Hello, I believe that there is a bug with this decoder. The example in decoder.xml looks like this:
sshd[23578]: reverse mapping checking getaddrinfo for pib4.catv- bauer.at failed - POSSIBLE BREAKIN ATTEMPT! The decoder looks like this: <decoder name="ssh-reverse-mapping"> <parent>sshd</parent> <prematch>^reverse mapping checking </prematch> <regex offset="after_prematch">^\w+ for (\S+) </regex> <order>srcip</order> </decoder> What is being decoded as the source IP address would be: pib4.catv- bauer.at. This is not correct. This came to light this past weekend when I saw an entry in active- response.log like this: Sat Jun 5 11:29:27 PDT 2010 /opt/ossec/active-response/bin/host- deny.sh add - 92.117.127.124.broad.bj.bj.static.163data.com.cn 1275762567.604428 5703 Obviously, it didn't work because the third parameter is not an IP address. The event which generated the alert looked this: OSSEC HIDS Notification. 2010 Jun 05 11:29:27 Received From: (x.w.y.z) a.b.c.d->/var/log/secure.log Rule: 5703 fired (level 10) -> "Possible breakin attempt (high number of reverse lookup errors)." Portion of the log(s): Jun 5 11:29:27 x sshd[53408]: reverse mapping checking getaddrinfo for 92.117.127.124.broad.bj.bj.static.163data.com.cn [124.127.117.92] failed - POSSIBLE BREAK-IN ATTEMPT! Jun 5 11:29:25 x sshd[37460]: reverse mapping checking getaddrinfo for 92.117.127.124.broad.bj.bj.static.163data.com.cn [124.127.117.92] failed - POSSIBLE BREAK-IN ATTEMPT! Jun 5 11:29:25 x sshd[53405]: reverse mapping checking getaddrinfo for 92.117.127.124.broad.bj.bj.static.163data.com.cn [124.127.117.92] failed - POSSIBLE BREAK-IN ATTEMPT! Jun 5 11:29:23 x sshd[37458]: reverse mapping checking getaddrinfo for 92.117.127.124.broad.bj.bj.static.163data.com.cn [124.127.117.92] failed - POSSIBLE BREAK-IN ATTEMPT! Jun 5 11:29:22 x sshd[53402]: reverse mapping checking getaddrinfo for 92.117.127.124.broad.bj.bj.static.163data.com.cn [124.127.117.92] failed - POSSIBLE BREAK-IN ATTEMPT! Rule 5703 tries to activate the active response by passing 92.117.127.124.broad.bj.bj.static.163data.com.cn as the IP address because of the flaw in the decoder. This particular set of events was generated on a Mac. I don't know yet what similar events from other OS's would look like. Trevor
