I'm interested in such a decoder as well, so any effort expended to help Doug would also help me and countless others I'm sure.
On Wed, Nov 10, 2010 at 3:55 PM, dan (ddp) <[email protected]> wrote: > On Wed, Nov 10, 2010 at 3:12 PM, Doug Burks <[email protected]> wrote: > > Has anybody used OSSEC to monitor OpenLDAP logs? Specifically, I'd > > like to monitor for auth failures (err=49 in the sanitized log sample > > below). As you can see, one LDAP connection (conn=999999) creates > > multiple log entries. Further complicating the matter is the fact > > that there are two instances of the err=49 error in this LDAP > > connection. > > > > Here's what I'd like to do. > > 1. Write a decoder that would: > > -process all of these lines together > > -pull out the source IP address from the "ACCEPT from > > IP=10.10.248.27:33957" entry > > -pull out the username from the "BIND > > dn="uid=username,ou=Department,ou=Business > > Unit,ou=People,dc=example,dc=com"" entry > > 2. Write an "Invalid credentials" rule that would look for > > "err=49". > > > > Would this be possible? Would it require the multi-line log reader > > support added in OSSEC v2.5? If so, I haven't found any documentation > > on this feature. > > > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 fd=64 ACCEPT > > from IP=10.10.248.27:33957 (IP=10.10.241.77:389) > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=0 EXT > > oid=1.3.6.1.4.1.1466.20037 > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=0 STARTTLS > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=0 RESULT oid= > > err=0 text= > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 fd=64 TLS > > established tls_ssf=256 ssf=256 > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=1 BIND > > dn="cn=Host,ou=Personal Accounts,dc=example,dc=com" method=128 > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=1 BIND > > dn="cn=Host,ou=Personal Accounts,dc=example,dc=com" mech=SIMPLE ssf=0 > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=1 RESULT > > tag=97 err=0 text= > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=2 SRCH > > base="ou=People,dc=example,dc=com" scope=2 deref=0 > > filter="(uid=username)" > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=2 ENTRY > > dn="uid=username,ou=Department,ou=Business > > Unit,ou=people,dc=example,dc=com" > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=2 SEARCH > > RESULT tag=101 err=0 nentries=1 text= > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=3 BIND > > anonymous mech=implicit ssf=0 > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=3 BIND > > dn="uid=username,ou=Department,ou=Business > > Unit,ou=People,dc=example,dc=com" method=128 > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=3 RESULT > > tag=97 err=49 text= > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=4 BIND > > dn="cn=Host,ou=Personal Accounts,dc=example,dc=com" method=128 > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=4 BIND > > dn="cn=Host,ou=Personal Accounts,dc=example,dc=com" mech=SIMPLE ssf=0 > > Jan 11 09:26:57 hostname slapd2.4[20872]: conn=999999 op=4 RESULT > > tag=97 err=0 text= > > Jan 11 09:26:59 hostname slapd2.4[20872]: conn=999999 op=5 BIND > > anonymous mech=implicit ssf=0 > > Jan 11 09:26:59 hostname slapd2.4[20872]: conn=999999 op=5 BIND > > dn="uid=username,ou=Department,ou=Business > > Unit,ou=People,dc=example,dc=com" method=128 > > Jan 11 09:26:59 hostname slapd2.4[20872]: conn=999999 op=5 RESULT > > tag=97 err=49 text= > > Jan 11 09:26:59 hostname slapd2.4[20872]: conn=999999 op=6 BIND > > dn="cn=Host,ou=Personal Accounts,dc=example,dc=com" method=128 > > Jan 11 09:26:59 hostname slapd2.4[20872]: conn=999999 op=6 BIND > > dn="cn=Host,ou=Personal Accounts,dc=example,dc=com" mech=SIMPLE ssf=0 > > Jan 11 09:26:59 hostname slapd2.4[20872]: conn=999999 op=6 RESULT > > tag=97 err=0 text= > > Jan 11 09:27:01 hostname slapd2.4[20872]: conn=999999 op=7 UNBIND > > Jan 11 09:27:01 hostname slapd2.4[20872]: conn=999999 fd=64 closed > > > > Thanks, > > Doug Burks > > Gross. > > I was going to look into OpenLDAP at some point, now I think I see why > it wasn't done before. > > Out of curiosiry, can connection logs from different conn's be mixed > together? For example: > Jan 11 09:27:34 blah slapd: conn=99997 blahblah > Jan 11 09:27:35 blah slapd: conn=99998 blahblah > Jan 11 09:27:36 blah slapd: conn=99999 blahblah > Jan 11 09:27:36 blah slapd: conn=99997 More blahblah > > Unfortunately I haven't seem much about the multi-line log option. > Here's the source in logcollector that should be handling it: > > http://bitbucket.org/dcid/ossec-hids/src/tip/src/logcollector/read_multiline.c > > I'm going to try and get an idea of how do use it tonight, and ask > about it on IRC tomrrow. I'm just not sure how it'll handle multiple > connection logs getting mixed together. > It's almost like we need a log format where we can specify an > identifier that groups logs together (conn=ID)... >
