Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Honor no plaintext password logging for PASS cmd

Browse source
This commit is contained in:
Martin van Hensbergen 2024-09-19 16:55:44 +02:00 • committed by Arne Welzel
parent 989730c241
commit 0e926afbc1
11 changed files with 84 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/base/protocols/ftp/main.zeek
View file

@ -169,9 +169,15 @@ function set_ftp_session(c: connection)
}
}
function should_hide_password(s: Info) : bool
{
return ! s$capture_password && to_lower(s$user) !in guest_ids;
}
function ftp_message(c: connection)
{
if ( ! c?$ftp ) return;
local password_hidden_string = "<hidden>";
local s: Info = c$ftp;
s$ts=s$cmdarg$ts;
s$command=s$cmdarg$cmd;
@ -193,16 +199,15 @@ function ftp_message(c: connection)
s$reply_msg = s$reply_msg[:max_reply_msg_length];
}
# In case of logging PASS command, the password will appear in arg column and might need hiding
if ( s$command == "PASS" && should_hide_password(s))
s$arg = password_hidden_string;
if ( s$arg == "" )
delete s$arg;
if ( s?$password &&
! s$capture_password &&
to_lower(s$user) !in guest_ids )
{
s$password = "<hidden>";
}
if ( s?$password && should_hide_password(s))
s$password = password_hidden_string;
if ( s?$cmdarg && s$command in logged_commands)
Log::write(FTP::LOG, s);