X-Git-Url: http://git.ipfire.org/?p=people%2Fstevee%2Fguardian.git;a=blobdiff_plain;f=modules%2FParser.pm;h=4f03bf958064598ff5e9a38974f6ea46805bb713;hp=13715e004dcd7fe5d8115e6d492c463b8fe32dc7;hb=7587e837c071ac35993b942e1786deca87abdc51;hpb=8fba3c57f5fc7d782a1846f7187b370cd18bfbb8

diff --git a/modules/Parser.pm b/modules/Parser.pm
index 13715e0..4f03bf9 100644
--- a/modules/Parser.pm
+++ b/modules/Parser.pm
@@ -10,6 +10,7 @@ our @EXPORT_OK = qw(IsSupportedParser Parser);
 # has to be called to parse messages in the right way.
 my %logfile_parsers = (
 	"snort" => \&message_parser_snort,
+	"ssh" => \&message_parser_ssh,
 );
 
 #
@@ -77,4 +78,55 @@ sub message_parser_snort($) {
 	return "$message[0] SNORT A simple Snort Message";
 }
 
+#
+## The SSH message parser.
+#
+## This subfunction is used for parsing and detecting different attacks
+## against the SSH service.
+#
+sub message_parser_ssh (@) {
+	my @message = @_;
+
+	# The name of the parser module.
+	my $name = "SSH";
+
+	# Variable to store the grabbed IP-address.
+	my $address;
+
+	# Variable to store the parsed event.
+	my $message;
+
+	# Loop through all lines, in case multiple one have
+	# been passed.
+	foreach my $line (@message) {
+		# Check for failed password attempts.
+		if ($line =~/.*sshd.*Failed password for (.*) from (.*) port.*/) {
+			# Store the grabbed IP-address.
+			$address = $2;
+
+			# Set event message.
+			$message = "Possible SSH-Bruteforce Attack for user: $1.";
+		}
+
+		# This should catch Bruteforce Attacks with enabled preauth
+		elsif ($line =~ /.*sshd.*Received disconnect from (.*):.*\[preauth\]/) {
+			# Store obtained IP-address.
+			$address = $1;
+
+			# Set event message.
+			$message = "Possible SSH-Bruteforce Attack - failed preauth.";
+		}
+	}
+
+	# Check if at least the IP-address information has been extracted.
+	if (defined ($address)) {
+		# Return the extracted values and event message.
+		return "$address $name $message";
+	}
+
+	# If we got here, the provided message is not affected by any filter and
+	# therefore can be skipped. Return nothing (False) in this case.
+	return;
+}
+
 1;