guardian: Add support to watch for brute-force attempts on owncloud.

diff --git a/config/guardian/guardian b/config/guardian/guardian
index bfede37955e0cb4de7aef47d2c6605bf427af7e4..e9eb5fb99081865252767dcb653bd07d8037dcc5 100644 (file)
--- a/config/guardian/guardian
+++ b/config/guardian/guardian
@@ -54,11 +54,13 @@ my $guardianctrl = "/usr/local/bin/guardianctrl";
 my $enable_snort = "true";
 my $enable_ssh = "true";
 my $enable_httpd = "true";
+my $enable_owncloud = "false";
 
 # Watched files.
 my $syslogfile = "/var/log/messages";
 my $alert_file = "/var/log/snort.alert";
 my $httpdlog_file = "/var/log/httpd/error_log";
+my $owncloudlog_file = "/var/owncloud/data/owncloud.log";
 
 # Variable to store if the red interface is active and in use.
 my $red_active;
@@ -230,6 +232,9 @@ while () {
                elsif ("$changed_file" eq "$httpdlog_file") {
                        &handle_httpd("$message");
                }
+               elsif ("$changed_file" eq "$owncloudlog_file") {
+                       &handle_owncloud("$message");
+               }
 
                # Drop processed event from queue.
                $queue->dequeue();
@@ -304,6 +309,18 @@ sub handle_httpd ($) {
        }
 }
 
+#
+### Function to detect Owncloud Login-Bruteforce Attacks.
+#
+sub handle_owncloud ($) {
+       my $message = @_[0];
+
+       # Check for failed login attempts.
+       if ($message =~/.*\"Login failed:.* \(Remote IP: \'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\'.*/) {
+               &checkaction ($1, "Possible Owncloud-Bruteforce Attack.");
+       }
+}
+
 #
 ## Function to create inotify tasks for each monitored file.
 #
@@ -555,6 +572,11 @@ sub load_conf {
                        $httpdlog_file = $1;
                }
 
+               # Get path to owncloud logfile.
+               if (/OwncloudLogFile\s+(.*)/) {
+                       $owncloudlog_file = $1;
+               }
+
                # Read-in path to the ignorefile.
                if (/IgnoreFile\s+(.*)/) {
                        $ignorefile = $1;
@@ -590,6 +612,10 @@ sub load_conf {
                if (/EnableHTTPDMonitoring\s+(.*)/) {
                        $enable_httpd = $1;
                }
+               # Owncloud - Brute force attacks.
+               if (/EnableOwncloudMonitoring\s+(.*)/) {
+                       $enable_owncloud = $1;
+               }
        }
 
        # Validate input.
@@ -659,6 +685,11 @@ sub generate_monitored_files {
                push(@files, $httpdlog_file);
        }
 
+       # Add owncloud logfile if the monitoring should be enabled.
+       if ($enable_owncloud eq "true" or $enable_owncloud eq "on") {
+               push(@files, $owncloudlog_file);
+       }
+
        # Check for and drop non existing files.
        foreach my $file (@files) {
                # Check if given file exist.