# Proxmox failed auth parser

**URL:** <https://discourse.crowdsec.net/t/proxmox-failed-auth-parser/505>\
**Category:** crowdsec\
**Created:** [January 4, 2022, 10:05am UTC](https://discourse.crowdsec.net/t/proxmox-failed-auth-parser/505 "2022-01-04T10:05:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![unam](https://avatars.discourse-cdn.com/v4/letter/u/ecae2f/32.png) [@unam](https://discourse.crowdsec.net/u/unam)\
**Post date:** [January 4, 2022, 10:05am UTC](https://discourse.crowdsec.net/t/proxmox-failed-auth-parser/505/1 "2022-01-04T10:05:10Z")

</div>

Hi,

I’m trying to write a parser for proxmox virtual env (pve) authentication system.

It currently write to syslog something like :

```auto
Jan 3 17:42:01 dedie-h pvedaemon[2885697]: authentication failure; rhost=::ffff:1.2.3.4 user=root@pam msg=Authentication failure

```

Following this doc : [Creating parsers | CrowdSec](https://docs.crowdsec.net/docs/parsers/create/) I am writing the parser. When I try to run it against my log file, the first part (syslog parser) is ok but it always returns false against my proxmox-logs parser.

I am pretty sure it’s a stupid mistake from my part but I 'can’t find where.

- parsers/s01-parse/crowdsecurity/proxmox-logs.yaml

```auto
debug: true
name: crowdsecurity/proxmox-logs
description: "Parse syslog, searching for proxmox bruteforce patterns"
filter: "evt.Parsed.program == 'pvedaemon'"
onsuccess: next_stage
pattern_syntax:
  IPv4_WORKAROUND: (?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
  IP_WORKAROUND: (?:%{IPV6}|%{IPv4_WORKAROUND})
  PVE_AUTH_FAIL: '%{SYSLOGTIMESTAMP} %{SYSLOGHOST} %{SYSLOGPROG}: authentication failure; rhost=%{IPV6}:%{IP_WORKAROUND:client_ip} user=%{USERNAME:source_user}@%{WORD:realm} msg=Authentication failure'
nodes:
  - grok:
      name: "PVE_AUTH_FAIL"
      apply_on: message
      statics:
        - meta: log_type
          value: pve_failed-auth
        - meta: source_user
          expression: "evt.Parsed.source_user"
statics:
    - meta: service
      value: pvedaemon
    - meta: source_ip
      expression: "evt.Parsed.client_ip"

```

> Note : I just tried with the IPv4\_WORKAROUND variable without sucess. Before that change I was using %{IPV4}

- .tests/proxmox-logs/config.yaml

```auto
parsers:
- crowdsecurity/syslog-logs
- parsers/s01-parse/crowdsecurity/proxmox-logs.yaml
scenarios:
- ""
postoverflows:
- ""
log_file: proxmox-logs.log
log_type: syslog
labels: {}
ignore_parsers: false

```

Thanks for you reply 🙂

---

<div class="post-metadata">

**Author:** ![thibault](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/thibault/32/2_2.png) [@thibault](https://discourse.crowdsec.net/u/thibault)\
**Post date:** [January 4, 2022, 10:29am UTC](https://discourse.crowdsec.net/t/proxmox-failed-auth-parser/505/2 "2022-01-04T10:29:26Z")

</div>

Hello !

At first glance, it seems that you are trying to “re” parse the syslog headers, but the syslog parser did it already, so you just have to parse the message itself (syslogtimestamp, sysloghost and syslogprog are already taken care of).

You can use [`cscli explain`](https://doc.crowdsec.net/docs/user_guides/cscli_explain) to see exactly what happens !

Hope this helps,

---

<div class="post-metadata">

**Author:** ![unam](https://avatars.discourse-cdn.com/v4/letter/u/ecae2f/32.png) [@unam](https://discourse.crowdsec.net/u/unam)\
**Post date:** [January 4, 2022, 10:42am UTC](https://discourse.crowdsec.net/t/proxmox-failed-auth-parser/505/3 "2022-01-04T10:42:46Z")

</div>

My bad, just did removing the syslog part, thank !  
I also removed the IPv4\_WORKAROUND, no needed anymore.

Here is the final result :

```auto
debug: true
name: crowdsecurity/proxmox-logs
description: "Parse syslog, searching for proxmox bruteforce patterns"
filter: "evt.Parsed.program == 'pvedaemon'"
onsuccess: next_stage
pattern_syntax:
  PVE_AUTH_FAIL: 'authentication failure; rhost=%{IPV6}:%{IPV4:client_ip} user=%{USERNAME:source_user}@%{WORD:realm} msg=Authentication failure'
nodes:
  - grok:
      name: "PVE_AUTH_FAIL"
      apply_on: message
      statics:
        - meta: log_type
          value: pve_failed-auth
        - meta: source_user
          expression: "evt.Parsed.source_user"
statics:
    - meta: service
      value: pvedaemon
    - meta: source_ip
      expression: "evt.Parsed.client_ip"

```

With this output :

```auto
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Success == true
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Parsed["client_ip"] == "1.2.3.4"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Parsed["logsource"] == "syslog"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Parsed["message"] == "authentication failure; rhost=::ffff:1.2.3.4 user=root@pam msg=Authentication failure"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Parsed["pid"] == "2885697"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Parsed["timestamp"] == "Jan 3 17:42:01"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Parsed["program"] == "pvedaemon"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Parsed["realm"] == "pam"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Parsed["source_user"] == "root"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Meta["machine"] == "dedie-h"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Meta["service"] == "pvedaemon"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Meta["source_ip"] == "1.2.3.4"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Meta["source_user"] == "root"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Meta["datasource_path"] == "proxmox-logs.log"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Meta["datasource_type"] == "file"
results["s01-parse"]["crowdsecurity/proxmox-logs"][1].Evt.Meta["log_type"] == "pve_failed-auth"

```

Thanks ! 🙂

---

<div class="post-metadata">

**Author:** ![thibault](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/thibault/32/2_2.png) [@thibault](https://discourse.crowdsec.net/u/thibault)\
**Post date:** [January 4, 2022, 10:43am UTC](https://discourse.crowdsec.net/t/proxmox-failed-auth-parser/505/4 "2022-01-04T10:43:30Z")

</div>

Awesome 🙂  
Would you mind contributing it to the hub ? [Hub | CrowdSec](https://doc.crowdsec.net/docs/contributing/contributing_hub)

---

<div class="post-metadata">

**Author:** ![unam](https://avatars.discourse-cdn.com/v4/letter/u/ecae2f/32.png) [@unam](https://discourse.crowdsec.net/u/unam)\
**Post date:** [January 4, 2022, 10:52am UTC](https://discourse.crowdsec.net/t/proxmox-failed-auth-parser/505/5 "2022-01-04T10:52:29Z")

</div>

Yep that was the idea, I was looking for a product I daily use to try writing a crowdsec parser and start contributing.

I keep reading the doc and doing some tests on my side, I also have to learn how to detect a bruteforce using this parser.  
When everything will be ok, I’ll submit 🙂