From: Stefan Schantl <stefan.schantl@ipfire.org>
Date: Mon, 27 Jun 2016 10:38:36 +0000 (+0200)
Subject: Introduce message parser for owncloud.
X-Git-Tag: 2.0^2
X-Git-Url: http://git.ipfire.org/?p=people%2Fstevee%2Fguardian.git;a=commitdiff_plain;h=7306aaf8a461398a7bd8a802a4aac434737ec64e

Introduce message parser for owncloud.

This message parser is able to detect brute-force
login attempts against a local running owncloud
instance.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---

diff --git a/modules/Parser.pm b/modules/Parser.pm
index e50cef7..1a6471a 100644
--- a/modules/Parser.pm
+++ b/modules/Parser.pm
@@ -10,6 +10,7 @@ our @EXPORT_OK = qw(IsSupportedParser Parser);
 # has to be called to parse messages in the right way.
 my %logfile_parsers = (
 	"httpd" => \&message_parser_httpd,
+	"owncloud" => \&message_parser_owncloud,
 	"snort" => \&message_parser_snort,
 	"ssh" => \&message_parser_ssh,
 );
@@ -277,4 +278,55 @@ sub message_parser_httpd (@) {
 	return;
 }
 
+#
+## The Owncloud message parser.
+#
+## This subfunction is used for parsing and detecting brute-force login
+## attempts against a local running owncloud instance.
+#
+sub message_parser_owncloud (@) {
+	my @message = @_;
+	my @actions;
+
+	# The name of the parser module.
+	my $name = "Owncloud";
+
+	# Variable to store the grabbed IP-address.
+	my $address;
+
+	# Variable to store the parsed event.
+	my $message;
+
+	# Loop through all lines, in case multiple one have
+	# been passed.
+	foreach my $line (@message) {
+		 # This will catch brute-force attacks against the login (username).
+		if ($line =~/.*\"Login failed: \'(.*)\' \(Remote IP: \'(.*)\'\,.*/) {
+			# Store the grabbed user name.
+			my $user = $1;
+
+			# Store the grabbed IP-address.
+			$address = $2;
+
+			# Set event message.
+			$message = "Possible brute-force attack, wrong password for user: $user.";
+		}
+
+		# Check if at least the IP-address information has been extracted.
+		if (defined ($address)) {
+			# Add the extracted values and event message to the actions array.
+			push(@actions, "count $address $name $message");
+		}
+	}
+
+	# If any actions are required, return the array.
+	if (@actions) {
+		return @actions;
+	}
+
+	# If we got here, the provided message is not affected by any filter and
+	# therefore can be skipped. Return nothing (False) in this case.
+	return;
+}
+
 1;