+ assessment.impact.description=Someone tried to login as $3 from $4 port $5 using the $1 method; \
9282aab
+ source(0).node.address(0).address=$4; \
9282aab
+ source(0).service.port=$5; \
9282aab
+ source(0).service.iana_protocol_name=tcp; \
9282aab
+ source(0).service.iana_protocol_number=6; \
9282aab
+ target(0).service.port=22; \
9282aab
+ target(0).service.name=ssh; \
9282aab
+ target(0).service.iana_protocol_name=tcp; \
9282aab
+ target(0).service.iana_protocol_number=6; \
9282aab
+ target(0).user.category=os-device; \
9282aab
+ target(0).user.user_id(0).type=target-user; \
9282aab
+ target(0).user.user_id(0).name=$3; \
9282aab
+ additional_data(0).type=string; \
9282aab
+ additional_data(0).meaning=Authentication method; \
9282aab
+ additional_data(0).data=$1; \
9282aab
+ additional_data(1).type=string; \
9282aab
+ additional_data(1).meaning=Failure reason; \
9282aab
+ additional_data(1).data=$2 user; \
9282aab
+ last
9282aab
+
9282aab
+#LOG:Oct  2 14:40:05 suse-9.2 sshd[18725]: error: PAM: Authentication failure for root from unknown.anywhere.net
9282aab
+#LOG:Oct  2 14:46:52 suse-9.2 sshd[18804]: error: PAM: Authentication failure for foobar from unknown.anywhere.net
9282aab
+regex=error: PAM: Authentication failure for (\S+) from (\S+); \
9282aab
+ classification.text=Remote Login; \
9282aab
+ optgoto=1907; \
9282aab
+ id=1914; \
9282aab
+ revision=2; \
9282aab
+ analyzer(0).name=sshd; \
9282aab
+ analyzer(0).manufacturer=OpenSSH; \
9282aab
+ analyzer(0).class=Authentication; \
9282aab
+ assessment.impact.severity=medium; \
9282aab
+ assessment.impact.completion=failed; \
9282aab
+ assessment.impact.type=user; \
9282aab
+ assessment.impact.description=Someone tried to login as $1 from $2; \
9282aab
+ source(0).node.name=$2; \
9282aab
+ source(0).service.iana_protocol_name=tcp; \
9282aab
+ source(0).service.iana_protocol_number=6; \
9282aab
+ target(0).service.port=22; \
9282aab
+ target(0).service.name=ssh; \
9282aab
+ target(0).service.iana_protocol_name=tcp; \
9282aab
+ target(0).service.iana_protocol_number=6; \
9282aab
+ target(0).user.category=os-device; \
9282aab
+ target(0).user.user_id(0).type=target-user; \
9282aab
+ target(0).user.user_id(0).name=$1; \
9282aab
+ last