Problem is that there is nothing to interpret the ldap log entries.
If the thing you want to watch isn't syslog or in the decoder (see
below) it won't generate any SIDs, and therefore no alerts.
To add a new application, you have to build the decoder to extract the
data, or modify (clone) an existing one.
As far as picking entries out of syslog, look at syslog_rules.xml. If
an event occurs that doesn't match the searches, it is invisible to OSSEC.
It doesn't have any string filters for LDAP so it won't "see" any of the
entries unless they happen to match the badword list.
I don't run LDAP any more but I think if I were going to tackle this,
Idon't think I would log ldap to syslog directly becasue it is so chatty.
I would preprocess the actual LDAP logs, eliminate things not security
related, reformat/concatenate the relevant lines with regex and use
logger to add them to syslog.
Then a simpler rule set in local_rules.xml could be defined to generate
alerts.
To get a list of predefined application decoders
# cat /var/ossec/etc/decoder.xml|grep decoder\ name|sort
On 11/24/2010 09:31 AM, Doug Burks wrote:
We *do* have OpenLDAP configured to use syslog. This multi-line mess
is as good as it gets :)
Thanks,
Doug Burks
On Nov 20, 7:05 pm, Michael Starks<[email protected]>
wrote:
On 11/10/2010 02:12 PM, Doug Burks wrote:
Has anybody used OSSEC to monitor OpenLDAP logs? Specifically, I'd
like to monitor for auth failures (err=49 in the sanitized log sample
below). As you can see, one LDAP connection (conn=999999) creates
multiple log entries. Further complicating the matter is the fact
that there are two instances of the err=49 error in this LDAP
connection.
Would configuring OpenLDAP to use syslog be the path of least resistance
here?
--
Michael Starks
[I] Immutable Securityhttp://www.immutablesecurity.com
--
R. Loyd Darby, OSSIM-OCSE
Project Manager DOC/NOAA/NMFS
Infrastructure coordinator
Southeast Fisheries Science Center
305-361-4297
