On Tue, Feb 5, 2013 at 12:05 PM, Greg Ramos <[email protected]> wrote:
> Yeo, that rule worked. May I ask, what was in /tmp/j that you used to test?
>
You should read my entire email next time.
**
full event: 'Feb 4 07:20:23 appoc9 sshd[901]: [ID 947420
auth.warning] refused connect from 60.13.74.23'
**
>
> OSSEC HIDS Notification.
> 2013 Feb 05 16:43:21
>
> Received From: appoc9->/var/adm/messages
> Rule: 9999 fired (level 7) -> "SSH connection blocked by tcp wrappers."
> Portion of the log(s):
>
> Feb 5 09:43:21 appoc9 sshd[14737]: [ID 947420 auth.warning] refused
> connect from 64.118.82.235
>
>
>
> --END OF NOTIFICATION
>
>
> On Mon, Feb 4, 2013 at 6:29 PM, dan (ddp) <[email protected]> wrote:
>> On Mon, Feb 4, 2013 at 7:21 PM, Greg Ramos <[email protected]> wrote:
>>> I was constantly being hit from this machine:
>>>
>>> Feb 4 07:20:23 appoc9 sshd[901]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>
>> I'm guessing your email alert level is set to 7. This log message
>> appears to trigger a level 5 alert.
>>
>> # cat /tmp/j | /var/ossec/bin/ossec-logtest
>> 2013/02/04 20:25:25 ossec-testrule: INFO: Reading decoder file
>> etc/decoder.xml.
>> 2013/02/04 20:25:25 ossec-testrule: INFO: Reading decoder file
>> etc/local_decoder.xml.
>> 2013/02/04 20:25:25 ossec-testrule: INFO: Reading decoder file
>> etc/wip/nsd_decoder.xml.
>> 2013/02/04 20:25:25 ossec-testrule: INFO: Reading the lists file:
>> 'lists/blocked.txt.cdb'
>> 2013/02/04 20:25:25 ossec-testrule: INFO: Reading the lists file:
>> 'lists/userlist.txt.cdb'
>> 2013/02/04 20:25:25 ossec-testrule: INFO: Reading the lists file:
>> 'lists/banneduser.txt.cdb'
>> 2013/02/04 20:25:25 ossec-testrule: INFO: Started (pid: 28087).
>> ossec-testrule: Type one log per line.
>>
>>
>>
>> **Phase 1: Completed pre-decoding.
>> full event: 'Feb 4 07:20:23 appoc9 sshd[901]: [ID 947420
>> auth.warning] refused connect from 60.13.74.23'
>> hostname: 'appoc9'
>> program_name: 'sshd'
>> log: 'refused connect from 60.13.74.23'
>>
>> **Phase 2: Completed decoding.
>> decoder: 'sshd'
>> srcip: '60.13.74.23'
>>
>> **Phase 3: Completed filtering (rules).
>> Rule id: '2503'
>> Level: '5'
>> Description: 'Connection blocked by Tcp Wrappers.'
>> **Alert to be generated.
>>
>>
>> You can raise this by adding this to the local_rules.xml:
>>
>> <rule id="INSERT ID" level="7">
>> <if_sid>2503</if_sid>
>> <program_name>sshd</program_name>
>> <description>SSH connection blocked by tcp wrappers.</description>
>> </rule>
>>
>> You should then end up with something like:
>> # cat /tmp/j | /var/ossec/bin/ossec-logtest
>> 2013/02/04 20:29:19 ossec-testrule: INFO: Reading decoder file
>> etc/decoder.xml.
>> 2013/02/04 20:29:19 ossec-testrule: INFO: Reading decoder file
>> etc/local_decoder.xml.
>> 2013/02/04 20:29:19 ossec-testrule: INFO: Reading decoder file
>> etc/wip/nsd_decoder.xml.
>> 2013/02/04 20:29:19 ossec-testrule: INFO: Reading the lists file:
>> 'lists/blocked.txt.cdb'
>> 2013/02/04 20:29:19 ossec-testrule: INFO: Reading the lists file:
>> 'lists/userlist.txt.cdb'
>> 2013/02/04 20:29:19 ossec-testrule: INFO: Reading the lists file:
>> 'lists/banneduser.txt.cdb'
>> 2013/02/04 20:29:20 ossec-testrule: INFO: Started (pid: 20573).
>> ossec-testrule: Type one log per line.
>>
>>
>>
>> **Phase 1: Completed pre-decoding.
>> full event: 'Feb 4 07:20:23 appoc9 sshd[901]: [ID 947420
>> auth.warning] refused connect from 60.13.74.23'
>> hostname: 'appoc9'
>> program_name: 'sshd'
>> log: 'refused connect from 60.13.74.23'
>>
>> **Phase 2: Completed decoding.
>> decoder: 'sshd'
>> srcip: '60.13.74.23'
>>
>> **Phase 3: Completed filtering (rules).
>> Rule id: '100091'
>> Level: '7'
>> Description: 'SSH connection blocked by tcp wrappers.'
>> **Alert to be generated.
>>
>>
>> I'm not sure this could get any more basic.
>>
>>> Feb 4 07:25:13 appoc9 sshd[1117]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:14 appoc9 sshd[1118]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:17 appoc9 sshd[1119]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:19 appoc9 sshd[1120]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:21 appoc9 sshd[1121]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:21 appoc9 sshd[1122]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:24 appoc9 sshd[1123]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:24 appoc9 sshd[1124]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:26 appoc9 sshd[1125]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:26 appoc9 sshd[1126]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:28 appoc9 sshd[1127]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:29 appoc9 sshd[1128]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:31 appoc9 sshd[1129]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:31 appoc9 sshd[1130]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:33 appoc9 sshd[1131]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:34 appoc9 sshd[1132]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:36 appoc9 sshd[1133]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:36 appoc9 sshd[1134]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:38 appoc9 sshd[1135]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:38 appoc9 sshd[1136]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:40 appoc9 sshd[1137]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:40 appoc9 sshd[1138]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 07:25:44 appoc9 sshd[1139]: [ID 947420 auth.warning] refused
>>> connect from 60.13.74.23
>>> Feb 4 08:42:35 appoc9 sshd[6446]: [ID 947420 auth.warning] refused
>>> connect from fenderforum.com
>>> Feb 4 15:09:48 appoc9 sshd[25065]: [ID 947420 auth.warning] refused
>>> connect from 87.101.142.139
>>>
>>>
>>> On Mon, Feb 4, 2013 at 5:09 PM, dan (ddp) <[email protected]> wrote:
>>>>
>>>> On Feb 4, 2013 6:33 PM, "Greg Ramos" <[email protected]> wrote:
>>>>>
>>>>> OK, I purchased the book on Amazon. I noticed the date is pretty old,
>>>>> considering things are changing all the time, but perhaps it will help
>>>>> me to learn the software. Anyway, one of the primary reasons I install
>>>>> the package, was to monitor ssh refusals. I am getting notification of
>>>>> failed logins, but not refusals. In other words, I had a machine that
>>>>> was refused by the tcp wrappers, and noted in /var/adm/messages, but
>>>>> did not receive an alert for any of these attempts. I have used
>>>>> 'swatch' before which I could set up to look for ssh refusals, similar
>>>>> to logwatch. The problem with logwatch, unless I don't have it
>>>>> configured correctly, is I get a report the next day. I am looking for
>>>>> something that monitors attempts live, which OSSEC does, I am just
>>>>> missing the refused attempts.
>>>>>
>>>>>
>>>>> OSSEC Host-Based Intrusion Detection Guide
>>>>>
>>>>> --
>>>>>
>>>>
>>>> Please provide a log sample.
>>>>
>>>>> ---
>>>>> You received this message because you are subscribed to the Google Groups
>>>>> "ossec-list" group.
>>>>> To unsubscribe from this group and stop receiving emails from it, send an
>>>>> email to [email protected].
>>>>> For more options, visit https://groups.google.com/groups/opt_out.
>>>>>
>>>>>
>>>>
>>>> --
>>>>
>>>> ---
>>>> You received this message because you are subscribed to the Google Groups
>>>> "ossec-list" group.
>>>> To unsubscribe from this group and stop receiving emails from it, send an
>>>> email to [email protected].
>>>> For more options, visit https://groups.google.com/groups/opt_out.
>>>>
>>>>
>>>
>>> --
>>>
>>> ---
>>> You received this message because you are subscribed to the Google Groups
>>> "ossec-list" group.
>>> To unsubscribe from this group and stop receiving emails from it, send an
>>> email to [email protected].
>>> For more options, visit https://groups.google.com/groups/opt_out.
>>>
>>>
>>
>> --
>>
>> ---
>> You received this message because you are subscribed to the Google Groups
>> "ossec-list" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to [email protected].
>> For more options, visit https://groups.google.com/groups/opt_out.
>>
>>
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/groups/opt_out.
>
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
