Merge branch 'ssh-parser'

[people/stevee/guardian.git] / modules / Parser.pm

diff --git a/modules/Parser.pm b/modules/Parser.pm
index 9c3fc87130204d8bbb674a4afdb7eecb2c0041d2..4f03bf958064598ff5e9a38974f6ea46805bb713 100644 (file)
--- a/modules/Parser.pm
+++ b/modules/Parser.pm
@@ -10,6 +10,7 @@ our @EXPORT_OK = qw(IsSupportedParser Parser);
 # has to be called to parse messages in the right way.
 my %logfile_parsers = (
        "snort" => \&message_parser_snort,
+       "ssh" => \&message_parser_ssh,
 );
 
 #
@@ -30,8 +31,14 @@ sub Parser ($$) {
        # Call responsible message parser.
        my $action = $logfile_parsers{$parser}->(@message);
 
-       # Return which action should be performed.
-       return "count $action";
+       # In case an action has been returned, return it too. 
+       if (defined($action)) {
+               # Return which action should be performed.
+               return "count $action";
+       }
+
+       # Return undef, no action required.
+       return undef;
 }
 
 #
@@ -71,4 +78,55 @@ sub message_parser_snort($) {
        return "$message[0] SNORT A simple Snort Message";
 }
 
+#
+## The SSH message parser.
+#
+## This subfunction is used for parsing and detecting different attacks
+## against the SSH service.
+#
+sub message_parser_ssh (@) {
+       my @message = @_;
+
+       # The name of the parser module.
+       my $name = "SSH";
+
+       # Variable to store the grabbed IP-address.
+       my $address;
+
+       # Variable to store the parsed event.
+       my $message;
+
+       # Loop through all lines, in case multiple one have
+       # been passed.
+       foreach my $line (@message) {
+               # Check for failed password attempts.
+               if ($line =~/.*sshd.*Failed password for (.*) from (.*) port.*/) {
+                       # Store the grabbed IP-address.
+                       $address = $2;
+
+                       # Set event message.
+                       $message = "Possible SSH-Bruteforce Attack for user: $1.";
+               }
+
+               # This should catch Bruteforce Attacks with enabled preauth
+               elsif ($line =~ /.*sshd.*Received disconnect from (.*):.*\[preauth\]/) {
+                       # Store obtained IP-address.
+                       $address = $1;
+
+                       # Set event message.
+                       $message = "Possible SSH-Bruteforce Attack - failed preauth.";
+               }
+       }
+
+       # Check if at least the IP-address information has been extracted.
+       if (defined ($address)) {
+               # Return the extracted values and event message.
+               return "$address $name $message";
+       }
+
+       # If we got here, the provided message is not affected by any filter and
+       # therefore can be skipped. Return nothing (False) in this case.
+       return;
+}
+
 1;