Trigger/Ban ssh root connection

crowdsec
1

Hi all,
I try to create simple scenario in order to ban ssh root connection as soon as it fail.
This scenario is ok but a little bit direct :

type: trigger
name: local/ssh-root
description: "ban root connection"
filter: "evt.Meta.log_type == 'ssh_failed-auth'"
groupby: evt.Meta.source_ip
blackhole: 1m
  #reprocess: true
labels:
 service: ssh
 type: bruteforce
 remediation: true

It works. But i would like to make sure and change filter with :

filter: "evt.Meta.log_type == 'ssh_failed-auth' and evt.Parsed.message contains 'user=root'"

This last filter never match. It’s my first scenario, is it possible to do that ?
Thanks a lot,
Stephane.

2

Yeah so checking our sshd parser you can see we set the failed user as a Meta property

https://hub.crowdsec.net/author/crowdsecurity/configurations/sshd-logs

So you should be able to set the filter too:

filter: "evt.Meta.log_type == 'ssh_failed-auth' and evt.Meta.target_user == 'root'"
1 Like
3

Hi @iiAmLoz
I tried this, but when i run command below, the evt.Meta.target_user is empty :face_with_open_eyes_and_hand_over_mouth:

Log entry :

Oct  1 00:01:41 minipc1 sshd[538922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root

Explain :

sudo cscli explain -v --file /tmp/log2 --type=syslog                                                                                                                                   ο‰’ 18s dugravot6@minipc1 ο€— 11:49:15
line: Oct  1 00:01:41 minipc1 sshd[538922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root
        β”œ s00-raw                                                                                                      
        |       β”” 🟒 crowdsecurity/syslog-logs (+9 ~9)                          
        |               β”” update evt.ExpectMode : %!s(int=0) -> 1                
        |               β”” update evt.Stage :  -> s01-parse                      
        |               β”” update evt.Line.Raw :  -> Oct  1 00:01:41 minipc1 sshd[538922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root
        |               β”” update evt.Line.Src :  -> /tmp/log2
        |               β”” update evt.Line.Time : 0001-01-01 00:00:00 +0000 UTC -> 2023-10-02 09:49:20.136747444 +0000 UTC
        |               β”” create evt.Line.Labels.type : syslog                   
        |               β”” update evt.Line.Process : %!s(bool=false) -> true      
        |               β”” update evt.Line.Module :  -> file                                                            
        |               β”” create evt.Parsed.logsource : syslog                                                         
        |               β”” create evt.Parsed.message : pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root
        |               β”” create evt.Parsed.pid : 538922                                                                                                                                                                                      
        |               β”” create evt.Parsed.priority :                                                                                                                                                                                        
        |               β”” create evt.Parsed.program : sshd                                                                                                                                                                                    
        |               β”” create evt.Parsed.timestamp : Oct  1 00:01:41                                                                                                                                                                       
        |               β”” create evt.Parsed.timestamp8601 :                                                                                                                                                                                   
        |               β”” create evt.Parsed.facility :                                                                                                                                                                                        
        |               β”” update evt.Time : 0001-01-01 00:00:00 +0000 UTC -> 2023-10-02 09:49:20.136802472 +0000 UTC   
        |               β”” update evt.StrTime :  -> Oct  1 00:01:41                                                     
        β”œ s01-parse                                                                                                    
        |       β”œ πŸ”΄ cowrie-logs                          
        |       β”œ πŸ”΄ crowdsecurity/apache2-logs                                                                                                                                                                                               
        |       β”œ πŸ”΄ crowdsecurity/dovecot-logs                                                                        
        |       β”œ πŸ”΄ crowdsecurity/iptables-logs
        |       β”œ πŸ”΄ crowdsecurity/modsecurity
        |       β”œ πŸ”΄ crowdsecurity/mysql-logs
        |       β”œ πŸ”΄ crowdsecurity/nginx-logs
        |       β”œ πŸ”΄ crowdsecurity/postfix-logs
        |       β”œ πŸ”΄ crowdsecurity/postscreen-logs
        |       β”œ πŸ”΄ crowdsecurity/smb-logs
        |       β”” 🟒 crowdsecurity/sshd-logs (+5 ~1)
        |               β”” update evt.Stage : s01-parse -> s02-enrich
        |               β”” create evt.Parsed.source_ip : 1.2.3.4
        |               β”” create evt.Parsed.sshd_invalid_user :  
        |               β”” create evt.Meta.service : ssh
        |               β”” create evt.Meta.target_user :  
        |               β”” create evt.Meta.log_type : ssh_failed-auth
        β”œ s02-enrich
        |       β”œ 🟒 crowdsecurity/dateparse-enrich (+1 ~2)
        |               β”œ create evt.Enriched.MarshaledTime : 2023-10-01T00:01:41Z
        |               β”œ update evt.Time : 2023-10-02 09:49:20.136802472 +0000 UTC -> 2023-10-01 00:01:41 +0000 UTC
        |               β”œ update evt.MarshaledTime :  -> 2023-10-01T00:01:41Z
        |       β”œ πŸ”΄ crowdsecurity/geoip-enrich
        |       β”œ πŸ”΄ crowdsecurity/http-logs
        |       β”œ πŸ”΄ crowdsecurity/naxsi-logs
        |       β”” 🟒 crowdsecurity/whitelists (unchanged)
        β”œ-------- parser success 🟒
        β”œ Scenarios
                β”œ 🟒 crowdsecurity/ssh-bf
                β”œ 🟒 crowdsecurity/ssh-bf_user-enum
                β”œ 🟒 crowdsecurity/ssh-slow-bf
                β”” 🟒 crowdsecurity/ssh-slow-bf_user-enum

Any idea ?

4

Indeed, It seems that the ban is well done. Even if the evt.Meta.target_user is empty.

5

This works fine for me?

$ cscli explain --log 'Oct  1 00:01:41 minipc1 sshd[538922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root' --type syslog -v
line: Oct  1 00:01:41 minipc1 sshd[538922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root
	β”œ s00-raw
	|	β”” 🟒 crowdsecurity/syslog-logs (+12 ~9)
	|		β”” update evt.ExpectMode : %!s(int=0) -> 1
	|		β”” update evt.Stage :  -> s01-parse
	|		β”” update evt.Line.Raw :  -> Oct  1 00:01:41 minipc1 sshd[538922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root
	|		β”” update evt.Line.Src :  -> /tmp/cscli_explain861569487/cscli_test_tmp.log
	|		β”” update evt.Line.Time : 0001-01-01 00:00:00 +0000 UTC -> 2023-10-02 10:06:53.538351249 +0000 UTC
	|		β”” create evt.Line.Labels.type : syslog
	|		β”” update evt.Line.Process : %!s(bool=false) -> true
	|		β”” update evt.Line.Module :  -> file
	|		β”” create evt.Parsed.pid : 538922
	|		β”” create evt.Parsed.priority : 
	|		β”” create evt.Parsed.program : sshd
	|		β”” create evt.Parsed.timestamp : Oct  1 00:01:41
	|		β”” create evt.Parsed.timestamp8601 : 
	|		β”” create evt.Parsed.facility : 
	|		β”” create evt.Parsed.logsource : syslog
	|		β”” create evt.Parsed.message : pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root
	|		β”” update evt.Time : 0001-01-01 00:00:00 +0000 UTC -> 2023-10-02 10:06:53.538395487 +0000 UTC
	|		β”” update evt.StrTime :  -> Oct  1 00:01:41
	|		β”” create evt.Meta.machine : minipc1
	|		β”” create evt.Meta.datasource_path : /tmp/cscli_explain861569487/cscli_test_tmp.log
	|		β”” create evt.Meta.datasource_type : file
	β”œ s01-parse
	|	β”œ 🟒 crowdsecurity/sshd-logs (+9 ~1)
	|		β”œ update evt.Stage : s01-parse -> s02-enrich
	|		β”œ create evt.Parsed.pam_type : unix
	|		β”œ create evt.Parsed.sshd_invalid_user : root
	|		β”œ create evt.Parsed.sshd_client_ip : 1.2.3.4
	|		β”œ create evt.Parsed.uid : 0
	|		β”œ create evt.Parsed.euid : 0
	|		β”œ create evt.Meta.log_type : ssh_failed-auth
	|		β”œ create evt.Meta.service : ssh
	|		β”œ create evt.Meta.source_ip : 1.2.3.4
	|		β”œ create evt.Meta.target_user : root
	β”œ s02-enrich
	|	β”œ 🟒 crowdsecurity/dateparse-enrich (+2 ~2)
	|		β”œ create evt.Enriched.MarshaledTime : 2023-10-01T00:01:41Z
	|		β”œ update evt.Time : 2023-10-02 10:06:53.538395487 +0000 UTC -> 2023-10-01 00:01:41 +0000 UTC
	|		β”œ update evt.MarshaledTime :  -> 2023-10-01T00:01:41Z
	|		β”œ create evt.Meta.timestamp : 2023-10-01T00:01:41Z
	|	β”œ 🟒 crowdsecurity/geoip-enrich (+10)
	|		β”œ create evt.Enriched.ASNumber : 0
	|		β”œ create evt.Enriched.IsInEU : false
	|		β”œ create evt.Enriched.IsoCode : AU
	|		β”œ create evt.Enriched.Latitude : -33.494000
	|		β”œ create evt.Enriched.Longitude : 143.210400
	|		β”œ create evt.Enriched.ASNNumber : 0
	|		β”œ create evt.Enriched.ASNOrg : 
	|		β”œ create evt.Meta.IsInEU : false
	|		β”œ create evt.Meta.ASNNumber : 0
	|		β”œ create evt.Meta.IsoCode : AU
	β”œ-------- parser success 🟒
	β”œ Scenarios
		β”œ 🟒 crowdsecurity/ssh-bf
		β”œ 🟒 crowdsecurity/ssh-bf_user-enum
		β”œ 🟒 crowdsecurity/ssh-slow-bf
		β”” 🟒 crowdsecurity/ssh-slow-bf_user-enum

Can you ensure your parsers / version is up to date via:

cscli hub update
cscli hub upgrade
6

Yes, it’s up to date on this debian. I notice also that geoip failed.
It works well (as you) on 2 another virtual machines (one debian and one centos7).
I will try to reinstall crowdsec.
Thank for your help !

7

@iiAmLoz
After reinstall crowdsec (…) it works as expected !

1 Like