mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 07:38:19 +00:00
f79b5adc08
I replaced a few strcmps with either calls to std::str.compare or with the == operator of BroString. Also changed two of the input framework tests that did not pass anymore after the merge. The new SSH analyzer no longer loads the scripts that let network time run, hence those tests failed because updates were not propagated from the threads (that took a while to find.) * origin/topic/vladg/ssh: (25 commits) SSH: Register analyzer for 22/tcp. SSH: Add 22/tcp to likely_server_ports SSH: Ignore encrypted packets by default. SSH: Fix some edge-cases which created BinPAC exceptions SSH: Add memleak btest SSH: Update baselines SSH: Added some more events for SSH2 SSH: Intel framework integration (PUBKEY_HASH) Update baselines for new SSH analyzer. Update SSH policy scripts with new events. SSH: Add documentation Refactoring ssh-protocol.pac: SSH: Use the compression_algorithms const in another place. Some cleanup and refactoring on SSH main.bro. SSH: A bit of code cleanup. Move SSH constants to consts.pac SSH: Cleanup code style. SSH: Fix some memleaks. Refactored the SSH analyzer. Added supported for algorithm detection and more key exchange message types. Add host key support for SSH1. Add support for SSH1 Move SSH analyzer to new plugin architecture. ... Conflicts: scripts/base/protocols/ssh/main.bro testing/btest/Baseline/core.print-bpf-filters/output2 testing/btest/Baseline/plugins.hooks/output BIT-1344: #merged
90 lines
3.1 KiB
Text
90 lines
3.1 KiB
Text
##! Detect hosts which are doing password guessing attacks and/or password
|
|
##! bruteforcing over SSH.
|
|
|
|
@load base/protocols/ssh
|
|
@load base/frameworks/sumstats
|
|
@load base/frameworks/notice
|
|
@load base/frameworks/intel
|
|
|
|
module SSH;
|
|
|
|
export {
|
|
redef enum Notice::Type += {
|
|
## Indicates that a host has been identified as crossing the
|
|
## :bro:id:`SSH::password_guesses_limit` threshold with
|
|
## failed logins.
|
|
Password_Guessing,
|
|
## Indicates that a host previously identified as a "password
|
|
## guesser" has now had a successful login
|
|
## attempt. This is not currently implemented.
|
|
Login_By_Password_Guesser,
|
|
};
|
|
|
|
redef enum Intel::Where += {
|
|
## An indicator of the login for the intel framework.
|
|
SSH::SUCCESSFUL_LOGIN,
|
|
};
|
|
|
|
## The number of failed SSH connections before a host is designated as
|
|
## guessing passwords.
|
|
const password_guesses_limit: double = 30 &redef;
|
|
|
|
## The amount of time to remember presumed non-successful logins to
|
|
## build a model of a password guesser.
|
|
const guessing_timeout = 30 mins &redef;
|
|
|
|
## This value can be used to exclude hosts or entire networks from being
|
|
## tracked as potential "guessers". The index represents
|
|
## client subnets and the yield value represents server subnets.
|
|
const ignore_guessers: table[subnet] of subnet &redef;
|
|
}
|
|
|
|
event bro_init()
|
|
{
|
|
local r1: SumStats::Reducer = [$stream="ssh.login.failure", $apply=set(SumStats::SUM, SumStats::SAMPLE), $num_samples=5];
|
|
SumStats::create([$name="detect-ssh-bruteforcing",
|
|
$epoch=guessing_timeout,
|
|
$reducers=set(r1),
|
|
$threshold_val(key: SumStats::Key, result: SumStats::Result) =
|
|
{
|
|
return result["ssh.login.failure"]$sum;
|
|
},
|
|
$threshold=password_guesses_limit,
|
|
$threshold_crossed(key: SumStats::Key, result: SumStats::Result) =
|
|
{
|
|
local r = result["ssh.login.failure"];
|
|
local sub_msg = fmt("Sampled servers: ");
|
|
local samples = r$samples;
|
|
for ( i in samples )
|
|
{
|
|
if ( samples[i]?$str )
|
|
sub_msg = fmt("%s%s %s", sub_msg, i==0 ? "":",", samples[i]$str);
|
|
}
|
|
# Generate the notice.
|
|
NOTICE([$note=Password_Guessing,
|
|
$msg=fmt("%s appears to be guessing SSH passwords (seen in %d connections).", key$host, r$num),
|
|
$sub=sub_msg,
|
|
$src=key$host,
|
|
$identifier=cat(key$host)]);
|
|
}]);
|
|
}
|
|
|
|
event SSH::ssh_auth_successful(c: connection, auth_method_none: bool)
|
|
{
|
|
local id = c$id;
|
|
|
|
Intel::seen([$host=id$orig_h,
|
|
$conn=c,
|
|
$where=SSH::SUCCESSFUL_LOGIN]);
|
|
}
|
|
|
|
event SSH::ssh_auth_failed(c: connection)
|
|
{
|
|
local id = c$id;
|
|
|
|
# Add data to the FAILED_LOGIN metric unless this connection should
|
|
# be ignored.
|
|
if ( ! (id$orig_h in ignore_guessers &&
|
|
id$resp_h in ignore_guessers[id$orig_h]) )
|
|
SumStats::observe("ssh.login.failure", [$host=id$orig_h], [$str=cat(id$resp_h)]);
|
|
}
|