Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

SSH&FTP Documentation updates.

Browse source 
Closes #732
This commit is contained in:
Seth Hall 2012-01-08 01:16:40 -05:00
parent 1afe8b011c
commit 48ed922e06
10 changed files with 85 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/policy/protocols/ssh/detect-bruteforcing.bro
View file

@ -1,3 +1,5 @@
##! Detect hosts which are doing password guessing attacks and/or password
##! bruteforcing over SSH.
@load base/protocols/ssh
@load base/frameworks/metrics
@ -13,13 +15,13 @@ export {
## determined failed logins.
Password_Guessing,
## Indicates that a host previously identified as a "password guesser"
## has now had a heuristically successful login attempt.
## has now had a heuristically successful login attempt. This is not
## currently implemented.
Login_By_Password_Guesser,
};
redef enum Metrics::ID += {
## This metric is to measure failed logins with the hope of detecting
## bruteforcing hosts.
## Metric is to measure failed logins.
FAILED_LOGIN,
};
@ -37,7 +39,7 @@ export {
## client subnets and the yield value represents server subnets.
const ignore_guessers: table[subnet] of subnet &redef;
## Keeps track of hosts identified as guessing passwords.
## Tracks hosts identified as guessing passwords.
global password_guessers: set[addr]
&read_expire=guessing_timeout+1hr &synchronized &redef;
}

7
scripts/policy/protocols/ssh/geo-data.bro
View file

@ -1,5 +1,4 @@
##! This implements all of the additional information and geodata detections
##! for SSH analysis.
##! Geodata based detections for SSH analysis.
@load base/frameworks/notice
@load base/protocols/ssh
@ -19,8 +18,8 @@ export {
remote_location: geo_location &log &optional;
};
## The set of countries for which you'd like to throw notices upon
## successful login
## The set of countries for which you'd like to generate notices upon
## successful login.
const watched_countries: set[string] = {"RO"} &redef;
}

2
scripts/policy/protocols/ssh/interesting-hostnames.bro
View file

@ -10,7 +10,7 @@ module SSH;
export {
redef enum Notice::Type += {
## Generated if a login originates or responds with a host and the
## Generated if a login originates or responds with a host where the
## reverse hostname lookup resolves to a name matched by the
## :bro:id:`SSH::interesting_hostnames` regular expression.
Interesting_Hostname_Login,

4
scripts/policy/protocols/ssh/software.bro
View file

@ -1,4 +1,4 @@
##! This script extracts SSH client and server information from SSH
##! Extracts SSH client and server information from SSH
##! connections and forwards it to the software framework.
@load base/frameworks/software
@ -7,7 +7,9 @@ module SSH;
export {
redef enum Software::Type += {
## Identifier for SSH clients in the software framework.
SERVER,
## Identifier for SSH servers in the software framework.
CLIENT,
};
}