Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/jazoff/ticket-1670'

Browse source 
BIT-1670 #merged

* origin/topic/jazoff/ticket-1670:
  Ensure that the notice uid field is filled in.
  Move lookup_addr when statement
This commit is contained in:
Robin Sommer 2016-09-27 11:38:08 -07:00
commit a87083233e
1 changed files with 16 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

27
scripts/policy/protocols/ssh/interesting-hostnames.bro
View file

@ -27,21 +27,26 @@ export {
/^ftp[0-9]*\./ &redef;
}
event ssh_auth_successful(c: connection, auth_method_none: bool)
function check_ssh_hostname(id: conn_id, uid: string, host: addr)
{
for ( host in set(c$id$orig_h, c$id$resp_h) )
when ( local hostname = lookup_addr(host) )
{
when ( local hostname = lookup_addr(host) )
if ( interesting_hostnames in hostname )
{
if ( interesting_hostnames in hostname )
{
NOTICE([$note=Interesting_Hostname_Login,
$msg=fmt("Possible SSH login involving a %s %s with an interesting hostname.",
Site::is_local_addr(host) ? "local" : "remote",
host == c$id$orig_h ? "client" : "server"),
$sub=hostname, $conn=c]);
}
NOTICE([$note=Interesting_Hostname_Login,
$msg=fmt("Possible SSH login involving a %s %s with an interesting hostname.",
Site::is_local_addr(host) ? "local" : "remote",
host == id$orig_h ? "client" : "server"),
$sub=hostname, $id=id, $uid=uid]);
}
}
}
event ssh_auth_successful(c: connection, auth_method_none: bool)
{
for ( host in set(c$id$orig_h, c$id$resp_h) )
{
check_ssh_hostname(c$id, c$uid, host);
}
}