On Thu, Nov 26, 2015 at 6:44 PM, Graeme Coates
<[email protected]> wrote:
> Hi,
>
> Am running OSSEC 2.8.3-3jessie (from the alientvault.com repo)
>
> I'm trying to test active-response rules for a Wordpress install -
> specifically to add source IPs as DROP rules in iptables where they have
> multiple authentication issues, or where they are trying to brute force via
> XMLRPC multicall.
>
> The rules all work well in ipv4, but I get no active response under ipv6 -
> though I do get the alert at level 10 as follows (via email notification) -
> is picked up as an auth failure thanks to WPfail2ban (I don't have the
> WPsyslog2 plugin so it skips the WP specific rules - though may rectify
> that), or via a custom rule for xmlrpc.php POSTS:
>
>
> OSSEC HIDS Notification.
> 2015 Nov 26 23:04:34
>
> Received From: host->/var/log/auth.log
> Rule: 40111 fired (level 10) -> "Multiple authentication failures."
> Portion of the log(s):
>
> Nov 26 23:04:33 host wordpress(www.chromosphere.co.uk)[10102]:
> Authentication failure for sam from x:x:x:x:0:3:0:1
> Nov 26 23:04:32 host wordpress(www.chromosphere.co.uk)[10102]:
> Authentication failure for sam from x:x:x:x:0:3:0:1
> Nov 26 23:04:31 fuggle wordpress(www.chromosphere.co.uk)[10102]:
> Authentication failure for sam from x:x:x:x:0:3:0:1
> ...etc...
>
>
> (Original log: /var/log/auth:
>
> Nov 26 23:04:32 fuggle wordpress(www.chromosphere.co.uk)[10102]:
> Authentication failure for sam from x:x:x:x:0:3:0:1
> )
>
>
>
> Is ipv6 supported for active-responses yet? I've added debug statements to
> mail me when the firewall-drop.sh rule active-response runs (and to tell me
> what the params are) but see nothing for ipv6 (but works for ipv4) . The
> script looks like it should work with ipv6 as there's different logic as to
> whether the ip address has dots or colons...
>
I ran the sample logs through ossec-logtest, and the IP addresses
aren't being decoded. In fact, the log message isn't matching a
decoder.
# /var/ossec/bin/ossec-logtest
2015/11/27 08:06:05 ossec-testrule: INFO: Reading local decoder file.
2015/11/27 08:06:05 ossec-testrule: INFO: Started (pid: 20569).
ossec-testrule: Type one log per line.
Nov 26 23:04:33 host wordpress(www.chromosphere.co.uk)[10102]:
Authentication failure for sam from x:x:x:x:0:3:0:1
**Phase 1: Completed pre-decoding.
full event: 'Nov 26 23:04:33 host
wordpress(www.chromosphere.co.uk)[10102]: Authentication failure for
sam from x:x:x:x:0:3:0:1'
hostname: 'host'
program_name: 'wordpress(www.chromosphere.co.uk)'
log: 'Authentication failure for sam from x:x:x:x:0:3:0:1'
**Phase 2: Completed decoding.
No decoder matched.
**Phase 3: Completed filtering (rules).
Rule id: '2501'
Level: '5'
Description: 'User authentication failure.'
**Alert to be generated.
Adding this to local_decoder.xml gave me an IP to work with:
<decoder name="wp-auth">
<program_name>^wordpress</program_name>
<prematch>^Authentication </prematch>
<regex offset="after_prematch">^(\S+) for (\S+) from (\S+)$</regex>
<order>status, srcuser, srcip</order>
</decoder>
> Thanks
>
> Graeme
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/d/optout.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
