Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

enhance: Add sshd refused connection based on hosts.deny #1192

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

enhance: Add sshd refused connection based on hosts.deny #1192

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6461fad
enhance: Add sshd refused connection based on hosts.deny
LaurenceJJones Dec 16, 2024
f55829a
enhance: Update scenario to have 0 confidence as it more of a configu…
LaurenceJJones Dec 18, 2024
2ed7668
Merge branch 'master' into sshd_refused
LaurenceJJones Jan 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 54 additions & 6 deletions .tests/sshd-logs/parser.assert
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
len(results) == 3
len(results["s00-raw"]["crowdsecurity/syslog-logs"]) == 21
len(results["s00-raw"]["crowdsecurity/syslog-logs"]) == 23
results["s00-raw"]["crowdsecurity/syslog-logs"][0].Success == true
results["s00-raw"]["crowdsecurity/syslog-logs"][0].Evt.Parsed["logsource"] == "syslog"
results["s00-raw"]["crowdsecurity/syslog-logs"][0].Evt.Parsed["message"] == "Invalid user pascal from 35.188.49.176 port 53502"
Expand Down Expand Up @@ -202,15 +202,35 @@ results["s00-raw"]["crowdsecurity/syslog-logs"][19].Evt.Meta["machine"] == "inst
results["s00-raw"]["crowdsecurity/syslog-logs"][19].Evt.Whitelisted == false
results["s00-raw"]["crowdsecurity/syslog-logs"][20].Success == true
results["s00-raw"]["crowdsecurity/syslog-logs"][20].Evt.Parsed["logsource"] == "syslog"
results["s00-raw"]["crowdsecurity/syslog-logs"][20].Evt.Parsed["message"] == "Invalid user pascal5 from 35.188.49.176 port 53502"
results["s00-raw"]["crowdsecurity/syslog-logs"][20].Evt.Parsed["message"] == "Invalid user pascal5 from 192.168.1.3 port 53502"
results["s00-raw"]["crowdsecurity/syslog-logs"][20].Evt.Parsed["pid"] == "16379"
results["s00-raw"]["crowdsecurity/syslog-logs"][20].Evt.Parsed["program"] == "sshd-session"
results["s00-raw"]["crowdsecurity/syslog-logs"][20].Evt.Parsed["timestamp"] == "Feb 12 14:10:24"
results["s00-raw"]["crowdsecurity/syslog-logs"][20].Evt.Meta["datasource_path"] == "sshd-logs.log"
results["s00-raw"]["crowdsecurity/syslog-logs"][20].Evt.Meta["datasource_type"] == "file"
results["s00-raw"]["crowdsecurity/syslog-logs"][20].Evt.Meta["machine"] == "sd-126005"
results["s00-raw"]["crowdsecurity/syslog-logs"][20].Evt.Whitelisted == false
len(results["s01-parse"]["crowdsecurity/sshd-logs"]) == 21
results["s00-raw"]["crowdsecurity/syslog-logs"][21].Success == true
results["s00-raw"]["crowdsecurity/syslog-logs"][21].Evt.Parsed["logsource"] == "syslog"
results["s00-raw"]["crowdsecurity/syslog-logs"][21].Evt.Parsed["message"] == "refused connect from _U2FsdGVkX19P3BCJmFBHhjLza8BcMH06WCUVwttMHpE=_@::ffff:192.168.1.1 (::ffff:192.168.1.1)"
results["s00-raw"]["crowdsecurity/syslog-logs"][21].Evt.Parsed["pid"] == "16379"
results["s00-raw"]["crowdsecurity/syslog-logs"][21].Evt.Parsed["program"] == "sshd"
results["s00-raw"]["crowdsecurity/syslog-logs"][21].Evt.Parsed["timestamp"] == "Dec 12 14:10:24"
results["s00-raw"]["crowdsecurity/syslog-logs"][21].Evt.Meta["datasource_path"] == "sshd-logs.log"
results["s00-raw"]["crowdsecurity/syslog-logs"][21].Evt.Meta["datasource_type"] == "file"
results["s00-raw"]["crowdsecurity/syslog-logs"][21].Evt.Meta["machine"] == "myhost"
results["s00-raw"]["crowdsecurity/syslog-logs"][21].Evt.Whitelisted == false
results["s00-raw"]["crowdsecurity/syslog-logs"][22].Success == true
results["s00-raw"]["crowdsecurity/syslog-logs"][22].Evt.Parsed["logsource"] == "syslog"
results["s00-raw"]["crowdsecurity/syslog-logs"][22].Evt.Parsed["message"] == "refused connect from example.com (192.168.1.1)"
results["s00-raw"]["crowdsecurity/syslog-logs"][22].Evt.Parsed["pid"] == "16379"
results["s00-raw"]["crowdsecurity/syslog-logs"][22].Evt.Parsed["program"] == "sshd"
results["s00-raw"]["crowdsecurity/syslog-logs"][22].Evt.Parsed["timestamp"] == "Dec 16 14:10:24"
results["s00-raw"]["crowdsecurity/syslog-logs"][22].Evt.Meta["datasource_path"] == "sshd-logs.log"
results["s00-raw"]["crowdsecurity/syslog-logs"][22].Evt.Meta["datasource_type"] == "file"
results["s00-raw"]["crowdsecurity/syslog-logs"][22].Evt.Meta["machine"] == "myhost"
results["s00-raw"]["crowdsecurity/syslog-logs"][22].Evt.Whitelisted == false
len(results["s01-parse"]["crowdsecurity/sshd-logs"]) == 23
results["s01-parse"]["crowdsecurity/sshd-logs"][0].Success == true
results["s01-parse"]["crowdsecurity/sshd-logs"][0].Evt.Parsed["logsource"] == "syslog"
results["s01-parse"]["crowdsecurity/sshd-logs"][0].Evt.Parsed["message"] == "Invalid user pascal from 35.188.49.176 port 53502"
Expand Down Expand Up @@ -510,18 +530,46 @@ results["s01-parse"]["crowdsecurity/sshd-logs"][19].Evt.Meta["source_ip"] == "19
results["s01-parse"]["crowdsecurity/sshd-logs"][19].Evt.Whitelisted == false
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Success == true
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Parsed["logsource"] == "syslog"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Parsed["message"] == "Invalid user pascal5 from 35.188.49.176 port 53502"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Parsed["message"] == "Invalid user pascal5 from 192.168.1.3 port 53502"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Parsed["pid"] == "16379"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Parsed["program"] == "sshd-session"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Parsed["sshd_client_ip"] == "35.188.49.176"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Parsed["sshd_client_ip"] == "192.168.1.3"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Parsed["sshd_invalid_user"] == "pascal5"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Parsed["timestamp"] == "Feb 12 14:10:24"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Meta["datasource_path"] == "sshd-logs.log"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Meta["datasource_type"] == "file"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Meta["log_type"] == "ssh_failed-auth"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Meta["machine"] == "sd-126005"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Meta["service"] == "ssh"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Meta["source_ip"] == "35.188.49.176"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Meta["source_ip"] == "192.168.1.3"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Meta["target_user"] == "pascal5"
results["s01-parse"]["crowdsecurity/sshd-logs"][20].Evt.Whitelisted == false
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Success == true
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Parsed["logsource"] == "syslog"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Parsed["message"] == "refused connect from _U2FsdGVkX19P3BCJmFBHhjLza8BcMH06WCUVwttMHpE=_@::ffff:192.168.1.1 (::ffff:192.168.1.1)"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Parsed["pid"] == "16379"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Parsed["program"] == "sshd"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Parsed["sshd_client_ip"] == "192.168.1.1"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Parsed["timestamp"] == "Dec 12 14:10:24"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Meta["datasource_path"] == "sshd-logs.log"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Meta["datasource_type"] == "file"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Meta["log_type"] == "ssh_refused_conn"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Meta["machine"] == "myhost"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Meta["service"] == "ssh"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Meta["source_ip"] == "192.168.1.1"
results["s01-parse"]["crowdsecurity/sshd-logs"][21].Evt.Whitelisted == false
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Success == true
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Parsed["logsource"] == "syslog"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Parsed["message"] == "refused connect from example.com (192.168.1.1)"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Parsed["pid"] == "16379"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Parsed["program"] == "sshd"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Parsed["sshd_client_ip"] == "192.168.1.1"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Parsed["timestamp"] == "Dec 16 14:10:24"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Meta["datasource_path"] == "sshd-logs.log"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Meta["datasource_type"] == "file"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Meta["log_type"] == "ssh_refused_conn"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Meta["machine"] == "myhost"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Meta["service"] == "ssh"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Meta["source_ip"] == "192.168.1.1"
results["s01-parse"]["crowdsecurity/sshd-logs"][22].Evt.Whitelisted == false
len(results["success"][""]) == 0
4 changes: 3 additions & 1 deletion .tests/sshd-logs/sshd-logs.log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,4 +18,6 @@ Feb 8 17:15:01 hostname sshd[1478159]: Connection reset by authenticating user r
Apr 6 18:51:41 eve sshd[2784424]: Failed password for invalid user root from 192.168.1.2 port 51182 ssh2
Jul 1 09:30:56 usbkey sshd[8807]: fatal: Timeout before authentication for 192.168.9.212 port 47056
Jul 2 11:32:16 instance-20240401-2335 sshd[309785]: ssh_dispatch_run_fatal: Connection from 192.168.9.213 port 48680: message authentication code incorrect [preauth]
Feb 12 14:10:24 sd-126005 sshd-session[16379]: Invalid user pascal5 from 35.188.49.176 port 53502
Feb 12 14:10:24 sd-126005 sshd-session[16379]: Invalid user pascal5 from 192.168.1.3 port 53502
Dec 12 14:10:24 myhost sshd[16379]: refused connect from _U2FsdGVkX19P3BCJmFBHhjLza8BcMH06WCUVwttMHpE=_@::ffff:192.168.1.1 (::ffff:192.168.1.1)
Dec 16 14:10:24 myhost sshd[16379]: refused connect from example.com (192.168.1.1)
12 changes: 12 additions & 0 deletions .tests/sshd-refused-conn/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
parsers:
- crowdsecurity/syslog-logs
- crowdsecurity/dateparse-enrich
- ./parsers/s01-parse/crowdsecurity/sshd-logs.yaml
scenarios:
- ./scenarios/crowdsecurity/ssh-refused-conn.yaml
postoverflows:
- ""
log_file: sshd-refused-conn.log
log_type: syslog
labels: {}
ignore_parsers: true
Empty file added .tests/sshd-refused-conn/parser.assert
View file
Open in desktop
Empty file.
16 changes: 16 additions & 0 deletions .tests/sshd-refused-conn/scenario.assert
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
len(results) == 1
"192.168.1.1" in results[0].Overflow.GetSources()
results[0].Overflow.Sources["192.168.1.1"].IP == "192.168.1.1"
results[0].Overflow.Sources["192.168.1.1"].Range == ""
results[0].Overflow.Sources["192.168.1.1"].GetScope() == "Ip"
results[0].Overflow.Sources["192.168.1.1"].GetValue() == "192.168.1.1"
results[0].Overflow.Alert.Events[0].GetMeta("datasource_path") == "sshd-refused-conn.log"
results[0].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file"
results[0].Overflow.Alert.Events[0].GetMeta("log_type") == "ssh_refused_conn"
results[0].Overflow.Alert.Events[0].GetMeta("machine") == "myhost"
results[0].Overflow.Alert.Events[0].GetMeta("service") == "ssh"
results[0].Overflow.Alert.Events[0].GetMeta("source_ip") == "192.168.1.1"
results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2024-12-16T14:10:24Z"
results[0].Overflow.Alert.GetScenario() == "crowdsecurity/ssh-refused-conn"
results[0].Overflow.Alert.Remediation == true
results[0].Overflow.Alert.GetEventsCount() == 1
1 change: 1 addition & 0 deletions .tests/sshd-refused-conn/sshd-refused-conn.log
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Dec 16 14:10:24 myhost sshd[16379]: refused connect from example.com (192.168.1.1)
7 changes: 7 additions & 0 deletions parsers/s01-parse/crowdsecurity/sshd-logs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ pattern_syntax:
SSHD_NOT_ALLOWED_USER: 'User %{USERNAME:sshd_invalid_user}? from %{IP_WORKAROUND:sshd_client_ip}( port \d+)? not allowed because not listed in AllowUsers'
SSHD_AUTH_TIMEOUT: 'Timeout before authentication for %{IP_WORKAROUND:sshd_client_ip}( port \d+)?'
SSHD_DISPATCH_FATAL: 'ssh_dispatch_run_fatal: Connection from %{IP_WORKAROUND:sshd_client_ip}( port \d+)?: message authentication code incorrect \[preauth\]'
SSHD_REFUSED_CONN: 'refused connect from.*\((::ffff:)?%{IP_WORKAROUND:sshd_client_ip}\)'
nodes:
- grok:
name: "SSHD_FAIL"
Expand Down Expand Up @@ -117,6 +118,12 @@ nodes:
statics:
- meta: log_type
value: ssh_dispatch_fatal
- grok:
name: "SSHD_REFUSED_CONN"
apply_on: message
statics:
- meta: log_type
value: ssh_refused_conn
statics:
- meta: service
value: ssh
Expand Down
5 changes: 5 additions & 0 deletions scenarios/crowdsecurity/ssh-refused-conn.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
Detect refused connections to SSHD based on hosts deny and allow rules.

Typically these are defined in different locations based on the distribution.

- **For Debian/Ubuntu**: `/etc/hosts.deny` and `/etc/hosts.allow`
16 changes: 16 additions & 0 deletions scenarios/crowdsecurity/ssh-refused-conn.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
type: trigger
name: crowdsecurity/ssh-refused-conn
description: "Detect sshd refused connections"
filter: "evt.Meta.log_type == 'ssh_refused_conn'"
groupby: evt.Meta.source_ip
blackhole: 1m
reprocess: false
labels:
service: ssh
confidence: 0
spoofable: 0
classification:
- attack.T1595
label: "SSH Refused Connection"
behavior: "generic:scan"
remediation: true
Loading