On Mon, Jun 7, 2010 at 5:19 PM, tm <[email protected]> wrote: > Hello, > > I believe that there is a bug with this decoder. The example in > decoder.xml looks like this: > > sshd[23578]: reverse mapping checking getaddrinfo for pib4.catv- > bauer.at failed - POSSIBLE BREAKIN ATTEMPT! > > The decoder looks like this: > > <decoder name="ssh-reverse-mapping"> > <parent>sshd</parent> > <prematch>^reverse mapping checking </prematch> > <regex offset="after_prematch">^\w+ for (\S+) </regex> > <order>srcip</order> > </decoder> > > What is being decoded as the source IP address would be: pib4.catv- > bauer.at. This is not correct. > > This came to light this past weekend when I saw an entry in active- > response.log like this: > > Sat Jun 5 11:29:27 PDT 2010 /opt/ossec/active-response/bin/host- > deny.sh add - 92.117.127.124.broad.bj.bj.static.163data.com.cn > 1275762567.604428 5703 > > Obviously, it didn't work because the third parameter is not an IP > address. The event which generated the alert looked this: > > OSSEC HIDS Notification. > 2010 Jun 05 11:29:27 > > Received From: (x.w.y.z) a.b.c.d->/var/log/secure.log > Rule: 5703 fired (level 10) -> "Possible breakin attempt (high number > of reverse lookup errors)." > Portion of the log(s): > > Jun 5 11:29:27 x sshd[53408]: reverse mapping checking getaddrinfo > for 92.117.127.124.broad.bj.bj.static.163data.com.cn [124.127.117.92] > failed - POSSIBLE BREAK-IN ATTEMPT! > Jun 5 11:29:25 x sshd[37460]: reverse mapping checking getaddrinfo > for 92.117.127.124.broad.bj.bj.static.163data.com.cn [124.127.117.92] > failed - POSSIBLE BREAK-IN ATTEMPT! > Jun 5 11:29:25 x sshd[53405]: reverse mapping checking getaddrinfo > for 92.117.127.124.broad.bj.bj.static.163data.com.cn [124.127.117.92] > failed - POSSIBLE BREAK-IN ATTEMPT! > Jun 5 11:29:23 x sshd[37458]: reverse mapping checking getaddrinfo > for 92.117.127.124.broad.bj.bj.static.163data.com.cn [124.127.117.92] > failed - POSSIBLE BREAK-IN ATTEMPT! > Jun 5 11:29:22 x sshd[53402]: reverse mapping checking getaddrinfo > for 92.117.127.124.broad.bj.bj.static.163data.com.cn [124.127.117.92] > failed - POSSIBLE BREAK-IN ATTEMPT! > > Rule 5703 tries to activate the active response by passing > 92.117.127.124.broad.bj.bj.static.163data.com.cn as the IP address > because of the flaw in the decoder. > > This particular set of events was generated on a Mac. I don't know > yet what similar events from other OS's would look like. > > Trevor >
It seems like a number of OSes/distros have differing error messages for the same ssh events. So it isn't a flaw in the decoder, just no decoder for this particular platform. Adding a decoder for this shouldn't be too difficult. I can't test it out at the moment, but you could try adding the following decoder to decoder.xml above the decoder you mentioned: <decoder name="ssh-reverse-mapping-osx"> <parent>sshd</parent> <prematch>^reverse mapping checking </prematch> <regex offset="after_prematch">^\W+ for \S+ [(\S+)] </regex> <order>srcip</order> </decoder> Use ossec-logtest to test it out.
