Hi Daniel

GridFTP protocol & its Globus implementation is used in US TeraGrid 
project like http://www.teragrid.org/,
or Open Science Grid http://www.opensciencegrid.org/ , or in Europe in
Genesi-Dr http://www.genesi-dr.eu/, EGEE http://www.eu-egee.org/, etc..

so it has a very large community

this is a log fragment for a good transaction:
[4609] Wed Jul 16 22:04:42 2008 :: New connection from: wnode0406:42067
[4609] Wed Jul 16 22:04:42 2008 :: DN /DC=ch/DC=cern/OU=Organic 
Units/OU=Users/CN=samoper/CN=582979/CN=YYY XXX successfully authorized.
[4609] Wed Jul 16 22:04:42 2008 :: User sgmops001 successfully authorized.
[4609] Wed Jul 16 22:04:42 2008 :: Starting to transfer 
"/home/sgmops001/.globus/.gass_cache/local/md5/c5/6819e9394fdd304c0e38c3d875e746/md5/44/634526ab4efd0c35ecf41465259d25/data".
[4609] Wed Jul 16 22:04:42 2008 :: Finished transferring 
"/home/sgmops001/.globus/.gass_cache/local/md5/c5/6819e9394fdd304c0e38c3d875e746/md5/44/634526ab4efd0c35ecf41465259d25/data".
[4609] Wed Jul 16 22:04:42 2008 :: Closed connection from wnode0406:42067

if I try a simple ftp connection vs the GridFTP server without use my 
X509 I got this fragment:
[25327] Wed Jul 16 22:30:20 2008 :: Server started in inetd mode.
[25327] Wed Jul 16 22:30:20 2008 :: New connection from: 
XX-YYY-ZZ-WWW.fastres.net:37364
[25327] Wed Jul 16 22:31:50 2008 :: Closed connection from 
XX-YYY-ZZ-WWW.fastres.net:37364

and stop, without any message about the authentication/authorization phase

A lot of these attempts from a specific IP should be considered a DoS 
because on Grid the service
always use X509 Proxy Certificate to start net connections

is it easy to implement some OSSEC rules for this ?

many thanks again,
Fabio




Daniel Cid wrote:
> Hi Fabio,
>
> We currently do not support GridFTP (first time I hear about it), but
> if you can provide
> some log samples, we can work on some decoders/rules for it.
>
> Thanks,
>
> --
> Daniel B. Cid
> dcid ( at ) ossec.net
>
>
> 2008/7/14 Fabio Martinelli <[EMAIL PROTECTED]>:
>   
>> Dear OSSEC users
>>
>> is there some OSSEC plugins to understand GridFTP server logs ?
>> http://www.globus.org/toolkit/docs/4.2/4.2.0/data/gridftp/
>>
>> it's important configure the iptables fw in response to Internet DoS vs
>> GridFTP
>>
>> many thanks,
>> Fabio
>>
>>
>>
>>     

begin:vcard
fn:Fabio Martinelli
n:Martinelli;Fabio
org:INFN Tor Vergata
adr:;;via della ricerca scientifica, 1;ROME;;;ITALY
email;internet:[EMAIL PROTECTED]
title:Grid Computing Group
tel;work:+39 06 7259 4113
note;quoted-printable:Laurea V.O. in Informatica nel 2004, =
	=0D=0A=
	esperienze in =
	=0D=0A=
	ESA Frascati, =
	=0D=0A=
	ENEA Frascati, =
	=0D=0A=
	Accenture Roma, =
	=0D=0A=
	INFN Tor Vergata.
x-mozilla-html:TRUE
url:http://grid.roma2.infn.it/
version:2.1
end:vcard

Reply via email to