diff --git a/CHANGES b/CHANGES index c47d9a0c0f..e04b3b91d9 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ +2.6-161 | 2019-03-15 12:59:31 -0700 + + * Fix SSH remote_location geo-data not being logged for successful authNs. (Michael Dopheide) + 2.6-159 | 2019-03-14 16:39:52 -0700 * Move NEWS file back into main repo from zeek-docs (Jon Siwek, Corelight) diff --git a/VERSION b/VERSION index 00eef08f17..b7ffe7a8c7 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.6-159 +2.6-161 diff --git a/scripts/policy/protocols/ssh/geo-data.bro b/scripts/policy/protocols/ssh/geo-data.bro index c8f73b6ac7..af9e05f011 100644 --- a/scripts/policy/protocols/ssh/geo-data.bro +++ b/scripts/policy/protocols/ssh/geo-data.bro @@ -35,8 +35,8 @@ event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=3 if ( ! c$ssh?$direction ) return; - # Add the location data to the SSH record. - c$ssh$remote_location = get_location(c); + if ( ! c$ssh?$remote_location ) + return; if ( c$ssh$remote_location?$country_code && c$ssh$remote_location$country_code in watched_countries ) { @@ -48,7 +48,7 @@ event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=3 } } -event ssh_auth_failed(c: connection) &priority=3 +event ssh_auth_attempted(c: connection, authenticated: bool) &priority=3 { if ( ! c$ssh?$direction ) return;