Oops, spoke too soon. Looks like the decoder.xml change will block legitimate multiple connection attempts. That would be a problem. What I'd like to do is detect recurring USER command attempts and invoke active-response.
Rule: 100009 fired (level 10) -> "Multiple FTP connection attempts from same source IP." Portion of the log(s): Thu Sep 11 09:27:20 2008 [pid 29437] [ftp] FTP command: Client "192.192.192.192", "USER test" Thu Sep 11 09:27:18 2008 [pid 29437] [anonymous] FTP command: Client "192.192.192.192", "PASS <password>" Thu Sep 11 09:27:17 2008 [pid 29437] FTP command: Client "192.192.192.192", "USER anonymous" Thu Sep 11 09:27:05 2008 [pid 29184] [ftp] FTP command: Client "192.192.192.192", "QUIT" Thu Sep 11 09:26:39 2008 [pid 29184] [ftp] FTP command: Client "192.192.192.192", "LIST" Thu Sep 11 09:26:39 2008 [pid 29184] [ftp] FTP command: Client "192.192.192.192", "PASV" Thu Sep 11 09:26:37 2008 [pid 29184] [ftp] FTP command: Client "192.192.192.192", "SYST" Thu Sep 11 09:26:37 2008 [pid 29184] [anonymous] FTP command: Client "192.192.192.192", "PASS <password>" Thu Sep 11 09:26:33 2008 [pid 29184] FTP command: Client "192.192.192.192", "USER anonymous" Thu Sep 11 09:26:28 2008 [pid 29184] FTP command: Client "192.192.192.192", "AUTH KERBEROS_V4" -----Original Message----- From: Doug Floer Sent: Thursday, September 11, 2008 9:33 AM To: '[email protected]' Subject: RE: [ossec-list] Re: (SCL: 4) [ossec-list] not alerted on vsftp brute force attempts Thanks for your response, Daniel. The vsftpd version is 2.0.1. The vsftpd instance is strictly an anonymous FTP server, no named logins are allowed. In this case, the attacker has already successfully logged in as user anonymous and now is using brute force to try to change to a non-anonymous privileged user. 16,134 USER commands were attempted over the next 1/2 hour by this single source. IMHO, OSSEC should respond to with an active-response shutdown after 10 attempts in cases like this. Anyway, your suggestion to remove the $ from the regex worked like a charm. Thanks for your help! Great product, great support. Doug -----Original Message----- From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of Daniel Cid Sent: Wednesday, September 10, 2008 11:50 AM To: [email protected] Subject: [ossec-list] Re: (SCL: 4) [ossec-list] not alerted on vsftp brute force attempts Hi Doug, Which version of vsftpd are you using? In my tests, whenever someone fails the authentication, I get the following log: Sun Jun 4 xx 2006 [pid 21621] [lel1l] FAIL LOGIN: Client "192.168.2.10" Also, in this sample it looks like that the "attacker" is only issuing the USER command, but never completing the authentication process, so not really a brute force attempt. Anyway, if you still want to block this ip, you need to modify the decoder to extract the IP from that message (your rule is fine). Just edit decoder.xml and change: <decoder name="vsftpd"> <prematch>^\w\w\w \w\w\w\s+\d+ \S+ \d+ [pid \d+] </prematch> <regex offset="after_prematch">Client "(\d+.\d+.\d+.\d+)"$</regex> <order>srcip</order> </decoder> to <decoder name="vsftpd"> <prematch>^\w\w\w \w\w\w\s+\d+ \S+ \d+ [pid \d+] </prematch> <regex offset="after_prematch">Client "(\d+.\d+.\d+.\d+)"</regex> <order>srcip</order> </decoder> Hope it helps. -- Daniel B. Cid dcid ( at ) ossec.net On Wed, Sep 10, 2008 at 1:01 PM, Doug Floer <[EMAIL PROTECTED]> wrote: > > Hi folks, I didn't get a response so thought I'd ask again. If anyone > can help, I'd appreciate it greatly. > > Thanks, > Doug > -- > > OSSEC 1.5.1 doesn't seem to recognize repeated vsftp login attempts. > Vsftpd_rules.xml recognizes the "CONNECT: Client" entry but the > following "FTP command: Client .... USER" entries get a pass. Given > that there could be just a single "CONNECT: Client" entry but several > thousand of the "FTP command: Client" entries which would represent a > clear attack, I need some way to activate active-response in this > situation. I've tried the following in the server's local_rules.xml > with no luck. Any help would be much appreciated. > > <rule id="100008" level="3"> > <if_sid>11400</if_sid> > <match>FTP command: Client</match> > <group>connection attempt</group> > <description>FTP session open attempt.</description> > </rule> > <rule id="100009" level="10" frequency="10" timeframe="60"> > <if_matched_sid>100008</if_matched_sid> > <same_source_ip /> > <description>Multiple FTP connection attempts from </description> > <description>same source IP.</description> > <group>recon,</group> > </rule> > > Here is a sample set of log entries: > > Thu Sep 4 18:59:51 2008 [pid 8465] CONNECT: Client "222.73.247.58" > Thu Sep 4 18:59:51 2008 [pid 8465] FTP response: Client > "222.73.247.58", "220 WARNING: FOR AUTHORIZED USE ONLY" > Thu Sep 4 18:59:51 2008 [pid 8465] FTP command: Client "222.73.247.58", > "USER root" > Thu Sep 4 18:59:51 2008 [pid 8465] [root] FTP response: Client > "222.73.247.58", "530 This FTP server is anonymous only." > Thu Sep 4 18:59:51 2008 [pid 8465] FTP command: Client "222.73.247.58", > "USER root" > Thu Sep 4 18:59:51 2008 [pid 8465] [root] FTP response: Client > "222.73.247.58", "530 This FTP server is anonymous only." > Thu Sep 4 18:59:51 2008 [pid 8465] FTP command: Client "222.73.247.58", > "USER root" > Thu Sep 4 18:59:51 2008 [pid 8465] [root] FTP response: Client > "222.73.247.58", "530 This FTP server is anonymous only." > Thu Sep 4 18:59:52 2008 [pid 8465] FTP command: Client "222.73.247.58", > "USER root" > Thu Sep 4 18:59:52 2008 [pid 8465] [root] FTP response: Client > "222.73.247.58", "530 This FTP server is anonymous only." > Thu Sep 4 18:59:52 2008 [pid 8465] FTP command: Client "222.73.247.58", > "USER root" > Thu Sep 4 18:59:52 2008 [pid 8465] [root] FTP response: Client > "222.73.247.58", "530 This FTP server is anonymous only." > Thu Sep 4 18:59:52 2008 [pid 8465] FTP command: Client "222.73.247.58", > "USER root" > Thu Sep 4 18:59:52 2008 [pid 8465] [root] FTP response: Client > "222.73.247.58", "530 This FTP server is anonymous only." > > Thanks, > Doug >
