# This hash contains all supported parsers and which function
# has to be called to parse messages in the right way.
my %logfile_parsers = (
+ "httpd" => \&message_parser_httpd,
"snort" => \&message_parser_snort,
+ "ssh" => \&message_parser_ssh,
);
#
}
# Call responsible message parser.
- my $action = $logfile_parsers{$parser}->(@message);
+ my @actions = $logfile_parsers{$parser}->(@message);
- # If the parser successfully parsed the message, an action
- # has been returned.
- if ($action) {
- # Return which action should be performed.
- return "count $action";
+ # In case an action has been returned, return it too.
+ if (@actions) {
+ # Return which actions should be performed.
+ return @actions;
}
- # If the parser was not able to parse the the given message
- # in the right way, return Nothing.
- return;
+ # Return undef, if no actions are required.
+ return undef;
}
#
return;
}
+#
+## The SSH message parser.
+#
+## This subfunction is used for parsing and detecting different attacks
+## against the SSH service.
+#
+sub message_parser_ssh (@) {
+ my @message = @_;
+ my @actions;
+
+ # The name of the parser module.
+ my $name = "SSH";
+
+ # Variable to store the grabbed IP-address.
+ my $address;
+
+ # Variable to store the parsed event.
+ my $message;
+
+ # Loop through all lines, in case multiple one have
+ # been passed.
+ foreach my $line (@message) {
+ # Check for failed password attempts.
+ if ($line =~/.*sshd.*Failed password for (.*) from (.*) port.*/) {
+ # Store the grabbed IP-address.
+ $address = $2;
+
+ # Set event message.
+ $message = "Possible SSH-Bruteforce Attack for user: $1.";
+ }
+
+ # This should catch Bruteforce Attacks with enabled preauth
+ elsif ($line =~ /.*sshd.*Received disconnect from (.*):.*\[preauth\]/) {
+ # Store obtained IP-address.
+ $address = $1;
+
+ # Set event message.
+ $message = "Possible SSH-Bruteforce Attack - failed preauth.";
+ }
+
+ # Check if at least the IP-address information has been extracted.
+ if (defined ($address)) {
+ # Add the extracted values and event message for the computed
+ # event to the actions array.
+ push(@actions, "count $address $name $message");
+ }
+ }
+
+ # If any actions are required, return the array.
+ if (@actions) {
+ return (@actions);
+ }
+
+ # If we got here, the provided message is not affected by any filter and
+ # therefore can be skipped. Return nothing (False) in this case.
+ return;
+}
+
+#
+## The HTTPD message parser.
+#
+## This subfunction is used for parsing and detecting different attacks
+## against a running HTTPD service.
+#
+sub message_parser_httpd (@) {
+ my @message = @_;
+ my @actions;
+
+ # The name of the parser module.
+ my $name = "HTTPD";
+
+ # Variable to store the grabbed IP-address.
+ my $address;
+
+ # Variable to store the parsed event.
+ my $message;
+
+ # Loop through all lines, in case multiple one have
+ # been passed.
+ foreach my $line (@message) {
+ # This will catch brute-force attacks against htaccess logins (username).
+ if ($line =~ /.*\[error\] \[client (.*)\] user(.*) not found:.*/) {
+ # Store the grabbed IP-address.
+ $address = $1;
+
+ # Set event message.
+ $message = "Possible WUI brute-force attack, wrong user: $2.";
+ }
+
+ # Detect htaccess password brute-forcing against a username.
+ elsif ($line =~ /.*\[error\] \[client (.*)\] user(.*): authentication failure for.*/) {
+ # Store the extracted IP-address.
+ $address = $1;
+
+ # Set event message.
+ $message = "Possible WUI brute-force attack, wrong password for user: $2.";
+ }
+
+ # Check if at least the IP-address information has been extracted.
+ if (defined ($address)) {
+ # Add the extracted values and event message to the actions array.
+ push(@actions, "count $address $name $message");
+ }
+ }
+
+ # If any actions are required, return the array.
+ if (@actions) {
+ return @actions;
+ }
+
+ # If we got here, the provided message is not affected by any filter and
+ # therefore can be skipped. Return nothing (False) in this case.
+ return;
+}
+
1;