On Wed, Oct 19, 2016 at 8:43 AM, dan (ddp) <ddp...@gmail.com> wrote:
> On Tue, Oct 18, 2016 at 6:54 PM, Aj Navarro <ajnavarro1...@gmail.com> wrote:
>> Only I see the next messages in /var/ossec/logs/alers/alerts.log
>>
>> ** Alert 1476724188.107242: mail - syslog,errors,
>>
>> 2016 Oct 17 12:09:48 ixtrtc42scf->/var/log/messages
>>
>> Rule: 1002 (level 2) -> 'Unknown problem somewhere in the system.'
>>
>> Oct 17 12:09:48 ixtrtc42scf kernel: type=1100
>> audit(1476724188.016:36149378): user pid=6141 uid=0 auid=4294967295
>> ses=4294967295 msg=
>>
>> 'op=PAM:authentication acct="root" exe="/usr/sbin/sshd"
>> hostname=10.188.62.176 addr=10.188.62.176 terminal=ssh res=failed'
>>
>
> These log messages are not triggering 5712. In fact OSSEC isn't sure
> what to do with these log messages.
> Is there anything in your auth log?
>
Digging into it further, we get:
# cat /tmp/yy | /var/ossec/bin/ossec-logtest -q
2016/10/19 08:44:09 ossec-testrule: INFO: Reading the lists file:
'rules/lists/ossec.block'
2016/10/19 08:44:09 ossec-testrule: INFO: Started (pid: 16098).
ossec-testrule: Type one log per line.
**Phase 1: Completed pre-decoding.
full event: 'Oct 17 12:09:48 ixtrtc42scf kernel: type=1100
audit(1476724188.016:36149378): user pid=6141 uid=0 auid=4294967295
ses=4294967295 msg='op=PAM:authentication acct="root"
exe="/usr/sbin/sshd" hostname=10.188.62.176 addr=10.188.62.176
terminal=ssh res=failed''
hostname: 'ixtrtc42scf'
program_name: 'kernel'
log: 'type=1100 audit(1476724188.016:36149378): user pid=6141
uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication
acct="root" exe="/usr/sbin/sshd" hostname=10.188.62.176
addr=10.188.62.176 terminal=ssh res=failed''
**Phase 2: Completed decoding.
decoder: 'iptables'
**Phase 3: Completed filtering (rules).
Rule id: '1002'
Level: '2'
Description: 'Unknown problem somewhere in the system.'
**Alert to be generated.
So we'll have to create a decoder to deal with these odd log messages.
Adding the following decoder to my local decoders file:
<decoder name="wtf-iptables">
<parent>iptables</parent>
<prematch> exe="/usr/sbin/sshd" </prematch>
<!--<regex> acct="(\S+)" hostname="(\S+)" addr="(\S+)" </regex>-->
<regex> acct="(\S+)" exe="/\.+/sshd" hostname=(\S+) addr=(\S+) </regex>
<order>user,dstip, srcip</order>
</decoder>
I get:
**Phase 1: Completed pre-decoding.
full event: 'Oct 17 12:09:48 ixtrtc42scf kernel: type=1100
audit(1476724188.016:36149378): user pid=6141 uid=0 auid=4294967295
ses=4294967295 msg='op=PAM:authentication acct="root"
exe="/usr/sbin/sshd" hostname=10.188.62.176 addr=10.188.62.176
terminal=ssh res=failed''
hostname: 'ixtrtc42scf'
program_name: 'kernel'
log: 'type=1100 audit(1476724188.016:36149378): user pid=6141
uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication
acct="root" exe="/usr/sbin/sshd" hostname=10.188.62.176
addr=10.188.62.176 terminal=ssh res=failed''
**Phase 2: Completed decoding.
decoder: 'iptables'
dstuser: 'root'
dstip: '10.188.62.176'
srcip: '10.188.62.176'
**Phase 3: Completed filtering (rules).
Rule id: '1002'
Level: '2'
Description: 'Unknown problem somewhere in the system.'
**Alert to be generated.
I haven't done any testing to see if this will affect anything else though.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
