From d42febf36d34b8747172d65d4b8c73c06988034b Mon Sep 17 00:00:00 2001 From: Chris Petersen Date: Fri, 1 Sep 2006 20:54:01 +0000 Subject: [PATCH 01/85] auto-import sec-2.3.3-4 on branch devel from sec-2.3.3-4.src.rpm --- .cvsignore | 1 + 001_init.sec | 19 +++ amavisd.sec | 18 +++ bsd-MONITOR.sec | 54 +++++++++ bsd-PHYSMOD.sec | 46 ++++++++ bsd-USERACT.sec | 76 ++++++++++++ clamav.sec | 8 ++ conf.README | 10 ++ cvs.sec | 36 ++++++ dameware.sec | 15 +++ dbi-example.sec | 25 ++++ general.sec | 302 +++++++++++++++++++++++++++++++++++++++++++++++ hp-openview.sec | 110 +++++++++++++++++ labrea.sec | 29 +++++ mpd.sec | 18 +++ pix-security.sec | 241 +++++++++++++++++++++++++++++++++++++ pix-url.sec | 75 ++++++++++++ portscan.sec | 40 +++++++ sec.init | 88 ++++++++++++++ sec.logrotate | 8 ++ sec.spec | 235 ++++++++++++++++++++++++++++++++++++ sec.sysconfig | 25 ++++ snort.sec | 157 ++++++++++++++++++++++++ snortsam.sec | 70 +++++++++++ sources | 1 + ssh-brute.sec | 67 +++++++++++ ssh.sec | 253 +++++++++++++++++++++++++++++++++++++++ syslog-ng.txt | 95 +++++++++++++++ vtund.sec | 71 +++++++++++ windows.sec | 37 ++++++ 30 files changed, 2230 insertions(+) create mode 100644 001_init.sec create mode 100644 amavisd.sec create mode 100644 bsd-MONITOR.sec create mode 100644 bsd-PHYSMOD.sec create mode 100644 bsd-USERACT.sec create mode 100644 clamav.sec create mode 100644 conf.README create mode 100644 cvs.sec create mode 100644 dameware.sec create mode 100644 dbi-example.sec create mode 100644 general.sec create mode 100644 hp-openview.sec create mode 100644 labrea.sec create mode 100644 mpd.sec create mode 100644 pix-security.sec create mode 100644 pix-url.sec create mode 100644 portscan.sec create mode 100755 sec.init create mode 100644 sec.logrotate create mode 100644 sec.spec create mode 100644 sec.sysconfig create mode 100644 snort.sec create mode 100644 snortsam.sec create mode 100644 ssh-brute.sec create mode 100644 ssh.sec create mode 100644 syslog-ng.txt create mode 100644 vtund.sec create mode 100644 windows.sec diff --git a/.cvsignore b/.cvsignore index e69de29..e066934 100644 --- a/.cvsignore +++ b/.cvsignore @@ -0,0 +1 @@ +sec-2.3.3.tar.gz diff --git a/001_init.sec b/001_init.sec new file mode 100644 index 0000000..2858f15 --- /dev/null +++ b/001_init.sec @@ -0,0 +1,19 @@ +### Logfile & global variable initialization + +type = Single +ptype = RegExp +pattern = (SEC_STARTUP|SEC_RESTART|SEC_SHUTDOWN) +desc = SEC internal message +action = assign %mailto root@localhost; \ + assign %logfile /var/log/sec; \ + shellcmd /bin/echo -e -- "\n%t %s : $0\n" >> %logfile; \ + add SECPROD %t "starting : %s / $0" + +### Daily SEC report + +type = Calendar +time = 44 4 * * * +desc = Daily report +action = add SECPROD %t "Mailing report : '%s' to %mailto"; \ + report SECPROD /bin/mail -s "SEC REPORT: %s" %mailto + diff --git a/amavisd.sec b/amavisd.sec new file mode 100644 index 0000000..d718395 --- /dev/null +++ b/amavisd.sec @@ -0,0 +1,18 @@ +#Amavisd events + + +#Sep 4 15:43:02 xxxxx clamd[581]: /var/amavisd/amavis-20050904T153955-46858/parts/part-00001: HTML.Phishing.Bank-1 FOUND +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+clamd\[\d+\]: .*amavis-200\d+.*: (.*) FOUND +desc=$0 +action=add GENERAL_REPORT CLAMD: $2 on $1 + +#Sep 4 00:02:46 xxxxx amavis[57825]: (57825-12) TROUBLE in check_mail: creating_partsdir FAILED: DBD::mysql::st execute failed: L +ost connection to MySQL server during query at (eval 53) line 238, line 1789. +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+amavis\[\d+\]: .* TROUBLE .* +desc=$0 +action=add GENERAL_REPORT AMAVISD: $1: %s + diff --git a/bsd-MONITOR.sec b/bsd-MONITOR.sec new file mode 100644 index 0000000..302e0de --- /dev/null +++ b/bsd-MONITOR.sec @@ -0,0 +1,54 @@ +# +# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html +# +# SEC rules to pick up disruptive monitoring +# events. +# +#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR) +#---------------------------------------------------------------------- +#Nov 15 20:02:48 foohost syslogd: exiting on signal 15 +#Nov 22 02:00:02 foohost syslogd: restart +#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled +#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled +# + +# +# Syslog Exit +# ----------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+) +desc=$0 +action=write - MONITOR: $1 syslog exit on signal $2 at %t + +# +# Syslog Restart +# --------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart +desc=$0 +action=write - MONITOR: $1 syslog restart at %t + +# +# Syslog Exit +# ----------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+) +desc=$0 +action=write - MONITOR: $1 $2 promiscuous mode $3 at %t + +# +# Swapspace failure +# + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+kernel: swap_pager_getswapspace\(\S\): .* +desc=$0 +action=pipe '$1 GET SWAP FAILURE: %s' /usr/bin/mail -s "SWAP SPACE FAIL on $1" alerts@yourdomain.com + diff --git a/bsd-PHYSMOD.sec b/bsd-PHYSMOD.sec new file mode 100644 index 0000000..bb44dea --- /dev/null +++ b/bsd-PHYSMOD.sec @@ -0,0 +1,46 @@ +# +# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html +# +# PHYSMOD.conf - Events concerning physical modifications +# to the system. +# +# +#Logs involving physical modifications (PHYSMOD) +#------------------------------------------------ +#Nov 14 21:11:19 foohost /kernel: pccard: card inserted, slot 0 +#Nov 14 22:28:09 foohost /kernel: pccard: card removed, slot 0 +#Nov 12 19:46:31 foohost /kernel: de0: link down: cable problem? +#Nov 12 19:46:42 foohost /kernel: de0: autosense failed: cable problem? +#Oct 18 06:26:37 foohost pccardd[49]: ep0: 3Com Corporation (/3C589/) inserted. +#Oct 18 06:26:42 foohost pccardd[49]: pccardd started +# + +# +# PCMCIA Card Insertion, Removal +# -------------------------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pccard: card (\S+), slot (\d+) +desc=$0 +action=write - PHYSMOD: $1 pccard: card $2 in slot $3 at %t + +# +# PCMCIA Card Daemon +# -------------------------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+pccardd\[\d+\]: (.*) +desc=$0 +action=write - PHYSMOD: $1 pccardd: $2 at %t + +# +# Cabling Problem +# ---------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem +desc=$0 +action=write - PHYSMOD: $1 cable problem on $2, text: $3 at %t diff --git a/bsd-USERACT.sec b/bsd-USERACT.sec new file mode 100644 index 0000000..44227a9 --- /dev/null +++ b/bsd-USERACT.sec @@ -0,0 +1,76 @@ +# +# From http://sixshooter.v6.thrupoint.net/SEC-examples/article.html +# +# Events concerning user activities. +# +#Logs involving logins, change of UID and privilege escalations (USERACT) +#------------------------------------------------------------------------- +#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1 +#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100 +#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for jpb from 192.168.1.1 port 1077 ssh2 +#Nov 14 12:55:29 foohost sshd[3425]: Accepted keyboard-interactive/pam for jpb from fe80::2c0:4fff:fe18:13fd%ep0 port 27492 ssh2 +#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2 +#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql +#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0 +#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1 +#Oct 18 06:11:11 foohost login: login on ttyv0 as root +#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 +#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 +#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 +# + +# +# sshd Problems +# -------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) +desc=$0 +action=write - USERACT: $1 sshd $2 problem, text: $3 at %t + +# +# sshd Accepted +# -------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*) +desc=$0 +action=write - USERACT: $1 sshd accepted login, text: $2 at %t + +# +# login FAILURES +# --------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*) +desc=$0 +action=write - USERACT: $1 login $2 on $4 at %t + +# +# su bad +# ----------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+) +desc=$0 +action=write - USERACT: $1 su: $2 $3 to $4 on $5 at %t + +#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 +#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 +#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 +# +# +# su good to root +# ----------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+) +desc=$0 +action=write - USERACT: $1 su: $2 to ROOT on $4 at %t + + diff --git a/clamav.sec b/clamav.sec new file mode 100644 index 0000000..6ab594f --- /dev/null +++ b/clamav.sec @@ -0,0 +1,8 @@ +#Detects Clamav syslogs and reports them in a general report + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+clamd\[\d+\]: .*amavis-200\d+.*: (.*) FOUND +desc=$0 +action=add GENERAL_REPORT CLAMD: $2 on $1 + diff --git a/conf.README b/conf.README new file mode 100644 index 0000000..a25550f --- /dev/null +++ b/conf.README @@ -0,0 +1,10 @@ +This is the SEC configuration directory. Because SEC usage varies so widely +from user to user, this Fedora Extras package is configured by default to not +run. + +The commented-out default settings in /etc/sysconfig/sec will load any file in +this directory with a .sec suffix. Please look through the example files +included in /etc/sec/examples/ and install the ones you want here (taking into +account that the examples are generic and some of them may need to be tweaked +to work with your setup). You should also read the SEC man page so you have +at least a basic understanding of the SEC configuration commands. diff --git a/cvs.sec b/cvs.sec new file mode 100644 index 0000000..f0f67c4 --- /dev/null +++ b/cvs.sec @@ -0,0 +1,36 @@ + +#Jul 31 19:54:21 xxxx xinetd[2088]: START: cvspserver pid=16385 from=xx.xx.xx.xx + +type=single +desc = cvsp server connection start +ptype=regexp +pattern=([A-z._0-9-]*) xinetd\[\d+\]: START: cvspserver pid=\d+ from=(\d+\.\d+\.\d+\.\d+) +action=add GENERAL_REPORT CVS Connection from $2 on $1 + + +#Aug 5 10:38:29 xxxx cvs: password mismatch for username in /usr/local/cvsroot: PMOv/9hZsf6v. vs. PMMlzZLYrbthY + +type=single +ptype=regexp +pattern=([A-z._0-9-]*) cvs: password mismatch for (.*) in (.*) +desc = cvs login failure +action=pipe '$1 $2 CVS Login Failure: User $2 from $3' /usr/bin/mail -s '$1 $2 CVS Login Failure: $2 from $3' alerts@yourdomain.com + + +#Aug 5 10:38:49 xxxx cvs: attempt to root from account: username + +type=single +ptype=regexp +pattern=([A-z._0-9-]*) cvs: attempt to root from account: (.*) +desc = cvs login to root attempt +action=pipe ' $1 $2 CVS Login to Root Attempt: User $2 ' /usr/bin/mail -s '$1 CVS Login to Root Failure: $2' alerts@yourdomain.com + + +#Aug 5 10:42:37 xxxx cvs: login failure (for /usr/local/cvsroot) + +type=single +ptype=regexp +pattern=([A-z._0-9-]*) cvs: login failure \(for /usr/local/cvsroot\) +desc = cvs login failure +action=pipe '$1 $2 CVS Login Failure ' /usr/bin/mail -s '$1 CVS Login Failure' alerts@yourdomain.com + diff --git a/dameware.sec b/dameware.sec new file mode 100644 index 0000000..ad840a8 --- /dev/null +++ b/dameware.sec @@ -0,0 +1,15 @@ +#Dameware Connect +type=single +ptype=regexp +pattern=([A-z._0-9-]*) DMWRCS: (.*) Connect: (.*) +desc = Dameware Connect +action=add WINDOWS_REPORT DAMEWARE CONNECT: %s; \ +pipe 'DAMEWARE Connect -- : %s' /usr/bin/mail -s 'DAMEWARE CONNECT' alerts@yourdomain.com + + +#Dameware Disconnect +type=single +ptype=regexp +pattern=([A-z._0-9-]*) DMWRCS: (.*) Disconnect: (.*) +desc = Dameware Disconnect +action=add WINDOWS_REPORT DAMEWARE DISCONNECT: %s diff --git a/dbi-example.sec b/dbi-example.sec new file mode 100644 index 0000000..046e1c4 --- /dev/null +++ b/dbi-example.sec @@ -0,0 +1,25 @@ +# to use perl packages, like DBI, you need to start SEC with the *-intevents* flag. +# this rule gets run against the messages file to log events to a central DB. +# not so much for the rule itself, but an example using DBI: +# Submitted by Jason Chambers + +type=Single +ptype=RegExp +pattern=^(\S+\s+\S+\s+\S+)\s+(\S+)\s+(\S+:)\s+(\S+\s+\S+\s+\S+\s+)?(\S+)\s+:\s+\S+\s+;\s+(\S+)\s+;\s+(\S+)\s+;\s+(.*) +desc=update db log +action=assign %H $2;\ + assign %Z $5;\ + assign %U $6;\ + assign %R $7;\ + assign %C $8;\ + assign %N %u;\ + assign %I 0;\ + eval %I (require DBI);\ + eval %D (exit(1) unless %I;\ + $COMMAND = "%C";\ + my $DBH = DBI->connect('DBI:mysql:/DBname/:/DBhost/', '/DBuser/', '/DBpass/');\ + my $SQL = " SQL statement";\ + $DBH->do($SQL);\ + ); + + diff --git a/general.sec b/general.sec new file mode 100644 index 0000000..99856ff --- /dev/null +++ b/general.sec @@ -0,0 +1,302 @@ +# General log events, unix systems. From various sources +# +# Bad su +# ----------- +# +type=Single +ptype=RegExp +desc=$0 +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) +action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@email.com + +type=Single +ptype=RegExp +desc=$0 +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) +action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@email.com + + +# MONITOR.conf - SEC rules to pick up disruptive monitoring +# events. +# +#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR) +#---------------------------------------------------------------------- +#Nov 15 20:02:48 foohost syslogd: exiting on signal 15 +#Nov 22 02:00:02 foohost syslogd: restart +#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled +#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled +# + +# +# Syslog Exit +# ----------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+) +desc=$0 +action=write - MONITOR: $1 syslog exit on signal $2 at %t + +# +# Syslog Restart +# --------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart +desc=$0 +action=write - MONITOR: $1 syslog restart at %t + +# +# Syslog Exit +# ----------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+) +desc=$0 +action=write - MONITOR: $1 $2 promiscuous mode $3 at %t + + +# +# sshd Problems +# -------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) +desc=$0 +action=write - USERACT: $1 sshd $2 problem, text: $3 at %t + +# +# sshd Accepted +# -------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*) +desc=$0 +action=write - USERACT: $1 sshd accepted login, text: $2 at %t + +# +# login FAILURES +# --------------- +# +#type=Single +#ptype=RegExp +#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*) +#desc=$0 +#action=write - USERACT: $1 login $2 on $4 at %t + + +#SSH Auth failure on bsd 5 +#type=Single +#ptype=RegExp +#pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: error: PAM: authentication error for (/S+) from (/S+) +#desc=$0 +#action=pipe 'SSHD: 1 $1 2 $2 3 $3 to 4 $4 on 5 $5 at %t' /usr/bin/mail -s "SSHD: $1 $2 $3 to $4 on $5 at %t' + +# +# su bad +# ----------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+) +desc=$0 +action=pipe 'USER: $1 SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' + +#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 +#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 +#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 +# +# +# su good to root +# ----------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+) +desc=$0 +action=pipe 'USER: $1 GOOD SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' +#action=write - USERACT: $1 su: $2 to ROOT on $4 at %t + +# +# Cabling Problem +# ---------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem +desc=$0 +action=event 0 $1 PHYSMOD:ORANGE cable problem on $2, text: $3 at %t + + + +# USERACT - Events concerning user activities. +# +# Sample BSD logs involving logins, change of UID and privilege escalations. +#--------------------------------------------------------------------------- +#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1 +#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100 +#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for foouser from 192.168.1.1 port 1077 ssh2 +#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2 +#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql +#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0 +#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1 +#Oct 18 06:11:11 foohost login: login on ttyv0 as root +#Nov 10 19:40:03 foohost su: foouser to root on /dev/ttyp0 +#Nov 18 09:37:38 foohost su: BAD SU foouser to root on /dev/ttyp3 +#Nov 22 12:26:44 foohost su: BAD SU goodboy to root on /dev/ttyp0 +# + +# +# sshd Problems +# -------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) +desc=$0 +action=pipe 'USER: $1 su: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' +#action=event 0 $1 USERACT:YELLOW sshd $2 problem, text: $3 at %t + +# +# login FAILURES +# --------------- +# ORANGE +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(sshd|login): (.*?FAILURE.)(.*?ON) (.*) +desc=$0 +action=pipe 'USER: $1: Login Failure $2 on $4 at %t' /usr/bin/mail -s "USER: $1 su: $2 $3 to $4 on $5 at %t' +#action=event 0 $1 USERACT:YELLOW login $2 on $4 at %t + + +# NETWACT - SEC rules to pick up suspicious network events. +# +# Sample BSD logs involving odd or suspicious network activity. +#-------------------------------------------------------------- +#Jun 3 17:46:24 foohost named[38298]: client 10.12.127.176#3714: request has invalid signature: tsig verify failure +#Apr 14 16:23:08 foohost /kernel: arp: 10.10.152.12 moved from 00:90:27:37:35:cf to 00:d0:59:aa:61:11 on de0 +#Apr 1 11:23:39 sixshooter /kernel: Limiting closed port RST response from 368 to 200 packets per second + + +# +# named Dynamic DNS Update rejection +# ---------------------------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+named\[\d+\]: client (\S+): request has invalid signature:(.*) +desc=$0 +action=pipe 'NET: $1 dyndns attempt from $2' /usr/bin/mail -s "NET: $1 dyndns attempt from $2, text: $3 at %t" + +# +# MAC address moved +# ----------------- +# ORANGE +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: arp: (\S+) moved from (\S+) to (\S+) on (\S+) +desc=$0 +action=pipe 'NET: $1 arp moved on $2' /usr/bin/mail -s "NET: $1 arp moved on $2 from: $3 to $4 on $5 at %t" + +# +# DoS RST rate limit +# ------------------ +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Limiting closed port RST response from (\d+) to (\d+) +desc=$0 +action=pipe 'NET: $1 RST limit enforced: $2 to $3 at %t' /usr/bin/mail =s "NET: $1 RST limit enforced: $2 to $3" + + + +# COMPROM - SEC rules to pick up potential system compromise events. +# +# Sample BSD logs involving potential system compromise. +#------------------------------------------------------- +#May 25 18:09:55 foohost ntpd[1325]: ntpd exiting on signal 11 +#Jul 21 18:33:16 foohost /kernel: pid 55454 (ftpd), uid 1001: exited on signal 8 +#Apr 9 12:57:06 foohost /kernel: pid 28039 (telnet), uid 0: exited on signal 3 (core dumped) + +# +# ntpd crash +# ------------------ +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+ntpd\[\d+\]: ntpd exiting on signal (\d+) +desc=$0 +action=pipe 'CRASH: $1 ntpd crashed on signal $2 at %t' /usr/bin/mail -s "CRASH: $1 ntpd crashed" + +# +# Process crash +# ------------------ +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pid \d+ \(\S+\), uid (\d+): exited on signal (\d+) +desc=$0 +action=pipe 'CRASH: $1 $2 crashed on signal $4, uid $3 at %t' /usr/bin/mail -s "CRASH: $1 $2 crashed" + + + +# PROCESS - SEC rules to pick up suspicious process events. +# +# Sample BSD logs involving unusual processes. +#--------------------------------------------- +#Mar 23 08:05:52 foohost thttpd[126]: thttpd/2.25b 29dec2003 starting on port 8090 + +# +# Suspicious processes +# -------------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(thttpd)\[(\d+)\]:(.*) +desc=$0 +action=pipe 'SUSPROC: $1 suspicious process $2 pid $3, text: $4 at %t' /usr/bin/mail -s "SUSPROC: $1 suspicious process $2" + + + +# SHUTRST - SEC rules to pick up system shutdown, restart events. +# +# Sample BSD logs involving system shutdown and reset. +#----------------------------------------------------- +#Mar 6 16:28:13 foohost reboot: rebooted by foouser +#Jul 15 17:35:49 foohost halt: halted by root +#Mar 6 16:29:17 foohost /kernel: Copyright (c) 1992-2003 The FreeBSD Project. + +# +# Reboot message +# -------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+reboot: rebooted by (\S+) +desc=$0 +action=pipe 'REBOOT: $1 rebooted by $2' /usr/bin/mail -s "REBOOT: $1 rebooted by $2" + +# +# Halt message +# -------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+halt: halted by (\S+) +desc=$0 +action=pipe 'HALT: $1 halted by $2' /usr/bin/mail -s "HALT: $1 halted by $2" + +# +# Restart message +# -------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Copyright \(c\) (\S+) The FreeBSD Project +desc=$0 +action=pipe 'RESTART: $1 restart message at %t' /usr/bin/mail -s "RESTART: $1 restart message" + diff --git a/hp-openview.sec b/hp-openview.sec new file mode 100644 index 0000000..17db678 --- /dev/null +++ b/hp-openview.sec @@ -0,0 +1,110 @@ +################################################################ +# Sample SEC ruleset for HP OpenView ITO +################################################################ + +# process Cisco linkDown/linkUp trap events received from +# HP OpenView ITO trap template through itostream plugin +# Submitted by Risto Vaarandi + +type=PairWithWindow +ptype=RegExp +pattern=node=(\S+).*msg_text=cisco linkdown trap on interface (\S+) +desc=CISCO $1 INTERFACE $2 DOWN +action=event %s; +continue2=TakeNext +ptype2=RegExp +pattern2=node=$1.*msg_text=cisco linkup trap on interface $2 +desc2=CISCO %1 INTERFACE %2 BOUNCE +action2=event %s; +window=20 + +type=SingleWithSuppress +continue=TakeNext +ptype=RegExp +pattern=CISCO (\S+) INTERFACE (\S+) DOWN +desc=cisco $1 interface $2 down +action=reset +1 %s +window=60 + +type=Pair +ptype=RegExp +pattern=CISCO (\S+) INTERFACE (\S+) DOWN +desc=cisco $1 interface $2 down +action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major down +ptype2=RegExp +pattern2=node=$1.*msg_text=cisco linkup trap on interface $2 +desc2=cisco %1 interface %2 up +action2=shellcmd /home/opc_op/cisco_msg.sh %1 %2 normal up +window=86400 + +type=SingleWith2Thresholds +ptype=RegExp +pattern=CISCO (\S+) INTERFACE (\S+) BOUNCE +desc=cisco $1 interface $2 is unstable +action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major unstable +window=3600 +thresh=10 +desc2=cisco $1 interface $2 is stable again +action2=shellcmd /home/opc_op/cisco_msg.sh $1 $2 normal stable +window2=10800 +thresh2=0 + +# +# the cisco_msg.sh script: +# +##!/bin/sh +# +#NODE=$1 +#IF=$2 +#SEV=$3 +#TEXT=$4 +# +## use snmpget utility from Net-SNMP package +#IFNAME=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.2.1.2.2.1.2.$IF` +#DESCR=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.4.1.9.2.2.1.1.28.$IF` +# +#MSG=`echo "Interface $IFNAME ($DESCR) $TEXT" | sed s/\"/\'/g` +# +#/opt/OV/bin/OpC/opcmsg node=$NODE app=cisco obj=if \ +# sev=$SEV msg_grp=Network msg_text="$MSG" +# + + +# process APC ups "not online" trap events received from +# HP OpenView ITO trap template through itostream plugin + +type=SingleWithScript +ptype=RegExp +pattern=node=(\S+).*msg_text=APC ups not online +script=/home/opc_op/check_apc.sh $1 +desc=APC ups is not online! +action=shellcmd /opt/OV/bin/OpC/opcmsg node=$1 app=APC obj=state \ + msg_grp=UPS sev=critical msg_text='%s' + +# +# the check_apc.sh script +# +##!/bin/sh +# +## sleep for a few seconds and check if the UPS error is still present; +## if it is, exit with 0, otherwise exit with 1 +# +#UPS=$1 +#sleep 5 +# +## use snmpget utility from Net-SNMP package +#STATUS=`/usr/bin/snmpget -c public -OQve $UPS .1.3.6.1.4.1.318.1.1.1.4.1.1.0` +# +## According to the APC Powernet MIB the variable .1.3.6.1.4.1.318.1.1.1.4.1.1 +## takes the the following values: unknown(1), onLine(2), onBattery(3), +## onSmartBoost(4), timedSleeping(5), softwareBypass(6), off(7), rebooting(8), +## switchedBypass(9), hardwareFailureBypass(10), sleepingUntilPowerReturn(11), +## and onSmartTrim(12), where onLine(2) is the normal state for the UPS +# +#if [ $STATUS -eq 2 ] +#then +# exit 1 +#else +# exit 0 +#fi +# diff --git a/labrea.sec b/labrea.sec new file mode 100644 index 0000000..040bed2 --- /dev/null +++ b/labrea.sec @@ -0,0 +1,29 @@ +#Labrea tarpit events + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Initial Connect \(tarpitting\): (\d+\.\d+\.\d+\.\d+\s\d+) \-> \d+\.\d+\.\d+\.\d+\s(.*) +desc=$0 +action=add TARPIT_REPORT %t: $1 New Tarpitted Connect from $2 on port $3 + +#type=Single +#ptype=RegExp +#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Additional Activity: (\d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+ (\d+)* +#desc=$0 +#action=add TARPIT_REPORT %t: %s; +# + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Responded to a PING: (d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+ +desc=$0 +action=add TARPIT_REPORT %t: PING Sweep from $@ on $3 + +#Send hourly tarpit report + +type=Calendar +time=0 8,12,20 * * * +desc=Sending tarpit report... +action=report TARPIT_REPORT \ + /usr/bin/mail -s 'Tarpits: Tarpit Victim report' alerts@yourdomain.com; \ + delete TARPIT_REPORT diff --git a/mpd.sec b/mpd.sec new file mode 100644 index 0000000..cd9b476 --- /dev/null +++ b/mpd.sec @@ -0,0 +1,18 @@ + +type=single +desc = mpd connection start +ptype=regexp +pattern=([A-z._0-9-]*) mpd: PPTP connection from (\d+\.\d+\.\d+\.\d+):\d+ +action=add GENERAL_REPORT MPD Start from $2 on $1 + +type=single +ptype=regexp +pattern=([A-z._0-9-]*) mpd: Name: (.*) +desc = mpd user auth +action=add GENERAL_REPORT MPD User $2 Auth on $1 + +type=Single +ptype=RegExp +pattern=([A-z._0-9-]*) mpd: pptp\d: killing connection with (\d+\.\d+\.\d+\.\d+):\d+ +desc=mpd connection end +action=add GENERAL_REPORT MPD Connection end from $2 on $1 diff --git a/pix-security.sec b/pix-security.sec new file mode 100644 index 0000000..fa99013 --- /dev/null +++ b/pix-security.sec @@ -0,0 +1,241 @@ +#################################################################### +# SEC ruleset for Cisco PIX 6.x, 7.x +#################################################################### + +# Process various events from PIX syslog output +# +# Submitted by Chris Sawall +# email: sawall -[at]- gmail -[dot]- com +# Last Updated: 5/20/05 + +# ------------------------------------------------------------------ +# Watch for weird failures - possible trojan/worm +# ------------------------------------------------------------------ + +# Watch for 10 denies within 10 seconds. Especially useful to monitor +# for certain trojans and mass mailers +# +type=SingleWithThreshold +ptype=RegExp +pattern=\s*.*Deny\s+(\w+)\s+src.*:(.*)/.*:(.*)/(\b2\d\b).*$ +desc=Unusual Failures:$1 $4/$2 -> $3 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +window=10 +thresh=10 + +# Monitor for occurrances of certain variant of PHEL trojan destined +# for two different class C networks +# +type=Single +continue=dontcont +ptype=RegExp +pattern=(212\.147\.14[12]\.) +desc=Possible PHEL Trojan (1) +action=create phel_$1; add phel_$1 Local Time = %t; add phel_$1 $0; report phel_$1 /bin/mail -s "%s" email01@domain.com; delete phel_$1 + +# ------------------------------------------------------------------ +# Watch for firewall failovers +# ------------------------------------------------------------------ + +# Firewall failures/failovers +# Works for PIX 7.x + +# Failure of secondary (standby) firewall while primary is active +# Works for PIX 7.x +# +# $1 is the IP address of the primary firewall +# +type=Single +continue=takenext +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Primary\).*$ +desc=Secondary firewall for $1 - failure/reload +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 + +# Failure of secondary (standby) firewall while primary is active +# Works for PIX 7.x +# +# $1 is the IP address of the primary firewall +# +type=Single +continue=takenext +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Secondary\).*$ +desc=Primary firewall for $1 - failure/reload +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 + +# Failure of secondary (active), primary assumes active +# Works for PIX 7.x +# +# The first "desc" and "action" don't really do anything here. But SEC requires them to be present. +# $1 is the IP address of the primary firewall +# +type=Pair +continue=dontcont +ptype=RegExp +pattern=PIX-1-102001:\s+\(Primary\).*$ +desc=$0 +action=logonly +ptype2=RegExp +pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Primary\).*Peer state Standby Ready +desc2=Secondary (was active) firewall ($1) has failed. Primary is now active. +action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +window=5 + +# Failure of primary (active), secondary assumes active +# Works for PIX 7.x +# +# The first "desc" and "action" don't really do anything here. But SEC requires them to be present. +# $1 is the IP address of the primary firewall +# +type=Pair +continue=dontcont +ptype=RegExp +pattern=PIX-1-102001:\s+\(Secondary\).*$ +desc=$0 +action=logonly +ptype2=RegExp +pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Secondary\).*Peer state Standby Ready +desc2=Primary firewall ($1) has failed. Secondary is now active. +action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +window=5 + +# ------------------------------------------------------------------ +# Watch for firewall reloads +# ------------------------------------------------------------------ + +# Manual reload of PIX +# Works for PIX 6.x +# +# $1 is the IP address of the primary firewall +# +type=Single +continue=dontcont +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX reload.*$ +desc=$1 has been manually rebooted +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com ; delete ffo_$1 + +# Manual reload of PIX +# Works for PIX 7.x +# +# $1 is the IP address of the primary firewall +# +type=Single +continue=dontcont +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Orderly reload.*Reload reason:\s(\S+) +desc=$1 has been manually rebooted, reason: $2 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 + +# ------------------------------------------------------------------ +# Watch for SSH logins/failures on firewalls +# ------------------------------------------------------------------ + +# Suppress emails concerning pixbkup account +# In this case, the pixbkup acct is used to backup the PIX firewalls +# Keeping email alerts to a minimum, this skips past these alerts +# +type=Suppress +continue=dontcont +ptype=RegExp +pattern=pixbkup + +# Successful Admin SSH session +# Works for PIX 6.x +# +# Monitor for successful SSH connections to the PIX firewall +# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr +# +type=Single +continue=dontcont +ptype=RegExp +pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'.*to\s(\d+\.\d+\.\d+\.\d+)\/0.*SSH +desc=Admin Auth to $1.$2 -> $3 from $4 +action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# Successful Admin SSH session +# Works for PIX 7.x +# +# Monitor for successful SSH connections to the PIX firewall +# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr +# +type=Single +continue=dontcont +ptype=RegExp +pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'\sfrom\s(\d+\.\d+\.\d+\.\d+)\/0.*/22.*$ +desc=Admin Auth to $1.$2 -> $3 from $4 +action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# Failed Admin SSH session +# Works for PIX 6.x +# +# Monitor for failed SSH attempts to the PIX firewalls +# $1 is the user acct +# +type=Single +continue=takenext +ptype=RegExp +pattern=Authentication failed.*\'(\S+)\'.*SSH +desc=Admin Auth FAILED -> $1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# Failed Admin SSH session +# Works for PIX 7.x +# +# Monitor for failed SSH attempts to the PIX firewalls +# $1 is the user acct +# +type=Single +continue=takenext +ptype=RegExp +pattern=Authentication failed.*\'(\S+)\'.*/22.*$ +desc=Admin Auth FAILED -> $1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# Normal SSH termination +# Works for both PIX 6.x and 7.x +# +# $1 is the IP of the firewall and $2 is the user acct +# +type=Single +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*\"(\S+)\".*terminated normally +desc=ADMIN END $1 -> $2 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# SSH session timeout or abnormal termination +# Works for PIX 6.x +# May work for PIX 7.x - not tested but PIX-6-315011 is the same for 6 and 7. +# +# $1 is the IP of the firewall +# +type=Single +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*disconnected by SSH server +desc=Firewall session END - timeout $1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# ------------------------------------------------------------------ +# Watch for firewall commands +# ------------------------------------------------------------------ + +# Admin executed "write mem" +# Works for both PIX 6.x and 7.x +# +# $1 is the IP of the firewall +type=Single +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*write\sm.* +desc=User wrote config to memory -> $1 +action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@domain.com; delete fwcmd_$1 + +# Watch for HIGH CPU Utilization +# Works for PIX 6.x +# +type=Single +ptype=RegExp +pattern=PIX-.-211003 +desc=HIGH CPU Utilization +action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@domain.com; delete fwcmd_$1 + diff --git a/pix-url.sec b/pix-url.sec new file mode 100644 index 0000000..306169a --- /dev/null +++ b/pix-url.sec @@ -0,0 +1,75 @@ +#################################################################### +# SEC ruleset for Monitoring Keywords +#################################################################### + +# This particular ruleset was designed to monitor PIX syslog traffic +# and watch for keywords in URL traffic. Starting SEC must include +# the -intevents option. +# +# Currently tested for PIX 6.x +# +# Submitted by Chris Sawall +# email: sawall -[at]- gmail -[dot]- com +# Last Updated: 5/20/05 + +# Wait for SEC to start up or be restarted and then read in two lists +# of words. The first being a list of words to watch for and alert on, +# the second list being a list of exclusions for a suppression rule. +# +type=Single +ptype=PerlFunc +pattern=sub { if(($_[0] eq "SEC_STARTUP") || ($_[0] eq "SEC_RESTART")) { @words=`cat /root/watch4badwords`; chomp(@words); $list=join('|', @words); @ewords=`cat /root/watch4excludes`; chomp(@ewords); $excludes=join('|', @ewords);} } +desc=$0 +context=SEC_INTERNAL_EVENT +action=write - Set word list variable; + +# ------------------------------------------------------------------ +# Scan for certain URLs +# ------------------------------------------------------------------ + +# Monitor and match on keywords from the exclusions file and +# suppress reporting on them. +# +type=Suppress +continue=dontcont +ptype=PerlFunc +pattern=sub {($_[0] =~ /($excludes)/) } + +# Monitor for keywords and send an email alert +# +type=Single +ptype=PerlFunc +pattern=sub {($_[0] =~ /($list)/) } +desc=Inappropriate word in URL +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# +# Examples of "watch4badwords" and "watch4excludes" +# +# File should be a return delimited file. The +# script read the file in literally and creates +# an OR statement by putting a pipe (|) between +# all of the keywords. +# +# Be careful on what words are being monitored. +# The word virgin also finds virginia and alerts +# on it. +# +# The following are examples of things that work: +# +# ----> watch4badwords +# +# \bvirgin\b +# \byoung girl\b +# \b[Pp]layboy\b +# pr0n +# hardcore +# +# ----> watch4excludes +# +# \b10\.10\.2\.4\b +# \bcherry tree\b +# cnn.com +# + + diff --git a/portscan.sec b/portscan.sec new file mode 100644 index 0000000..85303af --- /dev/null +++ b/portscan.sec @@ -0,0 +1,40 @@ +################################################################ +# Sample SEC ruleset for "PORTSCAN FROM ip1 TO ip2:port" events +################################################################ + +# process "PORTSCAN FROM ip1 TO ip2:port" events, and if a certain +# source host has scanned the same destination port on more than +# 10 distinct destination hosts during 60 seconds, raise an alarm + +type=Single +ptype=RegExp +pattern=PORTSCAN FROM (\S+) TO \S+:(\d+) +context=!HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2 +continue=TakeNext +desc=Horizontal port sweep started from source $1 to target port $2 +action=eval %o ( $portscans{"$1:$2"} = {} ); \ + create HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2 60 \ + eval %o ( delete $portscans{"$1:$2"} ) + +type=Single +ptype=RegExp +pattern=PORTSCAN FROM (\S+) TO (\S+):(\d+) +context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 +continue=TakeNext +desc=Scanned destination IP: $2 +action=eval %o ( $portscans{"$1:$3"}->{$2} = 1 ); \ + add HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 %t: %s;\ + set HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 60 \ + eval %o ( delete $portscans{"$1:$3"} ) + +type=Single +ptype=RegExp +pattern=PORTSCAN FROM (\S+) TO (\S+):(\d+) +context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ + && =( scalar(keys(%{$portscans{"$1:$3"}})) > 10 ) +continue=DontCont +desc=$1 has scanned more than 10 destinations +action=report HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ + mail -s 'Horizontal port sweep from $1 target port $3' root@localhost; \ + delete HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3; \ + eval %o ( delete $portscans{"$1:$3"} ) diff --git a/sec.init b/sec.init new file mode 100755 index 0000000..7c06c9e --- /dev/null +++ b/sec.init @@ -0,0 +1,88 @@ +#!/bin/bash +# +# sec This starts and stops SEC +# +# chkconfig: - 26 74 +# description: Simple Event Correlator script to filter log file entries +# processname: /usr/bin/sec +# config: /etc/sysconfig/sec +# pidfile: /var/run/sec.pid +# + +# Source function library. + . /etc/rc.d/init.d/functions + +# Default to a clean return value + RETVAL=0 + +# Program we'll be executing + EXEC='/usr/bin/sec' + prog='sec' + + [ -f $EXEC ] || exit 0 + +# Source the config + [ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog + +# No options defined means that sec can't run + [ -z "$SEC_ARGS" ] && exit 0 + +# And away we go... + +start() { + for n in `seq 0 $((${#SEC_ARGS[*]} - 1))`; do + echo -n $"Starting $prog instance "$(($n + 1))": " + daemon $EXEC ${SEC_ARGS[$n]} + RETVAL=$? + [ $RETVAL -ne 0 ] && return $RETVAL + done + touch /var/lock/subsys/$prog + return $RETVAL +} + +stop() { + echo -n $"Stopping $prog: " + killproc $prog + RETVAL=$? + echo + [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$prog + return $RETVAL +} + +reload() { + echo -n $"Reloading configuration: " + killproc $prog -HUP + RETVAL=$? + echo + return $RETVAL +} + +restart() { + stop + start +} + +dump() { + echo -n $"Dumping state in /tmp/sec.dump: " + killproc $prog -USR1 + RETVAL=$? + echo + return $RETVAL +} + +sec_status() { + status $prog +} + +case "$1" in + start|stop|reload|restart|dump) + $1 + ;; + status) + sec_status + ;; + *) + echo $"Usage: $0 {start|stop|reload|restart|dump|status}" + exit 2 +esac + diff --git a/sec.logrotate b/sec.logrotate new file mode 100644 index 0000000..d536a75 --- /dev/null +++ b/sec.logrotate @@ -0,0 +1,8 @@ +/var/log/sec { + missingok + notifempty + sharedscripts + postrotate + /sbin/service sec reload 2> /dev/null > /dev/null || true + endscript +} diff --git a/sec.spec b/sec.spec new file mode 100644 index 0000000..f531410 --- /dev/null +++ b/sec.spec @@ -0,0 +1,235 @@ +# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169345 +# +# Specfile for SEC, the simple event correlator +# + +Name: sec +Version: 2.3.3 +Release: 4%{?dist} +Summary: SEC (simple event correlator) + +Group: System Environment/Daemons +License: GPL +URL: http://www.estpak.ee/~risto/sec/ + +################################################################################ + +Source0: http://dl.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz +Source1: sec.sysconfig +Source2: sec.init +Source3: sec.logrotate + +# Example files and configuration info +Source100: conf.README +Source101: http://www.estpak.ee/~risto/sec/examples/syslog-ng.txt +Source102: 001_init.sec +Source103: http://www.bleedingsnort.com/sec/amavisd.sec +Source104: http://www.bleedingsnort.com/sec/bsd-MONITOR.sec +Source105: http://www.bleedingsnort.com/sec/bsd-PHYSMOD.sec +Source106: http://www.bleedingsnort.com/sec/bsd-USERACT.sec +Source107: http://www.bleedingsnort.com/sec/clamav.sec +Source108: http://www.bleedingsnort.com/sec/cvs.sec +Source109: http://www.bleedingsnort.com/sec/dameware.sec +Source110: http://www.bleedingsnort.com/sec/dbi-example.sec +Source111: http://www.bleedingsnort.com/sec/general.sec +Source112: http://www.bleedingsnort.com/sec/hp-openview.sec +Source113: http://www.bleedingsnort.com/sec/labrea.sec +Source114: http://www.bleedingsnort.com/sec/mpd.sec +Source115: http://www.bleedingsnort.com/sec/pix-security.sec +Source116: http://www.bleedingsnort.com/sec/pix-url.sec +Source117: http://www.bleedingsnort.com/sec/portscan.sec +Source118: http://www.bleedingsnort.com/sec/snort.sec +Source119: http://www.bleedingsnort.com/sec/snortsam.sec +Source120: http://www.bleedingsnort.com/sec/ssh-brute.sec +Source121: http://www.bleedingsnort.com/sec/ssh.sec +Source122: http://www.bleedingsnort.com/sec/vtund.sec +Source123: http://www.bleedingsnort.com/sec/windows.sec + +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) + +BuildArch: noarch + +################################################################################ + +Requires(post): chkconfig +Requires(postun): initscripts +Requires(preun): initscripts, chkconfig + +# The init script uses arrays, so we need bash +Requires: bash + +# Not required specifically by SEC, but our examples use it so we might as well +# create a requirement for logrotate. +Requires: logrotate + +# Some alternate names for the package that users might search for +Provides: simple-evcorr +Provides: sec.pl + +################################################################################ + +%description +SEC is an open source and platform independent event correlation tool that +was designed to fill the gap between commercial event correlation systems and +homegrown solutions that usually comprise a few simple shell scripts. +SEC accepts input from regular files, named pipes, and standard input, and can +thus be employed as an event correlator for any application that is able to +write its output events to a file stream. + +################################################################################ + +%prep +%setup -q + +# Install some handy tools + mkdir tools/ + mv itostream.c \ + convert.pl \ + tools/ + +# Replace some tags in the config files + sed -i -e 's/@@NAME@@/%{name}/' \ + %{SOURCE1} \ + %{SOURCE2} \ + %{SOURCE3} + +# Fix the bindir in case a user wants it put in a different location + sed -i -e 's#/usr/bin/sec#%{_bindir}/sec#' \ + %{SOURCE2} + +################################################################################ + +%install + +rm -rf $RPM_BUILD_ROOT + +# Create the directories we'll need + install -d -m 755 $RPM_BUILD_ROOT%{_initrddir} + install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/log + install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/run + install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d + install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig + install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples + +# Install SEC and its associated files + install -D -p -m 755 sec.pl $RPM_BUILD_ROOT%{_bindir}/sec + install -D -p -m 644 sec.pl.man $RPM_BUILD_ROOT%{_mandir}/man1/sec.1 + install -p -m 644 %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/sec + install -p -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/sec + install -p -m 755 %{SOURCE2} $RPM_BUILD_ROOT%{_initrddir}/sec + +# Install the example config files and readme + install -p -m 644 %{SOURCE100} \ + $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/README + install -p -m 644 %{SOURCE101} \ + $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/syslog-ng.sec + install -p -m 644 %{SOURCE102} \ + %{SOURCE103} \ + %{SOURCE104} \ + %{SOURCE105} \ + %{SOURCE106} \ + %{SOURCE107} \ + %{SOURCE108} \ + %{SOURCE109} \ + %{SOURCE110} \ + %{SOURCE111} \ + %{SOURCE112} \ + %{SOURCE113} \ + %{SOURCE114} \ + %{SOURCE115} \ + %{SOURCE116} \ + %{SOURCE117} \ + %{SOURCE118} \ + %{SOURCE119} \ + %{SOURCE120} \ + %{SOURCE121} \ + %{SOURCE122} \ + %{SOURCE123} \ + $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/ + +# Replace all "email.com" in sample scripts with an actual fake domain: example.com + grep -rl 'email.com' $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/ \ + | xargs sed -i -e 's/email.com/example.com/g' + +# Create ghost files so rpm doesn't complain about them being gone + touch $RPM_BUILD_ROOT%{_localstatedir}/log/sec + touch $RPM_BUILD_ROOT%{_localstatedir}/run/sec.pid + +################################################################################ + +%post + +if [ $1 = 1 ]; then + /sbin/chkconfig --add sec +fi + +%preun + +if [ $1 = 0 ]; then + /sbin/service sec stop > /dev/null 2>&1 || : + /sbin/chkconfig --del sec +fi + +%postun + +if [ $1 = 1 ]; then + /sbin/service sec condrestart +fi + +%clean + +rm -rf $RPM_BUILD_ROOT + +################################################################################ + +%files + +%defattr(-,root,root,-) +%doc ChangeLog COPYING README tools/ +%config(noreplace) %{_sysconfdir}/sysconfig/sec +%config(noreplace) %verify (not md5 size mtime) %{_sysconfdir}/logrotate.d/sec +%{_sysconfdir}/%{name} +%{_bindir}/sec +%{_initrddir}/sec +%{_mandir}/man1/* +%ghost %verify (not md5 size mtime) %{_localstatedir}/log/sec +%ghost %verify (not md5 size mtime) %{_localstatedir}/run/sec.pid + +################################################################################ + +%changelog + +* Mon Jun 12 2006 Chris Petersen 2.3.3-4 +- Change group to keep rpmlint happy +- Fix permissions on the logrotate script + +* Thu Jun 08 2006 Chris Petersen 2.3.3-3 +- Clean up spec +- Add ghost file entries for the default logfile and pid +- Add logrotate script +- Add more bleedingsnort examples +- Add pid to sec.sysconfig and completely rewrite to handle multiple instances +- Fix download URL +- Fix echo log command in 001_init.sec +- Rewrite sysV init script to handle multiple instances (based loosely on vsftpd) + +* Mon May 01 2006 Didier Moens 2.3.3-2 +- Change init script to not start by default in any runlevel + +* Fri Apr 28 2006 Didier Moens 2.3.3-1 +- Upgrade to upstream 2.3.3 +- Add status to init script + +* Thu Sep 22 2005 Didier Moens 2.3.2-4 +- Update Source locations + +* Thu Sep 22 2005 Didier Moens 2.3.2-3 +- Change permissions on /usr/bin/sec + +* Thu Sep 22 2005 Didier Moens 2.3.2-2 +- Create initial startup rulesets +- Add examples +- Refine init script + +* Wed Sep 21 2005 Didier Moens 2.3.2-1 +- First build diff --git a/sec.sysconfig b/sec.sysconfig new file mode 100644 index 0000000..db96875 --- /dev/null +++ b/sec.sysconfig @@ -0,0 +1,25 @@ +# +# Because SEC usage varies so widely from user to user, it is configured by +# default to not run. Please read `sec --help` for valid options to use in +# this configuration directive, or use the sample defaults included below. +# +# If you would like to run multiple instances of sec in order to track more +# than one log file, you can use also use $SEC_OPTIONS as an array. +# +# Also, please don't forget to read the sec man page or look at the +# configuration options for /etc/sec/. +# + +# +# Default: +# +# SEC_ARGS="-detach -conf=/etc/sec/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.pid" +# + +# +# For Multiple instances of SEC, use something like: +# +# SEC_ARGS[0]="-detach -conf=/etc/sec/sys/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.sys.pid" +# +# SEC_ARGS[1]="-detach -conf=/etc/sec/mail/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.mail.pid" +# diff --git a/snort.sec b/snort.sec new file mode 100644 index 0000000..17e60d6 --- /dev/null +++ b/snort.sec @@ -0,0 +1,157 @@ +#################################################################### +# Sample SEC ruleset for Snort IDS +#################################################################### + +# ------------------------------------------------------------------ +# Handle portscans +# ------------------------------------------------------------------ + +# For every completed portscan, add an entry to the PORTSCAN_REPORT; +# also generate a meta-event ACTIVITY_FROM for the IP + +type=Single +ptype=RegExp +pattern=End of portscan from (([\d\.]+).*) +desc=Portscan from $1 +action=add PORTSCAN_REPORT %t: %s; event ACTIVITY_FROM_$2: %s + + +# ------------------------------------------------------------------ +# Recognize snort alert message and generate corresponding SEC event +# ------------------------------------------------------------------ + +# recognize snort alert message; also generate +# a meta-event ACTIVITY_FROM for the IP + +type=Single +ptype=RegExp +pattern=snort(?:\[\d+\])?: \[[0-9:]+\] (.+|!Malware|!MALWARE) \[(.+)\] \[.*Priority: (\d+)\]: \S+ ([\d\.]+):?\d* -> ([\d\.]+):?\d* +desc=PRIORITY $3 INCIDENT FROM $4 TO $5: $1 [$2] +action=event %s; event ACTIVITY_FROM_$4: $1 + + +## Detect if it's an unwanted event in snort +#type=Single +#ptype=RegExp +#pattern=(MALWARE|Malware) +#desc=$0 +#action=create UNWANTED_EVENT + + +# ------------------------------------------------------------------ +# Handle priority 1 incidents +# ------------------------------------------------------------------ + +# Detect the beginning of priority 1 attack from a certain source IP, +# and send a warning e-mail message that a new attack has begun; +# also create a context for storing a detailed information about the attack + +type=Single +ptype=RegExp +pattern=PRIORITY 1 INCIDENT FROM (\S+) TO \S+: .+ +context=ATTACK_FROM_$1 +continue=TakeNext +desc=Priority 1 attack started from $1 +action=create ATTACK_FROM_$1; add ALERT_REPORT %t: %s; pipe '%t: %s' + + +# For every priority 1 incident, add an entry to the context by its IP; +# if the IP has been quiet for 5 minutes, report the whole attack + +type=Single +ptype=RegExp +pattern=PRIORITY 1 INCIDENT FROM (\S+) TO (\S+): (.+) +context=ATTACK_FROM_$1 +continue=TakeNext +desc=Priority 1 incident from $1 to $2: $3 +action=add ATTACK_FROM_$1 %t: %s; \ + set ATTACK_FROM_$1 300 ( report ATTACK_FROM_$1 \ + /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1 (report)' alerts@email.com ) + + +# ------------------------------------------------------------------ +# Handle incidents by thresholding +# ------------------------------------------------------------------ + +# Count how many _certain type_ of incidents are coming from one source +# if the threshold has been crossed, reset the counting operation started +# by the next rule, in order to avoid duplicate alerts for the same IP + +type=SingleWithThreshold +ptype=RegExp +pattern=PRIORITY (\d+) INCIDENT FROM (\S+) TO \S+: (.+) +continue=TakeNext +desc=Snort has seen >= 30 priority $1 incidents from $2: $3 +action=add ALERT_REPORT %t: %s; \ + reset +1 Snort has seen >= 150 incidents from $2; \ + create TURNOFF_$2 3600 +thresh=30 +window=3600 + + +# Count how many incidents come from one source + +type=SingleWithThreshold +ptype=RegExp +pattern=PRIORITY \d+ INCIDENT FROM (\S+) TO \S+: .+ +context=!TURNOFF_$1 +desc=Snort has seen >= 150 incidents from $1 +action=add ALERT_REPORT %t: %s +thresh=150 +window=7200 + + +# ------------------------------------------------------------------ +# Report IPs that have been active for some time +# ------------------------------------------------------------------ + +# Set up activity contexts for the IP; if the IP has been active for 2 hours, +# and there have been no gaps longer than 30 minutes, report its activities + +type=Single +ptype=RegExp +pattern=ACTIVITY_FROM_(\S+): +context=!ACTIVITY_LIST_FOR_$1 +continue=TakeNext +desc=Create activity contexts for $1 +action=create ACTIVITY_LIST_FOR_$1_LIFETIME; \ + create ACTIVITY_LIST_FOR_$1 7200 ( report ACTIVITY_LIST_FOR_$1 \ + /usr/bin/mail -s 'SNORT: $1 has been active for 2 hours' alerts@email.com; \ + delete ACTIVITY_LIST_FOR_$1_LIFETIME ) + + +# Add the activity event to the context of a given IP, and extend +# the lifetime of activity contexts for 30 minutes for the IP + +type=Single +ptype=RegExp +pattern=ACTIVITY_FROM_(\S+): (.*) +context=ACTIVITY_LIST_FOR_$1 +desc=Activity from $1: $2 +action=add ACTIVITY_LIST_FOR_$1 %t: %s; \ + set ACTIVITY_LIST_FOR_$1_LIFETIME 1800 ( delete ACTIVITY_LIST_FOR_$1 ) + + +# ------------------------------------------------------------------ +# Send reports every day at 9:00 am +# ------------------------------------------------------------------ + +# send daily report about regular alerts + +type=Calendar +time=0 12 * * * +desc=Sending alert report... +action=report ALERT_REPORT \ + /usr/bin/mail -s 'SNORT: Hourly alert report' alerts@email.com; \ + delete ALERT_REPORT + + +# send daily report about portscans + +type=Calendar +time=0 9 * * * +desc=Sending portscan report... +action=report PORTSCAN_REPORT \ + /usr/bin/mail -s 'SNORT: daily portscan report' alerts@email.com; \ + delete PORTSCAN_REPORT + diff --git a/snortsam.sec b/snortsam.sec new file mode 100644 index 0000000..b0a687c --- /dev/null +++ b/snortsam.sec @@ -0,0 +1,70 @@ + + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Error: Could not bind socket. +desc = $0 +action=pipe '$1 Snortsam Bind Failed -- NEEDS ATTENTION!: %s' /usr/bin/mail -s "Snortsam Bind Failure: NEEDS ATTENTION on $1" alerts@yourdomain.com + + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) root: (.*), email, Error: \[email\] Did not receive a response waiting for banner on mail server at (.*) +desc = $0 +action=add SNORTSAM_REPORT $1 Couldn't email through $3 : %s + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) snortsam, Extending block for host ([A-z._0-9-]*) completely for (.*) +desc = $0 +action=add SNORTSAM_REPORT $1 Extending Block for $3 for $4 + + +#type=single +#ptype=regexp +#pattern=([A-Za-z0-9._-]+)snortsam\[([0-9]+)\]: [*], [:0-9]+, -, ipf, (.*) Failed +#desc = Snortsam ipf error +#action=pipe '$1 Snortsam IPF Command Failed' /usr/bin/mail -s "%s" alerts@yourdomain.com +##action=add SNORTSAM_REPORT ERROR $1 IPF Command Failure: $2 + + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Starting to listen for Snort alerts. +desc = $0 +action=add SNORTSAM_REPORT $1 Snortsam Startup: %s + + +#type=single +#ptype=regexp +#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Removing (.*) complete block for host (.*). +#desc = $0 +#action=add SNORTSAM_REPORT $1 Snortsam Removing Block: %s + +#type=single +#ptype=regexp +#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Blocking host (.*) completely for (.*) \((Sig_ID: \d+\))\. +#desc = $0 +#action=add SNORTSAM_REPORT $1 Snortsam Block: %s + + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) root: (.*) ipf, Error: Command (.*) Failed +desc = $0 +action=pipe '$1 Snortsam IPF Command Failed: $1 $2 $3' /usr/bin/mail -s "Snortsam IPF Command Failed on $1" alerts@yourdomain.com + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Snortsam Station .* using wrong password, trying to resync. +desc = $0 +action=pipe '$1 Snortsam Password Failure: $1' /usr/bin/mail -s "Snortsam Password Failure on $1" alerts@yourdomain.com + +#Send hourly snortsam report + +type=Calendar +time=0 * * * * +desc=Sending snortsam report... +action=report SNORTSAM_REPORT \ + /usr/bin/mail -s 'SNORTSAM report' alerts@yourdomain.com; \ + delete SNORTSAM_REPORT diff --git a/sources b/sources index e69de29..8fabc54 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +1b714a7dbb71e165327886a329f6d1e0 sec-2.3.3.tar.gz diff --git a/ssh-brute.sec b/ssh-brute.sec new file mode 100644 index 0000000..78ad658 --- /dev/null +++ b/ssh-brute.sec @@ -0,0 +1,67 @@ +################## ssh brute force attack blocker +# This sec ruleset monitors syslog messages for indications that an ssh brute-force +# login attack is underway. The trigger is an ssh login failure. +# +# If 4 additional syslog messages about ssh login failures from the same +# source address are received within next 1 minute, an iptables firewall +# rule is added to block access from the source IP. +# +# After that, the correlation operation waits until no ssh login failure +# syslog messages from the source IP have been received from the router +# during the last 2 hours, and then the iptables rule is removed. By +# definition, once the IP is blocked, there will be no more connection +# attempt failures logged by ssh (ie., packets will be dropped by the kernel +# before they reach the syslog daemon), so the rule will be flushed after +# 2 hours. +# +# Vulnerabilities of this ruleset are: +# DoS attack: if the attacker is aware of this ruleset, they could +# spoof a series of victim IP addresses (for example, the +# AOL proxy address), thus causing the server running sec +# to deny service to the victim. +# +# persistent firewall rules: +# if the sec daemon crashes or is restarted, any existing rules +# will not be removed after 2hours +# +# window=60 # sliding window (1 minute) for initial event match +# thresh=4 # number of events (ssh login failures from a given IP) that must +# # occur within the window period in order to trigger the action +# +# window2=7200 # sliding window (2 hours) for the second event match +# thresh2=0 +############### +# RCSversion="$Header: /home/fedora/jkeating/pkgs/rpms/sec/devel/ssh-brute.sec,v 1.1 2006/09/01 20:54:01 xris Exp $" +# +# Representative log file entries: +# Aug 28 04:43:03 10.1.1.18 sshd(pam_unix)[22344]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=www.ace.ne.jp +# Aug 28 04:43:03 host sshd[22568]: Failed password for illegal user library from 210.230.187.218 port 55019 ssh2 +# Aug 28 04:42:28 www.somehost.net sshd[9395]: Failed password for illegal user mysql from 210.230.187.218 port 52857 ssh2 +# Aug 28 04:42:28 host sshd[22509]: Failed password for root from 210.230.187.218 port 52960 ssh2 +# Aug 28 04:42:32 www.somehost.net sshd[9397]: Failed password for illegal user oracle from 210.230.187.218 port 53212 ssh2 +# Aug 28 04:42:32 host sshd[22510]: Failed password for illegal user admin from 2 10.230.187.218 port 53243 ssh2 + +# +type=SingleWith2Thresholds +ptype=RegExp +pattern=sshd.*: authentication failure[ ;].* rhost=(\S+) +desc=Multiple failed ssh authentication attempts from $1 +action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP ) +window=60 +thresh=4 +desc2=Pruning iptables firewall rule blocking ssh from $1 +action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP ) +window2=7200 +thresh2=0 + +type=SingleWith2Thresholds +ptype=RegExp +pattern=sshd.*: Failed password for.* user .* from (\S+) +desc=Multiple ssh password failures from $1 +action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP ) +window=60 +thresh=4 +desc2=Pruning iptables firewall rule blocking ssh from $1 +action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; sleep 2; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP ; sleep 2) +window2=7200 +thresh2=0 diff --git a/ssh.sec b/ssh.sec new file mode 100644 index 0000000..b718248 --- /dev/null +++ b/ssh.sec @@ -0,0 +1,253 @@ +# a ruleset to accumulate errors from a parent and child sshd process +# into a single context. This allows reporting of the authenticated +# user information with the error's generated by the child sshd process. + +# note handling of deferred reporting until after tie events received +# is still in flux. My old rules hanlded it by resubmitting all the +# events, but it didn't handle the parent defered reporting +# events. This way is cleaner, but not tested very well. + +type=single +continue=dontcont +ptype=Nregexp +pattern=sshd|SSHD +desc=filter out non-sshd events +action=none + +type=single +continue=dontcont +ptype=TValue +pattern=TRUE +desc=guard for already handled +action=logonly +context = [EVENT_PROCESSED] + +type=single +continue=takenext +ptype=TValue +pattern=TRUE +desc=We will handle. +action=create EVENT_PROCESSED + +## Recognize the start of an ssh session +# link parent and child event contexts. +# +#type=PairWithWindow +#continue=takenext +#desc=Recognize ssh session start for $1[$2] +#ptype=regexp +#pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Connection from ([0-9.]+) port [0-9]+ +#action=pipe session_log_$1_$2 \ +# /usr/bin/mail -s "ssh failed to generate tie event for $1" alerts@email.com +#desc2=Link parent and child contexts +#ptype2=regexp +#pattern2=$1 [A-z0-9]+\[[0-9]+\]: \[[^]]+\] SSHD child process +([0-9]+) spawned by $2 +#action2=copy session_log_%1_$1 %b; \ +# delete session_log_%1_$1; \ +# alias session_log_%1_%2 session_log_%1_$1; \ +# add session_log_%1_$1 $0; \ +# event 0 "sshd: Report %1_$1 if needed"; \ +# alias session_log_owner_%1_%2 session_log_owner_%1_$1 ;\ +# create tie_event_received_%1_%2 ;\ +# alias tie_event_received_%1_%2 tie_event_received_%1_$1 ;\ +# delete ssh_tie_event_needed_%1 +#window=60 + +## recognize login event and save username for later use +type=single +desc=Start login timer +ptype=regexp +pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Accepted (publickey|password) for ([A-z0-9_-]+) from [0-9.]+ port [0-9]+ (.*) +action=add session_log_$1_$2 $0; add session_log_owner_$1_$2 $4 + +# handle logout +type=single +desc=Recognize ssh session end +ptype=regexp +pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Closing connection to ([0-9.]+) +action= delete session_log_$1_$2; delete session_log_owner_$1_$2; \ + delete tie_event_received_$1_$2 + +## ignore ssh IPV6 errors. +# +# Example input: +# Nov 3 06:34:25 corphost sshd[5961]: [ID 800047 auth.error] error: \ +# connect_to ::1 port 5910: Network is unreachable +# +type=suppress +desc = ignore IPV6 errors from ssh +ptype=regexp +pattern=sshd\[[0-9]+\]: \[ID 800047 auth.error\] error: connect_to ::1 port [0-9]+: Network is unreachable + +# because the tie command can come after critical errors are reported, +# we provide a way to generate a report on demand. +type=single +desc=Report immediate on request. +ptype=regexp +pattern=^sshd: Report (.*) if needed$ +context = session_log_report_$1 +action= report session_log_$1 /usr/bin/mailx -s "sshd error on $1" alerts@email.com ;\ + delete session_log_report_$1 + +type=suppress +desc=Discard report immediate event on request. +ptype=regexp +pattern=^sshd: Report (.*) if needed$ + +# INSERT IMMEDIATE REPORT RULES HERE +# rules that should report problems immediately should go here. +# e.g. channel_setup_fwd_listener: cannot listen to port: 1521 +# where port is < 1024, or is some other well known port indicating +# possible hacking. +# +# We have five possible cases: +# Event is from parent process and no info from child process is needed. +# Report normally. +# Event is from parent process and info from child process is needed, +# and tie event received (context tie_event_received__ +# exists). Report normally. +# Event is from parent process and info from child process is needed, +# but tie event not received (context tie_event_received__ +# does not exist). +# Report using child event as trigger. +# Event that has to be reported is from the child process and +# we have received the tie event (context +# tie_event_received__ exists). Just report normally. +# Event that has to be reported is from the child process and +# we haven't received the tie event (context +# tie_event_received__ does not exist). Defer reporting +# until after tie event by setting context +# session_log_report__. +# +# We may need two rules for each event if the event can come before the tie +# event. One rule checks to see if the context ssh_tie_event_needed_$1 +# where $1 is the reporting host. If so then it needs to set the context +# session_log_report__ if generated by the child process. + +# Note we get a less specific report this way. It should be retooled +# to generate a context that the report rule can simply obsolete. +# These events are generated by the child. +type=single +continue=takenext +desc = record ssh channel_setup_fwd_listener error for $1 port < 1025 +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*) +context = $3 < 1025 && ! tie_event_received_$1_$2 +action = add session_log_$1_$2 $0 ; \ + create session_log_report_$1_$2 + +type=single +continue=takenext +desc = record ssh channel_setup_fwd_listener error for $1 port < 1025 +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*) +context = $3 < 1025 && tie_event_received_$1_$2 +action = add session_log_$1_$2 $0 ; \ + report session_log_report_$1_$2 \ + /usr/bin/mailx -s "sshd bind < 1025 on $1" alerts@email.com + +# end immediate rules here + +## report/record ssh bind errors. +# Record ssh bind errors in the session log. Don't report unless +# we have more than 5 of them in a 10 minute period. Then go and +# find out why they are occurring. Probably a frustrated user +# getting the -L options wrong. +# +# We record all events until a 10 minute period has passed with no +# events. If the threshold is exceeded, then we report all events +# recorded during the 10 minute rolling window. +# +# We also group channel_setup_fwd_listener with this. +# +# Example input: +# Nov 4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: bind: \ +# Address already in use +# +type=single +continue=takenext +desc = record ssh bind error for $1 +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use +action = add session_log_$1_$2 $0 ; \ + set ssh_port_forward_errors_$1_$2 600 + +type=singlewiththreshold +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use +context = ssh_port_forward_errors_$1_$2 +desc = send report on ssh forward errors if pass threshold (bind) +action = report session_log_$1_$2 \ + /usr/bin/mailx -s "ssh port forward errors host $1" alerts@email.com; \ + delete ssh_port_forward_errors_$1_$2 +thresh=5 +window=600 + +# Similar idea to ssh bind errors except on +# channel_setup_fwd_listener errors. If we have more than 5 +# of them in a 10 minute period, go and find out why they are occurring. +# Probably a frustrated user getting the -L options wrong. +# +# We record all events until a 10 minute period has passed with no +# events. If the threshold is exceeded, then we report all events +# recorded during the 10 minute rolling window. +# +# Example input: +# Nov 4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: \ +# channel_setup_fwd_listener: cannot listen to port: 1521 +# + +type=single +continue=takenext +desc = record ssh channel_setup_fwd_listener error for $1 +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: +action = add session_log_$1_$2 $0 ; \ + set ssh_channel_setup_errors_$1_$2 600 + +type=singlewiththreshold +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: +context = ssh_channel_setup_errors_$1_$2 +desc = send report on ssh channel setup errors +action = report session_log_$1_$2 \ + /usr/bin/mailx -s "ssh port forward errors host $1" alerts@email.com ; \ + delete ssh_channel_setup_errors_$1_$2 +thresh=5 +window=600 + +# Gather random sshd errors and report after 5 minutes +# +# This could have been set up a number of different ways, but I have one +# rule to create the context only when it doesn't exist, and another rule +# that adds to the context. The create rule also sets the 5 minute timeout +# that will cause the event store to be delivered when it is deleted. +# +# Example input: +# Nov 3 09:48:56 example sshd[7871]: [ID 800047 auth.crit] fatal: \ +# Timeout before authentication for 37.117.12.201 +# +type=single +continue = takenext +ptype=regexp +pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: +desc = create context to report ssh errors for host $1 pid $2 in 5 minutes +context = ! session_log_5min_timer_$1_$2 +action = create session_log_5min_timer_$1_$2 300 report session_log_$1_$2 \ + /usr/bin/mailx -s "ssh errors for host $1 pid $2" alerts@email.com + +type=single +continue = dontcont +ptype=regexp +pattern=([A-Za-z0-9._-]*) sshd\[([0-9]+)\]: +desc = gather ssh errors for host $1 +action = add session_log_$1_$2 $0 + +# Remove the handled context if we reach this point. +type=single +continue=dontcont +ptype=TValue +pattern=TRUE +desc=delete EVENT_PROCESSED +action=delete EVENT_PROCESSED + diff --git a/syslog-ng.txt b/syslog-ng.txt new file mode 100644 index 0000000..8bc90fc --- /dev/null +++ b/syslog-ng.txt @@ -0,0 +1,95 @@ +################################################################ +# SEC ruleset for syslog-ng (contributed by Peter Straka) +################################################################ +#date host proces[pid]: [ID number facility.level] txt + +################################################################ +# internal +################################################################ +# setings parameters for next use +# +# %A,%B,%C,%D = parameters +# %F = output file for write +# %E = email list +# %M = mail program +################################################################ + +#rule beno#1 +type=Single +ptype=RegExp +pattern=(SEC_STARTUP|SEC_RESTART|SEC_SHUTDOWN) +context=SEC_INTERNAL_EVENT +desc=SEC internal +action=shellcmd /bin/echo -- %t %s $0;\ + assign %F /tmp/sec.out;\ + assign %E root@localhost;\ + assign %M /bin/mail -s "SEC production event";\ + add OUT %t "starting";\ + +################################################################ +# statistics +################################################################ + +#rule beno#2 +type=Single +continue=TakeNext +ptype=RegExp +pattern=\s(\S+)\s(\S+)\[\d+\]\:\s\[ID \d+ (\S+)\.(\S+)\]\s +desc=log level and facility counter + host and proces counter +action= assign %A $1;\ + assign %B $2;\ + assign %C $3;\ + assign %D $4;\ + eval %Z ($host{"%A"}++; $proces{"%B"}++; $facility{"%C"}++; $level{"%D"}++;); + +#rule beno#3 +#write statistics and null counters every hour +type=Calendar +time=0 * * * * +desc=log level and facility counter + host and proces counter +action=eval %Z (\ + my @ret; \ + push(@ret,"*******************************\n***** LEVEL:\n");\ + foreach $x (keys %level) {push(@ret,sprintf "%%s=%d\n",$x,$level{$x}) if $level{$x}; $level{$x}=0}; \ + push(@ret,"\n***** FACILITY:\n");\ + foreach $x (keys %facility) {push(@ret,sprintf "%%s=%d\n",$x,$facility{$x}) if $facility{$x}; $facility{$x}=0}; \ + push(@ret,"\n***** HOSTS:\n");\ + foreach $x (keys %host) {push(@ret,sprintf "%%s=%d\n",$x,$host{$x}) if $host{$x}; $host{$x}=0}; \ + push(@ret,"\n***** PROCES:\n");\ + foreach $x (keys %proces) {push(@ret,sprintf "%%s=%d\n",$x,$proces{$x}) if $proces{$x}; $proces{$x}=0}; \ +push(@ret,"\n********************************************************\n");\ + return "@ret"); \ + write %F %t %Z; \ + add STAT %Z; \ + report STAT %M %E; \ + delete STAT ; + +################################################################ +# hourly statistics +################################################################ + +#rule beno#4 +type=Single +continue=TakeNext +ptype=RegExp +pattern=\S+\s+\d+\s+(\d+)\:\d+\:\d+\s +desc=hourly counter +action=assign %A H$1;\ + eval %Z ($hour{%A}++;); + +#rule beno#5 +#write statistics and null counters at midnight +type=Calendar +time=25 16 * * * +desc=hourly counter +action=eval %Z (\ + my @ret; \ + push(@ret,"*******************************\n");\ + foreach $x (keys %hour) {push(@ret,sprintf "%%s:00=%d\n",$x,$hour{$x});$hour{$x}=0}; \ +push(@ret,"\n********************************************************\n");\ + return "@ret"); \ + write %F %t %Z; \ + add HOUR_STAT %Z; \ + report HOUR_STAT %M %E; \ + delete HOUR_STAT + diff --git a/vtund.sec b/vtund.sec new file mode 100644 index 0000000..3eb7ef0 --- /dev/null +++ b/vtund.sec @@ -0,0 +1,71 @@ +#VTUN Events + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (\S+)\[\S\] opened +desc=$0 +action=add GENERAL_REPORT %t: %s; + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: BlowFish encryption initialized +desc=$0 +action=add GENERAL_REPORT %t: VTUN Tunnel Opened on $1 + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: VTun client ver\s+(.*) +desc=$0 +action=add GENERAL_REPORT %t: VTUN Server Started on $1 version $2 + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connecting to (.*) +desc=$0 +action=add GENERAL_REPORT VTUN %s + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Denied connection from (\d+\.\d+\.\d+\.\d+):\d+ +desc=$0 +action=add GENERAL_REPORT %t: VTUN Connection DENIED by $1 from $2 + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connection denied by (.*) +desc=$0 +action=add GENERAL_REPORT %t: VTUN Connection DENIED by $2 for $1 + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Exit +desc=$0 +action=add GENERAL_REPORT %t: VTUN Exit on $1 + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Can't resolv server address: (.*) +desc=$0 +action=add GENERAL_REPORT %t: VTUN Cannot Resolve Target $2 on $1 + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (/S+) closed +desc=$0 +action=add GENERAL_REPORT %t: VTUN Session $2 Closed on $1 + + + +#Send 12 hours vtun report + +type=Calendar +time=0 0,12 * * * +desc=Sending vtun report... +action=report VTUN_REPORT \ + /usr/bin/mail -s 'VTUN: VTUN Report' alerts@yourdomain.com; \ + delete VTUN_REPORT0 + diff --git a/windows.sec b/windows.sec new file mode 100644 index 0000000..34110e8 --- /dev/null +++ b/windows.sec @@ -0,0 +1,37 @@ +#Windows events + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+ESE: N/A: Information Store \(\d+\) Online defragmentation (.*) +desc=$0 +action=add GENERAL_REPORT EXCHANGE DEFRAG%t: %s; + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Userenv: NT AUTHORITY\\SYSTEM: Windows cannot determine the user or computer name\. Return value \(1326\). +desc=$0 +action=add GENERAL_REPORT %t: %s + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Locked Out: Target Account Name: (\S+) .* +desc=$0 +action=pipe '$1 Windows Account Lockout: %s' /usr/bin/mail -s "Windows Account Locked on $1" alerts@yourdomain.com + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Changed: (/S+)\. .* +desc=$0 +action=pipe '$1 Windows Account Change: %s' /usr/bin/mail -s "Windows Account Changed on $1: $2" alerts@yourdomain.com + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+NetBT: N\/A: A duplicate name has been detected on the TCP network\. .* +desc=$0 +action=pipe '$1 Duplicate Netbios Name Detected: %s' /usr/bin/mail -s "Duplicate Netbios Name on $1" alerts@yourdomain.com + + + From 342d24b6901beb528b4326ccb6a53bf3f429f19f Mon Sep 17 00:00:00 2001 From: Chris Petersen Date: Wed, 6 Dec 2006 23:02:29 +0000 Subject: [PATCH 02/85] Upgrade to sec 2.4.0 --- .cvsignore | 2 +- sec.spec | 15 ++++++--------- sources | 2 +- 3 files changed, 8 insertions(+), 11 deletions(-) diff --git a/.cvsignore b/.cvsignore index e066934..d95dd22 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -sec-2.3.3.tar.gz +sec-2.4.0.tar.gz diff --git a/sec.spec b/sec.spec index f531410..bb9e2eb 100644 --- a/sec.spec +++ b/sec.spec @@ -4,8 +4,8 @@ # Name: sec -Version: 2.3.3 -Release: 4%{?dist} +Version: 2.4.0 +Release: 1%{?dist} Summary: SEC (simple event correlator) Group: System Environment/Daemons @@ -81,12 +81,6 @@ write its output events to a file stream. %prep %setup -q -# Install some handy tools - mkdir tools/ - mv itostream.c \ - convert.pl \ - tools/ - # Replace some tags in the config files sed -i -e 's/@@NAME@@/%{name}/' \ %{SOURCE1} \ @@ -185,7 +179,7 @@ rm -rf $RPM_BUILD_ROOT %files %defattr(-,root,root,-) -%doc ChangeLog COPYING README tools/ +%doc ChangeLog COPYING README %config(noreplace) %{_sysconfdir}/sysconfig/sec %config(noreplace) %verify (not md5 size mtime) %{_sysconfdir}/logrotate.d/sec %{_sysconfdir}/%{name} @@ -199,6 +193,9 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Wed Dec 06 2006 Chris Petersen 2.4.0-1 +- Update to 2.4.0 + * Mon Jun 12 2006 Chris Petersen 2.3.3-4 - Change group to keep rpmlint happy - Fix permissions on the logrotate script diff --git a/sources b/sources index 8fabc54..57cc393 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -1b714a7dbb71e165327886a329f6d1e0 sec-2.3.3.tar.gz +3697bdab0664d5392c8e1e66edd3291c sec-2.4.0.tar.gz From d21467118dc848ef66017f0d449ad6ac3e087692 Mon Sep 17 00:00:00 2001 From: Chris Petersen Date: Mon, 28 May 2007 20:06:22 +0000 Subject: [PATCH 03/85] Upgrade to 2.4.1 --- .cvsignore | 2 +- sec.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.cvsignore b/.cvsignore index d95dd22..de0ad9e 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -sec-2.4.0.tar.gz +sec-2.4.1.tar.gz diff --git a/sec.spec b/sec.spec index bb9e2eb..6486856 100644 --- a/sec.spec +++ b/sec.spec @@ -1,10 +1,11 @@ -# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169345 # # Specfile for SEC, the simple event correlator # +# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169345 +# Name: sec -Version: 2.4.0 +Version: 2.4.1 Release: 1%{?dist} Summary: SEC (simple event correlator) @@ -193,6 +194,9 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Mon May 28 2007 Chris Petersen 2.4.1-1 +- Update to 2.4.1 + * Wed Dec 06 2006 Chris Petersen 2.4.0-1 - Update to 2.4.0 diff --git a/sources b/sources index 57cc393..c2c00db 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -3697bdab0664d5392c8e1e66edd3291c sec-2.4.0.tar.gz +f233b3acf7cebdb573f4ff1f441866c3 sec-2.4.1.tar.gz From abbd46d375ca7f902366020934edfcd90def0cd6 Mon Sep 17 00:00:00 2001 From: Tom Callaway Date: Thu, 4 Sep 2008 16:58:27 +0000 Subject: [PATCH 04/85] fix license tag --- sec.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sec.spec b/sec.spec index 6486856..8bd8fe5 100644 --- a/sec.spec +++ b/sec.spec @@ -6,11 +6,11 @@ Name: sec Version: 2.4.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: SEC (simple event correlator) Group: System Environment/Daemons -License: GPL +License: GPLv2+ URL: http://www.estpak.ee/~risto/sec/ ################################################################################ @@ -193,6 +193,8 @@ rm -rf $RPM_BUILD_ROOT ################################################################################ %changelog +* Thu Sep 4 2008 Tom "spot" Callaway - 2.4.1-2 +- fix license tag * Mon May 28 2007 Chris Petersen 2.4.1-1 - Update to 2.4.1 From 7c6f398958f4f3cb62a9e863d77fbbebbd5fb66f Mon Sep 17 00:00:00 2001 From: Jesse Keating Date: Thu, 26 Feb 2009 00:21:13 +0000 Subject: [PATCH 05/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 8bd8fe5..44a24db 100644 --- a/sec.spec +++ b/sec.spec @@ -6,7 +6,7 @@ Name: sec Version: 2.4.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: SEC (simple event correlator) Group: System Environment/Daemons @@ -193,6 +193,9 @@ rm -rf $RPM_BUILD_ROOT ################################################################################ %changelog +* Wed Feb 25 2009 Fedora Release Engineering - 2.4.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + * Thu Sep 4 2008 Tom "spot" Callaway - 2.4.1-2 - fix license tag From a39fb5732b5f7e1ae945d1958553c99ec594115d Mon Sep 17 00:00:00 2001 From: Jesse Keating Date: Mon, 27 Jul 2009 04:07:02 +0000 Subject: [PATCH 06/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 44a24db..a4318c3 100644 --- a/sec.spec +++ b/sec.spec @@ -6,7 +6,7 @@ Name: sec Version: 2.4.1 -Release: 3%{?dist} +Release: 4%{?dist} Summary: SEC (simple event correlator) Group: System Environment/Daemons @@ -193,6 +193,9 @@ rm -rf $RPM_BUILD_ROOT ################################################################################ %changelog +* Sun Jul 26 2009 Fedora Release Engineering - 2.4.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + * Wed Feb 25 2009 Fedora Release Engineering - 2.4.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild From d106b2f2cd463c8355d1f007f1268089de4a8013 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 3 Oct 2009 07:35:41 +0000 Subject: [PATCH 07/85] - New upstream release - SPEC file cleanup - Init script cleanup - Removed some examples because of licensing issues. Upstream has clarified and changed most of the license tags to GPLv2. Additionally, upstream will include the examples in the next release. - Removed a provide statement since a period was in the name and no other package required that special name. --- .cvsignore | 2 +- 001_init.sec | 19 - amavisd.sec | 10 +- bsd-MONITOR.sec | 11 +- bsd-PHYSMOD.sec | 8 +- bsd-USERACT.sec | 7 +- general.sec => bsd-general.sec | 37 +- mpd.sec => bsd-mpd.sec | 8 + cisco-syslog.sec | 477 +++++++++++++++ clamav.sec | 8 - conf.README | 16 +- cvs.sec | 14 +- dameware.sec | 11 +- dbi-example.sec | 25 - hp-openview.sec | 6 +- import.log | 1 + labrea.sec | 11 +- pix-general.sec | 1046 ++++++++++++++++++++++++++++++++ pix-security.sec | 37 +- pix-url.sec | 7 +- portscan.sec | 7 +- sec.init | 144 +++-- sec.logrotate | 2 +- sec.spec | 229 +++---- snort.sec | 16 +- snortsam.sec | 19 +- sources | 2 +- ssh-brute.sec | 12 +- ssh.sec | 21 +- syslog-ng.txt | 95 --- vtund.sec | 20 +- windows.sec | 15 +- 32 files changed, 1879 insertions(+), 464 deletions(-) delete mode 100644 001_init.sec rename general.sec => bsd-general.sec (87%) rename mpd.sec => bsd-mpd.sec (56%) create mode 100644 cisco-syslog.sec delete mode 100644 clamav.sec delete mode 100644 dbi-example.sec create mode 100644 import.log create mode 100644 pix-general.sec delete mode 100644 syslog-ng.txt diff --git a/.cvsignore b/.cvsignore index de0ad9e..d14f9ac 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -sec-2.4.1.tar.gz +sec-2.5.2.tar.gz diff --git a/001_init.sec b/001_init.sec deleted file mode 100644 index 2858f15..0000000 --- a/001_init.sec +++ /dev/null @@ -1,19 +0,0 @@ -### Logfile & global variable initialization - -type = Single -ptype = RegExp -pattern = (SEC_STARTUP|SEC_RESTART|SEC_SHUTDOWN) -desc = SEC internal message -action = assign %mailto root@localhost; \ - assign %logfile /var/log/sec; \ - shellcmd /bin/echo -e -- "\n%t %s : $0\n" >> %logfile; \ - add SECPROD %t "starting : %s / $0" - -### Daily SEC report - -type = Calendar -time = 44 4 * * * -desc = Daily report -action = add SECPROD %t "Mailing report : '%s' to %mailto"; \ - report SECPROD /bin/mail -s "SEC REPORT: %s" %mailto - diff --git a/amavisd.sec b/amavisd.sec index d718395..d022e1c 100644 --- a/amavisd.sec +++ b/amavisd.sec @@ -1,5 +1,11 @@ -#Amavisd events - +############################################################################# +# Amavisd events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# #Sep 4 15:43:02 xxxxx clamd[581]: /var/amavisd/amavis-20050904T153955-46858/parts/part-00001: HTML.Phishing.Bank-1 FOUND type=Single diff --git a/bsd-MONITOR.sec b/bsd-MONITOR.sec index 302e0de..889ec98 100644 --- a/bsd-MONITOR.sec +++ b/bsd-MONITOR.sec @@ -1,9 +1,14 @@ # -# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html -# # SEC rules to pick up disruptive monitoring # events. # +# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html +# +# Copyright (C) 2003-2009 Jim Brown +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +# #Logs involving syslogd disabled or unusual promiscuous mode (MONITOR) #---------------------------------------------------------------------- #Nov 15 20:02:48 foohost syslogd: exiting on signal 15 @@ -50,5 +55,5 @@ type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+kernel: swap_pager_getswapspace\(\S\): .* desc=$0 -action=pipe '$1 GET SWAP FAILURE: %s' /usr/bin/mail -s "SWAP SPACE FAIL on $1" alerts@yourdomain.com +action=pipe '$1 GET SWAP FAILURE: %s' /usr/bin/mail -s "SWAP SPACE FAIL on $1" alerts@example.com diff --git a/bsd-PHYSMOD.sec b/bsd-PHYSMOD.sec index bb44dea..03b348f 100644 --- a/bsd-PHYSMOD.sec +++ b/bsd-PHYSMOD.sec @@ -1,9 +1,13 @@ # -# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html -# # PHYSMOD.conf - Events concerning physical modifications # to the system. # +# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html +# +# Copyright (C) 2003-2009 Jim Brown +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. # #Logs involving physical modifications (PHYSMOD) #------------------------------------------------ diff --git a/bsd-USERACT.sec b/bsd-USERACT.sec index 44227a9..edf2557 100644 --- a/bsd-USERACT.sec +++ b/bsd-USERACT.sec @@ -1,7 +1,12 @@ # +# Events concerning user activities. +# # From http://sixshooter.v6.thrupoint.net/SEC-examples/article.html # -# Events concerning user activities. +# Copyright (C) 2003-2009 Jim Brown +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. # #Logs involving logins, change of UID and privilege escalations (USERACT) #------------------------------------------------------------------------- diff --git a/general.sec b/bsd-general.sec similarity index 87% rename from general.sec rename to bsd-general.sec index 99856ff..457b39b 100644 --- a/general.sec +++ b/bsd-general.sec @@ -1,5 +1,10 @@ # General log events, unix systems. From various sources # +# Copyright (C) 2003-2009 Jim Brown +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +# # Bad su # ----------- # @@ -7,13 +12,13 @@ type=Single ptype=RegExp desc=$0 pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) -action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@email.com +action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com type=Single ptype=RegExp desc=$0 pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) -action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@email.com +action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com # MONITOR.conf - SEC rules to pick up disruptive monitoring @@ -94,7 +99,7 @@ action=write - USERACT: $1 sshd accepted login, text: $2 at %t #ptype=RegExp #pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: error: PAM: authentication error for (/S+) from (/S+) #desc=$0 -#action=pipe 'SSHD: 1 $1 2 $2 3 $3 to 4 $4 on 5 $5 at %t' /usr/bin/mail -s "SSHD: $1 $2 $3 to $4 on $5 at %t' +#action=pipe 'SSHD: 1 $1 2 $2 3 $3 to 4 $4 on 5 $5 at %t' /usr/bin/mail -s "SSHD: $1 $2 $3 to $4 on $5 at %t' alerts@example.com # # su bad @@ -104,7 +109,7 @@ type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+) desc=$0 -action=pipe 'USER: $1 SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' +action=pipe 'USER: $1 SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com #Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 #Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 @@ -118,7 +123,7 @@ type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+) desc=$0 -action=pipe 'USER: $1 GOOD SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' +action=pipe 'USER: $1 GOOD SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com #action=write - USERACT: $1 su: $2 to ROOT on $4 at %t # @@ -158,7 +163,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) desc=$0 -action=pipe 'USER: $1 su: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' +action=pipe 'USER: $1 su: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com #action=event 0 $1 USERACT:YELLOW sshd $2 problem, text: $3 at %t # @@ -169,7 +174,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(sshd|login): (.*?FAILURE.)(.*?ON) (.*) desc=$0 -action=pipe 'USER: $1: Login Failure $2 on $4 at %t' /usr/bin/mail -s "USER: $1 su: $2 $3 to $4 on $5 at %t' +action=pipe 'USER: $1: Login Failure $2 on $4 at %t' /usr/bin/mail -s "USER: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com #action=event 0 $1 USERACT:YELLOW login $2 on $4 at %t @@ -190,7 +195,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+named\[\d+\]: client (\S+): request has invalid signature:(.*) desc=$0 -action=pipe 'NET: $1 dyndns attempt from $2' /usr/bin/mail -s "NET: $1 dyndns attempt from $2, text: $3 at %t" +action=pipe 'NET: $1 dyndns attempt from $2' /usr/bin/mail -s "NET: $1 dyndns attempt from $2, text: $3 at %t" alerts@example.com # # MAC address moved @@ -200,7 +205,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: arp: (\S+) moved from (\S+) to (\S+) on (\S+) desc=$0 -action=pipe 'NET: $1 arp moved on $2' /usr/bin/mail -s "NET: $1 arp moved on $2 from: $3 to $4 on $5 at %t" +action=pipe 'NET: $1 arp moved on $2' /usr/bin/mail -s "NET: $1 arp moved on $2 from: $3 to $4 on $5 at %t" alerts@example.com # # DoS RST rate limit @@ -210,7 +215,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Limiting closed port RST response from (\d+) to (\d+) desc=$0 -action=pipe 'NET: $1 RST limit enforced: $2 to $3 at %t' /usr/bin/mail =s "NET: $1 RST limit enforced: $2 to $3" +action=pipe 'NET: $1 RST limit enforced: $2 to $3 at %t' /usr/bin/mail =s "NET: $1 RST limit enforced: $2 to $3" alerts@example.com @@ -230,7 +235,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+ntpd\[\d+\]: ntpd exiting on signal (\d+) desc=$0 -action=pipe 'CRASH: $1 ntpd crashed on signal $2 at %t' /usr/bin/mail -s "CRASH: $1 ntpd crashed" +action=pipe 'CRASH: $1 ntpd crashed on signal $2 at %t' /usr/bin/mail -s "CRASH: $1 ntpd crashed" alerts@example.com # # Process crash @@ -240,7 +245,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pid \d+ \(\S+\), uid (\d+): exited on signal (\d+) desc=$0 -action=pipe 'CRASH: $1 $2 crashed on signal $4, uid $3 at %t' /usr/bin/mail -s "CRASH: $1 $2 crashed" +action=pipe 'CRASH: $1 $2 crashed on signal $4, uid $3 at %t' /usr/bin/mail -s "CRASH: $1 $2 crashed" alerts@example.com @@ -258,7 +263,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(thttpd)\[(\d+)\]:(.*) desc=$0 -action=pipe 'SUSPROC: $1 suspicious process $2 pid $3, text: $4 at %t' /usr/bin/mail -s "SUSPROC: $1 suspicious process $2" +action=pipe 'SUSPROC: $1 suspicious process $2 pid $3, text: $4 at %t' /usr/bin/mail -s "SUSPROC: $1 suspicious process $2" alerts@example.com @@ -278,7 +283,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+reboot: rebooted by (\S+) desc=$0 -action=pipe 'REBOOT: $1 rebooted by $2' /usr/bin/mail -s "REBOOT: $1 rebooted by $2" +action=pipe 'REBOOT: $1 rebooted by $2' /usr/bin/mail -s "REBOOT: $1 rebooted by $2" alerts@example.com # # Halt message @@ -288,7 +293,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+halt: halted by (\S+) desc=$0 -action=pipe 'HALT: $1 halted by $2' /usr/bin/mail -s "HALT: $1 halted by $2" +action=pipe 'HALT: $1 halted by $2' /usr/bin/mail -s "HALT: $1 halted by $2" alerts@example.com # # Restart message @@ -298,5 +303,5 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Copyright \(c\) (\S+) The FreeBSD Project desc=$0 -action=pipe 'RESTART: $1 restart message at %t' /usr/bin/mail -s "RESTART: $1 restart message" +action=pipe 'RESTART: $1 restart message at %t' /usr/bin/mail -s "RESTART: $1 restart message" alerts@example.com diff --git a/mpd.sec b/bsd-mpd.sec similarity index 56% rename from mpd.sec rename to bsd-mpd.sec index cd9b476..594c556 100644 --- a/mpd.sec +++ b/bsd-mpd.sec @@ -1,3 +1,11 @@ +############################################################################# +# BSD mpd events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# type=single desc = mpd connection start diff --git a/cisco-syslog.sec b/cisco-syslog.sec new file mode 100644 index 0000000..3ee22ea --- /dev/null +++ b/cisco-syslog.sec @@ -0,0 +1,477 @@ +############################################################################# +# SEC rules for processing Cisco syslog messages +# +# Copyright (C) 2008-2009 Omer Ben-Shalom, Risto Vaarandi +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# + +# ----- Process system configuration events ----- + +# System configuration events +# suppressed because we don't care about it +# +type=suppress +ptype=substr +pattern=%SYS-5-CONFIG_I: +desc=device configuration + +# System configuration sync to standby router +# suppressed because we don't care about it +# +type=suppress +ptype=substr +pattern=%PFINIT-SP-5-CONFIG_SYNC: +desc=config sync + +# ----- Process reload and restart events ----- + +# Looks for a reload +# +type=single +continue=takeNext +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD: (.*) +desc=(WARNING) reload requested for $1 +action=pipe '%s details:$2' mail -s 'cisco event' root@example.com + +# Looks for a reload followed by a restart event +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD: +desc=(CRITICAL) $1 RELOAD_PROBLEM +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=($1).*?%SYS-5-RESTART: +desc2=(NOTICE) $1 RELOAD_OK +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=300 + +# Looks for a restart without reload command +# +type=single +ptype=regexp +pattern=(\S+) \d+:.*?%SYS-5-RESTART: +desc=(CRITICAL) $1 restart without reload command +action=pipe '%s' mail -s 'cisco event' root@example.com + +# ----- process SNMP authentication failure events ----- + +# this rule handles the SNMP authentication failures +# only one notification is sent for each source that is doing this per day +# +type=singleWithSuppress +ptype=regexp +pattern=(\S+) \d+:.*?%SNMP-3-AUTHFAIL: Authentication failure for SNMP req from host (\S+) +desc=(WARNING) Auth fail coming from $2 +action=pipe '%s' mail -s 'cisco event' root@example.com +window=86400 + +# ----- process OSPF neighbor change events ----- + +# This rule handles OSPF neighbor changes +# +type=single +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OSPF-5-ADJCHG:.*?Nbr (\S+) on (\S+) from (\S+) to (\S+), (.*) +desc=(MINOR) OSPF adjacency change: Router $1 reports that the neighbor on $3 ($2) changed from state $4 to state $5 detail:$6 +action=event %s; pipe '%s' mail -s 'cisco event' root@example.com + +# This rule escalates to CRITICAL if there are more than 5 neighbor changes +# in 5 seconds +# +type=SingleWithThreshold +ptype=substr +pattern=(MINOR) OSPF adjacency change +desc=(CRITICAL) More than 5 OSPF neighbor changes in 5 seconds +action=pipe '%s' mail -s 'cisco event' root@example.com +thresh=5 +window=5 + +# ----- process HSRP events ----- + +# This rule assembles together all HSRP events +# +type=single +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%STANDBY-6-STATECHANGE: (\S+).*?state (\S+) -> (\S+) +desc=HSRP change for $1 interface $2 - changed from $3 to $4 +action=add HSRP_$1 %t: %s; set HSRP_$1 5 (report HSRP_$1 mail -s 'cisco events' root@example.com) + +# ----- process duplex mismatch events ----- + +# this rule handles the duplex mismatch event +# only one notification is sent for each port that has duplex mismatch +# reported per day +# +type=singleWithSuppress +ptype=regexp +pattern=(\S+) \d+:.*?%CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on (not \S+) \((.*?)\), with (\S+) (\S+) \((.*?)\) +desc=(WARNING) Duplex mismatch between $1 port $2 ($3), other side is $4 port $5 ($6) +action=pipe '%s' mail -s 'cisco event' root@example.com +window=86400 + +# ----- process link down and link up events ----- + +# This rule deals with link down events +# +type=PairWithWindow +ptype=RegExp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINK-3-UPDOWN: Interface (\S+), changed state to down +desc=(MINOR) $1 INTERFACE $2 DOWN and not up in one minute +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=RegExp +pattern2=($1)\s+\d+:.*?%LINK-3-UPDOWN: Interface ($2), changed state to up +desc2=(WARNING) %1 INTERFACE %2 BOUNCE +action2=event %s +window=60 + +# when the first bounce event is seen, create a reporting trigger +# +type=Single +continue=TakeNext +ptype=regexp +pattern=(\S+) INTERFACE \S+ BOUNCE +context=!INTERFACE_BOUNCE_WAIT_$1 +desc=interface bounce summary event for router $1 +action=create INTERFACE_BOUNCE_WAIT_$1 10 (report INTERFACE_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete INTERFACE_BOUNCE_$1) + +# accumulate all interface bounce events into a context +# +type=Single +ptype=regexp +pattern=(\S+) INTERFACE (\S+) BOUNCE +desc=interface bounce for router $1 interface $2 detected +action=add INTERFACE_BOUNCE_$1 %t: %s + +# ----- process line protocol down and line protocol up events ----- + +# This rule deals with protocol up/down events +# +type=PairWithWindow +ptype=RegExp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface (\S+), changed state to down +desc=(MINOR) $1 INTERFACE $2 line protocol DOWN and not up in one minute +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=RegExp +pattern2=($1)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface ($2), changed state to up +desc2=(WARNING) %1 INTERFACE %2 line protocol BOUNCE +action2=event %s +window=60 + +# when the first bounce event is seen, create a reporting trigger +# +type=Single +continue=TakeNext +ptype=regexp +pattern=(\S+) INTERFACE \S+ line protocol BOUNCE +context=!LINE_PROTOCOL_BOUNCE_WAIT_$1 +desc=line protocol bounce for router $1 +action=create LINE_PROTOCOL_BOUNCE_WAIT_$1 10 (report LINE_PROTOCOL_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete LINE_PROTOCOL_BOUNCE_$1) + +# accumulate all line protocol bounce events into a context +# +type=Single +ptype=regexp +pattern=(\S+) INTERFACE (\S+) line protocol BOUNCE +desc=line protocol bounce for router $1 interface $2 detected +action=add LINE_PROTOCOL_BOUNCE_$1 %t: %s + +# ----- process late collision events ----- + +# Late collision alerts +# +type=SingleWithThreshold +ptype=RegExp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%PM_SCP-SP-4-LCP_FW_ABLC: Late collision message from module (\d+), port:(\d+) +desc=(MINOR) Multiple late collision events on $1 module $2 port $3 +action=pipe '%s' mail -s 'cisco event' root@example.com +window=3600 +thresh=5 + +# ----- process host flap events ----- + +# host flapping on single vlan +# +type=SingleWithThreshold +continue=TakeNext +ptype=RegExp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+) +desc=(MINOR) multiple hosts flapping between ports $4 and $5 in $1 vlan $3 +action=pipe '%s' mail -s 'cisco event' root@example.com +window=300 +thresh=5 + +# host flapping on multiple vlans +# +type=SingleWithThreshold +continue=TakeNext +ptype=RegExp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+) +desc=(MINOR) multiple hosts are flapping between ports $4 and $5 in $1 (potentially on multiple VLANs) +action=pipe '%s' mail -s 'cisco event' root@example.com +window=300 +thresh=20 + +# ----- process misc hw events ----- + +# %FILESYS-SP-STDBY-5-DEV:# flash disk removal +# +type=single +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%FILESYS-SP-STDBY-5-DEV:.*?PCMCIA flash card removed from (\S+) +desc=(WARNING) Flash card removed from $1 $2 +action=pipe '%s' mail -s 'cisco event' root@example.com + +# %OIR-SP-STDBY-6-CONSOLE +# +type=suppress +ptype=substr +pattern=%OIR-SP-STDBY-6-CONSOLE +desc=console access to route processor changed + +# %OIR-SP-6-INSCARD: - card inserted +# +type=single +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OIR-SP-6-INSCARD: Card inserted in slot (\d+), (.*) +desc=(HARMLESS) card inserted in $1 slot $2 status:$3 +action=pipe '%s' mail -s 'cisco event' root@example.com + +# ----- process module events ----- + +# %DIAG-SP-3-TEST_FAIL - diagnostics failed on a module +# +type=single +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DIAG-SP-3-TEST_FAIL: Module (\d+): (.*) +desc=(WARNING) diagnostics failed for $1 module $2 detail:$3 +action=pipe '%s' mail -s 'cisco event' root@example.com + +# %SNMP-5-MODULETRAP +# Looks for a module down followed by module up event +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-MODULETRAP: Module (\d+) [Down] Trap +desc=(MINOR) $1 Module DOWN (not back up in a minute) +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=($1) .*? %SNMP-5-MODULETRAP: Module ($2) [Up] Trap +desc2=(WARNING) $1 Module $2 BOUNCE (down and back up within a minute) +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=60 + +# ----- process irrelevant events (by suppressing) ----- + +# %SYS-SP-STDBY-5-RESTART - system restarted part of the boot - interesting? +# +type=suppress +ptype=substr +pattern=SYS-SP-STDBY-5-RESTART +desc=system restarted + +# %DIAG-SP-6-TEST_RUNNING - Running system test +# +type=suppress +ptype=substr +pattern=%DIAG-SP-6-TEST_RUNNING +desc=running diagnostics on a module + +# %FABRIC-SP-5-FABRIC_MODULE_BACKUP - module changed to backup state +# +type=suppress +ptype=substr +pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP +desc=module became backup + +# %DIAG-SP-6-RUN_MINIMUM - diagnostics are run +# +type=suppress +ptype=substr +pattern=%DIAG-SP-6-RUN_MINIMUM +desc=diagnostics running on switch + +# %DIAG-SP-6-DIAG_OK - diagnostics results are OK +# +type=suppress +ptype=substr +pattern=%DIAG-SP-6-DIAG_OK +desc=diagnostics results are OK + +# %PFREDUN-SP-STDBY-6-STANDBY - SSO events +# +type=suppress +ptype=substr +pattern=%PFREDUN-SP-STDBY-6-STANDBY +desc=SSO event (startup) + +# %PFREDUN-SP-STDBY-6-STANDBY - SSO events +# +type=suppress +ptype=substr +pattern=%PFREDUN-SP-6-ACTIVE +desc=SSO event (startup) + +# %FABRIC-SP-5-FABRIC_MODULE_BACKUP: - secondary sup is up and is secondary +# +type=suppress +ptype=substr +pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP: +desc=secondary sup is up and is secondary + +# %PFINIT-SP-5-CONFIG_SYNC - startup config on standby router sync +# +type=suppress +ptype=substr +pattern=%PFINIT-SP-5-CONFIG_SYNC +desc=startup config on standby router sync + +# %C4K_REDUNDANCY - Cayt 4K configuration/vlan database succesful sync +# the success match is to allow fails in sync to not be suppress +# +type=suppress +ptype=regexp +pattern=%C4K_REDUNDANCY.*?success +desc=config sync with standby supervisor + +# %SCP-SP-5-ASYNC_WATERMARK: SCP long queue wait +# the success match is to allow fails in sync to not be suppress +# +type=suppress +ptype=substr +pattern=%SCP-SP-5-ASYNC_WATERMARK: +desc=SCP control protocol pending queue is longer than notification threshold + +# %MLS_RATE-4-DISABLING: - Layer2 Rate Limiters have been disabled. Is this interesting? +# +type=suppress +ptype=substr +pattern=%MLS_RATE-4-DISABLING: +desc=Layer2 Rate Limiters have been disabled + +# ----- process native VLAN mismatch events ----- + +# %CDP-4-NATIVE_VLAN_MISMATCH: - native VLAN mismatch between switches, will repeat every minute until fixed +# +type=singleWithSuppress +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on (\S+) \((\d+)\), with (\S+) (\S+) \((\d+)\) +desc=(MINOR) A native VLAN mistmatch reported between $1 interface $2 (native VLAN $3) and host $4 interface $5 (native VLAN $6) +action=pipe '%s' mail -s 'cisco event' root@example.com +window=60 + +# ----- process snmp trapblock messages ----- + +# %SNMP-3-TRAPBLOCK - A process tried to create a trap it is not entitled to create +# See Cisco http://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi?action=search&counter=0&paging=5&query=SNMP-3-TRAPBLOCK +# +type=suppress +ptype=substr +pattern=%SNMP-3-TRAPBLOCK +desc=a process tried to create a trap it is not entitled to create + +# ----- process chassis alarm events ----- + +# %SNMP-5-CHASSISALARM - this rule handles the tmpAlarm +# +type=pairWithWindow +continue=takeNext +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(ON\) +desc=(MINOR) $1 temprature alarm signaled and not cleared in five minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +continue2=takeNext +ptype2=regexp +pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(OFF\) +desc2=(WARNING) $1 temprature alarm went on and was cleared in under five minutes +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=300 + +# %SNMP-5-CHASSISALARM - this rule handles the minorAlarm +# +type=pairWithWindow +continue=takeNext +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(ON\) +desc=(MINOR) $1 minor alarm reported and not cleared in three minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +continue2=takeNext +desc2=(WARNING) $1 minor alarm went on and was cleared in under three minutes +ptype2=regexp +pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(OFF\) +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=180 + +# %SNMP-5-CHASSISALARM - this rule handles the majorAlarm +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(ON\) +desc=(MINOR) $1 major alarm signaled and not cleared in two minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(OFF\) +desc2=(WARNING) $1 major alarm went on and was cleared in under two minutes +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=120 + +# ----- process power supply related events ----- + +# %C4K_IOSMODPORTMAN events - this one is about power supplies only +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD: Power Supply (\d+) has failed or been turned off +desc=(MINOR) $1 power supply $2 reported bad and event not cleared in two minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=($1) .*? %C4K_IOSMODPORTMAN-6-POWERSUPPLYGOOD: Power Supply ($2) is Okay +desc2=(WARNING) $1 power supply $2 alarm went on and was cleared in under two minutes +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=120 + +# ----- process neighbor down and neighbor up events ----- + +# %DVMRP-5-NBRDOWN +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DVMRP-5-NBRDOWN: Neighbor (\S+) went down on (\S+) +desc=(MINOR) $1 lost DVMRP neighbor $2 on interface $3 and it did not come up in two minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=($1) .*? %DVMRP-5-NBRUP: Neighbor ($2) is up on ($3) +desc2=(WARNING) $1 lost DVMRP neighbor $2 on interface $3 but id come up within two minutes +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=120 + +# ----- process fan power supply failure/ok events ----- + +# %C6KENV-SP-4-PSFANF events - this one is about fan failures +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C6KENV-SP-4-PSFANFAILED: the fan in power supply (\d+) has failed +desc=(MINOR) $1 fan in power supply $2 was reported bad and event not cleared in two minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=($1) .*? %C6KENV-SP-4-PSFANOK: the fan in power supply (\d+) is OK +desc2=(WARNING) $1 fan in power supply $2 alarm went on and was cleared in under two minutes +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=120 + +# ----- process events that have not been matched by any of above rules ----- + +# Default match +# this rule will match anything not previously matched but allows only +# one notification per day for each new event class seen +# +type=singleWithSuppress +ptype=regexp +pattern=(%.*?:) +desc=$1 +action=pipe '$0' mail -s 'cisco event' root@example.com +window=86400 diff --git a/clamav.sec b/clamav.sec deleted file mode 100644 index 6ab594f..0000000 --- a/clamav.sec +++ /dev/null @@ -1,8 +0,0 @@ -#Detects Clamav syslogs and reports them in a general report - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+clamd\[\d+\]: .*amavis-200\d+.*: (.*) FOUND -desc=$0 -action=add GENERAL_REPORT CLAMD: $2 on $1 - diff --git a/conf.README b/conf.README index a25550f..7365c13 100644 --- a/conf.README +++ b/conf.README @@ -1,10 +1,10 @@ -This is the SEC configuration directory. Because SEC usage varies so widely -from user to user, this Fedora Extras package is configured by default to not -run. +This is the SEC configuration directory. Because SEC usage varies so widely +from user to user, this package is configured by default to not run. The commented-out default settings in /etc/sysconfig/sec will load any file in -this directory with a .sec suffix. Please look through the example files -included in /etc/sec/examples/ and install the ones you want here (taking into -account that the examples are generic and some of them may need to be tweaked -to work with your setup). You should also read the SEC man page so you have -at least a basic understanding of the SEC configuration commands. +this directory with a .sec suffix. Please look through the example files +included in /usr/share/doc/sec-/examples/ and install the ones you +want here (taking into account that the examples are generic and some of them +may need to be tweaked to work with your setup). You should also read the SEC +man page so you have at least a basic understanding of the SEC configuration +commands. diff --git a/cvs.sec b/cvs.sec index f0f67c4..ae5af5d 100644 --- a/cvs.sec +++ b/cvs.sec @@ -1,3 +1,11 @@ +############################################################################# +# CVS events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# #Jul 31 19:54:21 xxxx xinetd[2088]: START: cvspserver pid=16385 from=xx.xx.xx.xx @@ -14,7 +22,7 @@ type=single ptype=regexp pattern=([A-z._0-9-]*) cvs: password mismatch for (.*) in (.*) desc = cvs login failure -action=pipe '$1 $2 CVS Login Failure: User $2 from $3' /usr/bin/mail -s '$1 $2 CVS Login Failure: $2 from $3' alerts@yourdomain.com +action=pipe '$1 $2 CVS Login Failure: User $2 from $3' /usr/bin/mail -s '$1 $2 CVS Login Failure: $2 from $3' alerts@example.com #Aug 5 10:38:49 xxxx cvs: attempt to root from account: username @@ -23,7 +31,7 @@ type=single ptype=regexp pattern=([A-z._0-9-]*) cvs: attempt to root from account: (.*) desc = cvs login to root attempt -action=pipe ' $1 $2 CVS Login to Root Attempt: User $2 ' /usr/bin/mail -s '$1 CVS Login to Root Failure: $2' alerts@yourdomain.com +action=pipe ' $1 $2 CVS Login to Root Attempt: User $2 ' /usr/bin/mail -s '$1 CVS Login to Root Failure: $2' alerts@example.com #Aug 5 10:42:37 xxxx cvs: login failure (for /usr/local/cvsroot) @@ -32,5 +40,5 @@ type=single ptype=regexp pattern=([A-z._0-9-]*) cvs: login failure \(for /usr/local/cvsroot\) desc = cvs login failure -action=pipe '$1 $2 CVS Login Failure ' /usr/bin/mail -s '$1 CVS Login Failure' alerts@yourdomain.com +action=pipe '$1 $2 CVS Login Failure ' /usr/bin/mail -s '$1 CVS Login Failure' alerts@example.com diff --git a/dameware.sec b/dameware.sec index ad840a8..8dd5201 100644 --- a/dameware.sec +++ b/dameware.sec @@ -1,10 +1,19 @@ +############################################################################# +# Dameware events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# + #Dameware Connect type=single ptype=regexp pattern=([A-z._0-9-]*) DMWRCS: (.*) Connect: (.*) desc = Dameware Connect action=add WINDOWS_REPORT DAMEWARE CONNECT: %s; \ -pipe 'DAMEWARE Connect -- : %s' /usr/bin/mail -s 'DAMEWARE CONNECT' alerts@yourdomain.com +pipe 'DAMEWARE Connect -- : %s' /usr/bin/mail -s 'DAMEWARE CONNECT' alerts@example.com #Dameware Disconnect diff --git a/dbi-example.sec b/dbi-example.sec deleted file mode 100644 index 046e1c4..0000000 --- a/dbi-example.sec +++ /dev/null @@ -1,25 +0,0 @@ -# to use perl packages, like DBI, you need to start SEC with the *-intevents* flag. -# this rule gets run against the messages file to log events to a central DB. -# not so much for the rule itself, but an example using DBI: -# Submitted by Jason Chambers - -type=Single -ptype=RegExp -pattern=^(\S+\s+\S+\s+\S+)\s+(\S+)\s+(\S+:)\s+(\S+\s+\S+\s+\S+\s+)?(\S+)\s+:\s+\S+\s+;\s+(\S+)\s+;\s+(\S+)\s+;\s+(.*) -desc=update db log -action=assign %H $2;\ - assign %Z $5;\ - assign %U $6;\ - assign %R $7;\ - assign %C $8;\ - assign %N %u;\ - assign %I 0;\ - eval %I (require DBI);\ - eval %D (exit(1) unless %I;\ - $COMMAND = "%C";\ - my $DBH = DBI->connect('DBI:mysql:/DBname/:/DBhost/', '/DBuser/', '/DBpass/');\ - my $SQL = " SQL statement";\ - $DBH->do($SQL);\ - ); - - diff --git a/hp-openview.sec b/hp-openview.sec index 17db678..d579dbf 100644 --- a/hp-openview.sec +++ b/hp-openview.sec @@ -1,10 +1,14 @@ ################################################################ # Sample SEC ruleset for HP OpenView ITO +# +# Copyright (C) 2003-2009 Risto Vaarandi +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. ################################################################ # process Cisco linkDown/linkUp trap events received from # HP OpenView ITO trap template through itostream plugin -# Submitted by Risto Vaarandi type=PairWithWindow ptype=RegExp diff --git a/import.log b/import.log new file mode 100644 index 0000000..e20fa49 --- /dev/null +++ b/import.log @@ -0,0 +1 @@ +sec-2_5_2-1_fc11:HEAD:sec-2.5.2-1.fc11.src.rpm:1254555264 diff --git a/labrea.sec b/labrea.sec index 040bed2..d27153a 100644 --- a/labrea.sec +++ b/labrea.sec @@ -1,4 +1,11 @@ -#Labrea tarpit events +############################################################################# +# Labrea tarpit events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# type=Single ptype=RegExp @@ -25,5 +32,5 @@ type=Calendar time=0 8,12,20 * * * desc=Sending tarpit report... action=report TARPIT_REPORT \ - /usr/bin/mail -s 'Tarpits: Tarpit Victim report' alerts@yourdomain.com; \ + /usr/bin/mail -s 'Tarpits: Tarpit Victim report' alerts@example.com; \ delete TARPIT_REPORT diff --git a/pix-general.sec b/pix-general.sec new file mode 100644 index 0000000..1aa9b87 --- /dev/null +++ b/pix-general.sec @@ -0,0 +1,1046 @@ +#################################################################### +# SEC ruleset for Cisco PIX 6.x, 7.x, FWSM 2.x +# +# Copyright (C) 2003-2009 Colin Hudler +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +#################################################################### + +# Process various events from PIX syslog output +# +# TODO -- A few FWSM log lines will not match. + +# Setup our variables -- not the right way to do this? Needs tweaking for your log lines +type=Single +ptype=RegExp +pattern=^(.* [0-9].:[0-9].:[0-9].) (.*)\.yourdomain\.edu.*?%(PIX|FWSM)-[0-9]-.*?:(.*) +desc=PIXLOG $2^ $1 $4 +action=event %s + +# 106001 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Inbound TCP connection denied from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+).* +desc=PIX $1 TCP connection denid HAMMER $2 to $3 +action=create ham1_$1; add ham1_$1 %t; add ham1_$1 %s;add ham1_$1 %s; add ham1_$1 $0; report ham1_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham1_$1 +window=10 +thresh=6 + +# 106006 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Connection denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+) +desc=PIX $1 denied by list HAMMER $2 to $3 +action=create ham2_$1; add ham2_$1 %t; add ham2_$1 %s; add ham2_$1 $0; report ham2_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham2_$1 +window=10 +thresh=6 + +# 106007 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny inbound UDP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) due to DNS.* +desc=PIX $1 Denied inbound UDP HAMMER $2 to $3 +action=create ham3_$1; add ham3_$1 %t; add ham3_$1 %s; add ham3_$1 $0; report ham3_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham3_$1 +window=10 +thresh=6 + +# 106010 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny inbound.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+).* +desc=PIX $1 Denied inbound HAMMER $2 to $3 +action=create ham4_$1; add ham4_$1 %t; add ham4_$1 %s; add ham4_$1 $0; report ham4_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham4_$1 +window=10 +thresh=6 + +# 106012 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny IP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+), IP options.* +desc=PIX $1 Denied IP Options HAMMER $2 to $3 +action=create ham5_$1; add ham5_$1 %t; add ham5_$1 %s; add ham5_$1 $0; report ham5_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham5_$1 +window=10 +thresh=6 + +# 106013 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Dropping echo request from (\d+.\d+.\d+.\d+) to PAT address +desc=PIX $1 Echo HAMMER $2 to PAT Address +action=create ham6_$1; add ham6_$1 %t; add ham6_$1 %s; add ham6_$1 $0; report ham7_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham8_$1 +window=10 +thresh=6 + +# 106014 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny inbound icmp src.*: (\d+.\d+.\d+.\d+) dst.*: (\d+.\d+.\d+.\d+) +desc=PIX $1 Deny inbound ICMP HAMMER $2 to $3 +action=create ham9_$1; add ham9_$1 %t; add ham9_$1 %s; add ham9_$1 $0; report ham9_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham9_$1 +window=10 +thresh=6 + +# 106015 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny.*\(no connection\) from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) +desc=PIX $1 Deny (no connection) HAMMER $2 to $3 +action=create ham10_$1; add ham10_$1 %t; add ham10_$1 %s; add ham10_$1 $0; report ham10_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham10_$1 +window=10 +thresh=30 + +# 106016,106017,106020,106021,106022 is further down this list... + +# 106018 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*ICMP packet type.*denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+) +desc=PIX $1 Deny ICMP type HAMMER $2 to $3 +action=create ham11_$1; add ham11_$1 %t; add ham11_$1 %s; add ham11_$1 $0; report ham11_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham11_$1 +window=10 +thresh=6 + +# 106023 +#Deny udp src outside:128.135.93.11/137 dst inside:128.135.211.65/137 by access-group "inward" +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+) by .* +desc=PIX $1 Deny by ACL HAMMER $2 to $3 +action=create ham12_$1; add ham12_$1 %t; add ham12_$1 %s; add ham12_$1 $0; report ham12_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham12_$1 +window=10 +thresh=32 + +# This is broken... still fix? TODO +# 106001 -- Report +#type=SingleWithThreshold +#continue=takenext +#ptype=RegExp +#pattern=^PIXLOG (\S+)\^ .*(Inbound TCP connection denied from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+).*)|\ +#(Connection denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+))|\ +#(Deny inbound UDP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) due to DNS)|\ +#(Deny inbound.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+))|\ +#(Deny IP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+), IP options)|\ +#(Dropping echo request from (\d+.\d+.\d+.\d+) to PAT address)|\ +#(Deny inbound icmp src.*: (\d+.\d+.\d+.\d+) dst.*: (\d+.\d+.\d+.\d+))|\ +#(Deny.*\(no connection\) from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+))|\ +#(ICMP packet type.*denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+))|\ +#(Deny.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+) by ) +#desc=PIX Conn Denied 10 times from $2 +#action=create rpt_$1; add rpt_$1 %t; add rpt_$1 %s;add rpt_$1 %s; add rpt_$1 $0; report rpt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpt_$1 +#window=10 +#thresh=30 + +# 101002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Bad failover cable. +desc=PIX $1 Bad Failover Cable +action=create bfc_$1; add bfc_$1 %t; add bfc_$1 %s; add bfc_$1 $0; report bfc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete bfc_$1 + +# 101003/4 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Failover cable not connected +desc=PIX $1 Failover cable gone +action=create nfc_$1; add nfc_$1 %t; add nfc_$1 %s; add nfc_$1 $0; report nfc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nfc_$1 + +# 101005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Error reading failover cable status +desc=PIX $1 Failover cable ERROR +action=create fce_$1; add fce_$1 %t; add fce_$1 %s; add fce_$1 $0; report fce_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fce_$1 + +# 102001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Power failure/System reload +desc=PIX $1 Peer Lost Power +action=create fpp_$1; add fpp_$1 %t; add fpp_$1 %s; add fpp_$1 $0; report fpp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpp_$1 + +# 103001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*No response from other firewall +desc=PIX $1 Peer Gone Away +action=create fnp_$1; add fnp_$1 %t; add fnp_$1 %s; add fnp_$1 $0; report fnp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fnp_$1 + +# 103003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Other firewall network interface (\S+) failed +desc=PIX $1 Peer interface $2 died +action=create fpi_$1; add fpi_$1 %t; add fpi_$1 %s; add fpi_$1 $0; report fpi_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpi_$1 + +# 103004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Other firewall reports this firewall failed +desc=PIX $1 Peer says I failed +action=create fif_$1; add fif_$1 %t; add fif_$1 %s; add fif_$1 $0; report fif_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fif_$1 + +# 103005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Other firewall reporting failure +desc=PIX $1 Peer reports failure +action=create fpf_$1; add fpf_$1 %t; add fpf_$1 %s; add fpf_$1 $0; report fpf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpf_$1 + +# 104001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*(Primary|Secondary) Switching to ACTIVE \(cause: (.*)\) +desc=PIX $1 FAILOVER! Becoming ACTIVE because $2 +action=create fba_$1; add fba_$1 %t; add fba_$1 %s; add fba_$1 $0; report fba_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fba_$1 + +# 104002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*(Primary|Secondary) Switching to STNDBY \(cause: (.*)\) +desc=PIX $1 FAILOVER! Becoming STNDBY because $2 +action=create fbs_$1; add fbs_$1 %t; add fbs_$1 %s; add fsb_$1 $0; report fbs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fbs_$1 + +# 104003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Switching to FAILED +desc=PIX $1 IN FAILED STATE! +action=create ffs_$1; add ffs_$1 %t; add ffs_$1 %s; add ffs_$1 $0; report ffs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ffs_$1 + +# 104004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Switching to OK. +desc=PIX $1 Failed Unit is ok +action=create ffs_$1; add ffs_$1 %t; add ffs_$1 %s; add ffs_$1 $0; report ffs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ffs_$1 + +# 105005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Lost Failover communications with mate on interface +desc=PIX $1 Peer Gone Away +action=create fnp_$1; add fnp_$1 %t; add fnp_$1 %s; add fnp_$1 $0; report fnp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fnp_$1 + +# 105007 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Link status \'Down\' on interface (\S+).* +desc=PIX $1 interface $2 is DOWN +action=create ind_$1; add ind_$1 %t; add ind_$1 %s; add ind_$1 $0; report ind_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ind_$1 + +# 105011 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Failover cable communication failure +desc=PIX $1 Failver cable failed +action=create fcf_$1; add fcf_$1 %t; add fcf_$1 %s; add fcf_$1 $0; report fcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fcf_$1 + +# 105021 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Standby unit failed to sync due to a locked (\S+) config. Lock held by (\S+) +desc=PIX $1 Failover Sync failed because $2 is locked by $3 +action=create lck_$1; add fcf_$1 %t; add fcf_$1 %s; add lck_$1 $0; report lck_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lck_$1 + +# 10532 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LAN Failover interface is down +desc=PIX $1 Failover interface is down +action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 + +# 10535 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Receive a LAN failover interface down msg from peer. +desc=PIX $1 Failover Peer reports LAN interface down +action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 + +# 10536 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*dropped a LAN Failover command message. +desc=PIX $1 Failover Dropped a LAN packet +action=create fdr_$1; add fdr_$1 %t; add fdr_$1 %s; add fdr_$1 $0; report fdr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fdr_$1 + +# 10537 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*The primary and standby units are switching back +desc=PIX $1 Failover: primary and standby units are switching back +action=create fsw_$1; add fsw_$1 %t; add fsw_$1 %s; add fsw_$1 $0; report fsw_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsw_$1 + +# 10543 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Failover interface failed +desc=PIX $1 Failover LAN Interface is down! +action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 + +# messages from 106001 moved to top + +# 106011 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny inbound (No xlate).* +desc=PIX $1 Same-Side Traffic Attack +action=create sst_$1; add sst_$1 %t; add sst_$1 %s; add sst_$1 $0; report sst_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sst_$1 + +# 106016 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny IP spoof from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) on interface +desc=PIX $1 IP Spoof from $2 to $3 +action=create spf_$1; add spf_$1 %t; add spf_$1 %s; add spf_$1 $0; report spf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spf_$1 + +# 106017 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny IP due to Land Attack from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) +desc=PIX $1 IP LAND Attack +action=create lnd_$1; add lnd_$1 %t; add lnd_$1 %s; add lnd_$1 $0; report lnd_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lnd_$1 + +# 106020 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny IP teardrop fragment.*from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) +desc=PIX $1 Teardrop Attack +action=create tdr_$1; add tdr_$1 %t; add tdr_$1 %s; add tdr_$1 $0; report tdr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tdr_$1 + +# 106021 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny.*reverse path check from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+).* +desc=PIX $1 Reverse Path Check Attack from $2 to $3 +action=create rpc_$1; add rpc_$1 %t; add rpc_$1 %s; add rpc_$1 $0; report rpc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpc_$1 + +# 106022 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny.*connection spoof from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+).* +desc=PIX $1 Connection Spoof Attack from $2 to $3 +action=create spf_$1; add spf_$1 %t; add spf_$1 %s; add spf_$1 $0; report spf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spf_$1 + +# 106024 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Access rules memory exhausted +desc=PIX $1 Out of ACL Memory! +action=create ame_$1; add ame_$1 %t; add ame_$1 %s; add ame_$1 $0; report ame_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ame_$1 + +# 106025/6 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Failed to determine the security context for the packet:(\S+):(\d+.\d+.\d+.\d+) (\d+.\d+.\d+.\d+) (\d+) (\d+).* +desc=PIX $1 failed getting context for vlan $2 $3:$4 to $5:$6 +action=create ctx_$1; add ctx_$1 %t; add ctx_$1 %s; add ctx_$1 $0; report ctx_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ctx_$1 + +# 107001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*RIP auth failed from (\d+.\d+.\d+.\d+).* +desc=PIX $1 RIP Auth Attack from $2 +action=create rip_$1; add rip_$1 %t; add rip_$1 %s; add rip_$1 $0; report rip_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rip_$1 + +# 107002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*RIP pkt failed from (\d+.\d+.\d+.\d+).* +desc=PIX $1 Invalid RIP Packet from $2 +action=create rpk_$1; add rpk_$1 %t; add rpk_$1 %s; add rpk_$1 $0; report rpk_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpk_$1 + +# 109003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Auth from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+\/\d+) failed \(all servers failed\).* +desc=PIX $1 All AAA Failed from $2 to $3 +action=create aaa_$1; add aaa_$1 %t; add aaa_$1 %s; add aaa_$1 $0; report aaa_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete aaa_$1 + +# 109006/8 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*(Authentication|Authorization) (failed|denied) for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) +desc=PIX $1 Auth Guessing Attack by $2 from $3 to $4 +action=create brt_$1; add brt_$1 %t; add brt_$1 %s; add brt_$1 $0; report brt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete brt_$1 +window=10 +thresh=6 + +# 109010 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Auth from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) failed \(too many pending auths\).* +desc=PIX $1 Max Auths Reached for $2 to $3 +action=create mth_$1; add mth_$1 %t; add mth_$1 %s; add mth_$1 $0; report mth_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mth_$1 + +# 109017 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User at (\d+.\d+.\d+.\d+) exceeded auth proxy connection +desc=PIX $1 $2 has opened to many proxy conns +action=create pcn_$1; add pcn_$1 %t; add pcn_$1 %s; add pcn_$1 $0; report pcn_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pcn_$1 + +# 109024 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Authorization denied.*for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) +desc=PIX $1 Authorization Denied HAMMER $2 from $3 to $4 +action=create uhm_$1; add uhm_$1 %t; add uhm_$1 %s; add uhm_$1 $0; report uhm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete uhm_$1 +window=10 +thresh=6 + +# 109025 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Authorization denied \(acl=.*\) for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) on interface.* +desc=PIX $1 Authorization Denied HAMMER $2 from $3 to $4 +action=create uhm_$1; add uhm_$1 %t; add uhm_$1 %s; add uhm_$1 $0; report uhm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete uhm_$1 +window=10 +thresh=6 + +# 111001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Begin configuration: (\d+.\d+.\d+.\d+) writing to (\S+) +desc=PIX $1 Config saved to $3 by $2 +action=create sav_$1; add sav_$1 %t; add sav_$1 %s; add sav_$1 $0; report sav_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sav_$1 + +# 111002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Begin configuration: (\d+.\d+.\d+.\d+) reading from (\S+) +desc=PIX $1 Config read from $3 by $2 +action=create sav_$1; add sav_$1 %t; add sav_$1 %s; add sav_$1 $0; report sav_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sav_$1 + +# 111003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*(\d+.\d+.\d+.\d+) Erase configuration +desc=PIX $1 WRITE ERASE WAS ISSUED $2 +action=create ers_$1; add ers_$1 %t; add ers_$1 %s; add ers_$1 $0; report ers_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ers_$1 + +# 111004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*(\d+.\d+.\d+.\d+) end configuration: \[FAILED\] +desc=PIX $1 FAILED CONFIGURING $2 +action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# 111008 +type=Single +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User \'(\S+)\' executed the command (.*) +desc=PIX $1 $2 executed: $3 +action=add CMD_REPORT $2 : $3 +#create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# FIXME -- Add syslog number +# FSWM Style +type=Single +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User \'(\S+)\' executed the \'(.*)\' command.* +desc=PIX $1 $2 executed: $3 +action=add CMD_REPORT $2 : $3 +#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + + +# 111008 +type=Single +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User (\S+) executed cmd:(.*) +desc=PIX $1 $2 executed: $3 +action=add CMD_REPORT $2 : $3 +#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 +#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# 113001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Unable to open AAA session. Session limit +desc=PIX $1 AAA Reached session limit +action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# 113005 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*AAA user authentication Rejected: reason = (.*) server = .* User = (\S+).* +desc=PIX $1 IPSEC: User Auth Attack: $2 for $3 +action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 +window=10 +thresh=6 + +# 113006 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User (\S+) locked out on exceeding number successive failed authentication attempts +desc=PIX $1 User Locked out: $2 +action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# 113020 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Kerberos error : Clock skew with server (\d+.\d+.\d+.\d+).* +desc=PIX $1 User Locked out: $2 +action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# Might be only 6.x +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Console Login from user at (\d+.\d+.\d+.\d+) +desc=PIX $1 Console Login from $2 +action=create con_$1; add con_$1 %t; add con_$1 %s; add con_$1 $0; report con_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete con_$1 + +# 112001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*clear (finished|complete)\. +desc=PIX $1 Clear Command Executed +action=create clr_$1; add clr_$1 %t; add clr_$1 %s; add clr_$1 $0; report clr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete clr_$1 + +# 199002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*[rR]eload command executed from.*(\d+.\d+.\d+.\d+) +desc=PIX $1 Reloaded by $2 +action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 + +# 199002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Orderly reload started at.*by (\S+). Reload.* +desc=PIX $1 Reloaded by $2 +action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 + +# 201002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+).*Too many.*connections on (static|xlate) (\d+.\d+.\d+.\d+) +desc=PIX $1 Max Embryonics to $3 (not attack) +action=create max_$1; add max_$1 %t; add max_$1 %s; add max_$1 $0; report max_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete max_$1 + +# 201003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Embryonic limit exceeded.*for (\d+.\d+.\d+.\d+\/\d+) \((\d+.\d+.\d+.\d+)\) (\d+.\d+.\d+.\d+\/\d+) +desc=PIX $1 Max Embryonics from $2 to $3 ($4) Attack +action=create emb_$1; add emb_$1 %t; add emb_$1 %s; add emb_$1 $0; report emb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete emb_$1 + +# 201008 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*The PIX is disallowing new connections. +desc=PIX $1 No longer allowing connections! +action=create stp_$1; add stp_$1 %t; add stp_$1 %s; add stp_$1 $0; report stp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete stp_$1 + +# 202001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Out of address translation slots! +desc=PIX $1 Out of NAT Slots +action=create nnt_$1; add nnt_$1 %t; add nnt_$1 %s; add nnt_$1 $0; report nnt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nnt_$1 + +# 209003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Fragment database limit of.*exceeded: src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* +desc=PIX $1 No room to assemble more frags from $2 to $3 +action=create frg_$1; add frg_$1 %t; add frg_$1 %s; add frg_$1 $0; report frg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete frg_$1 + +# 209004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Invalid IP fragment, size =.*exceeds maximum size =.*src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* +desc=PIX $1 Frag is invalid from $2 to $3 +action=create lrg_$1; add lrg_$1 %t; add lrg_$1 %s; add lrg_$1 $0; report lrg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lrg_$1 + +# 209005 +# FIXME -- Cisco log message doesnt match this +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Discard IP fragment set with more than.*elements:src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* +desc=PIX $1 To many frags from $2 to $3 +action=create _$1; add _$1 %t; add _$1 %s; add _$1 $0; report _$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete _$1 + +# 210002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU allocate block .* failed. +desc=PIX $1 Failover Block Alocation Failed +action=create fba_$1; add fba_$1 %t; add fba_$1 %s; add fba_$1 $0; report fba_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fba_$1 + +# 210005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU allocate connection failed +desc=PIX $1 Failover Connection Failed +action=create fcf_$1; add fcf_$1 %t; add fcf_$1 %s; add fcf_$1 $0; report fcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fcf_$1 + +# 210003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Unknown LU Object.* +desc=PIX $1 Failover: Unknown LU Object +action=create ulu_$1; add ulu_$1 %t; add ulu_$1 %s; add ulu_$1 $0; report ulu_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ulu_$1 + +# 210006 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU look NAT for (\d+.\d+.\d+.\d+) failed +desc=PIX $1 Failover NAT Sync failed for $2 +action=create fns_$1; add fns_$1 %t; add fns_$1 %s; add fns_$1 $0; report fns_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fns_$1 + +# 210007 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU allocate xlate failed +desc=PIX $1 Failover xlate Sync Failed +action=create fxs_$1; add fxs_$1 %t; add fxs_$1 %s; add fxs_$1 $0; report fxs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxs_$1 + +# 210008 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU no xlate for (\d+.\d+.\d+.\d+\/\d+) (\d+.\d+.\d+.\d+\/\d+) +desc=PIX $1 Failover xlate Sync Failure for $2 to $3 +action=create fxs_$1; add fxs_$1 %t; add fxs_$1 %s; add fxs_$1 $0; report fxs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxs_$1 + +# 210010 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU make UDP connection for (\d+.\d+.\d+.\d+:\d+) (\d+.\d+.\d+.\d+:\d+) failed +desc=PIX $1 Failover UDP Conn sync failure for $2 to $3 +action=create fus_$1; add fus_$1 %t; add fus_$1 %s; add fus_$1 $0; report fus_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fus_$1 + +# 210020 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU PAT port (\d+) reserve failed +desc=PIX $1 Failover PAT Sync for $2 failed +action=create fps_$1; add fps_$1 %t; add fps_$1 %s; add fps_$1 $0; report fps_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fps_$1 + +# 210021 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU create static xlate (\d+.\d+.\d+.\d+).*failed +desc=PIX $1 Failover Static xlate failed for $2 +action=create fxf_$1; add fxf_$1 %t; add fxf_$1 %s; add fxf_$1 $0; report fxf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxf_$1 + +# 210022 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU missed (\d+) updates +desc=PIX $1 Failover Sync failed for $2 updates +action=create fsf_$1; add fsf_$1 %t; add fsf_$1 %s; add fsf_$1 $0; report fsf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsf_$1 + +# 211001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Memory allocation Error +desc=PIX $1 Memory allocation Error! +action=create mae_$1; add mae_$1 %t; add mae_$1 %s; add mae_$1 $0; report mae_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mae_$1 + +# 211003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*CPU utilization for (\d+) seconds = (.*) +desc=PIX $1 CPU high ($2) for $3 secs +action=create cpu_$1; add cpu_$1 %t; add cpu_$1 %s; add cpu_$1 $0; report cpu_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cpu_$1 + +# 211003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Dropping SNMP request from (\d+.\d+.\d+.\d+\/\d+) to.*:(\d+.\d+.\d+.\d+\/\d+).* +desc=PIX $1 SNMP Attempt from $2 to $3 +action=create snp_$1; add snp_$1 %t; add snp_$1 %s; add snp_$1 $0; report snp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete snp_$1 + +# 213001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PPTP control daemon socket io.*errno = (\d+) +desc=PIX $1 PPTP Error $2 +action=create ppt_$1; add ppt_$1 %t; add ppt_$1 %s; add ppt_$1 $0; report ppt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppt_$1 + +# 213002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PPTP tunnel hashtable insert failed, peer = (\d+.\d+.\d+.\d+) +desc=PIX $1 PPTP hash table insert failed for $2 +action=create pht_$1; add pht_$1 %t; add pht_$1 %s; add pht_$1 $0; report pht_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pht_$1 + +# 213003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PPP virtual interface (\S+) isn't opened. +desc=PIX $1 PPP Virtual Int $2 failed to close +action=create ppp_$1; add ppp_$1 %t; add ppp_$1 %s; add ppp_$1 $0; report ppp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppp_$1 + +# 213004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PPP virtual interface (\S+) client ip allocation failed. +desc=PIX $1 PPP Virutal interface $2 failure (pool depleted) +action=create ppl_$1; add ppl_$1 %t; add ppl_$1 %s; add ppl_$1 $0; report ppl_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppl_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Denied Telnet login session from (\d+.\d+.\d+.\d+) on interface (int_name). +desc=PIX $1 Denid Telnet from $2 ($3) !! +action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Permitted Telnet login session from (\d+.\d+.\d+.\d+) +desc=PIX $1 Permitted Telnet from $2 ! +action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*telnet login session failed from (\d+.\d+.\d+.\d+).* +desc=PIX $1 Telnet login guessing attack +action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 + +# 308001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PIX console enable password incorrect for (num) tries \(from (\d+.\d+.\d+.\d+)\). +desc=PIX $1 Many Enable Password failures for $3 +action=create enb_$1; add enb_$1 %t; add enb_$1 %s; add enb_$1 $0; report enb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enb_$1 + +# 315011 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*SSH session from (\d+.\d+.\d+.\d+) on interface.*for user (\S+) disconnected by SSH server, reason:.* +desc=PIX $1 SSH Auth Attach from $2 ($3) +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 %s; add ssh_$1 $0; report ssh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ssh_$1 +window=10 +thresh=6 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Denied manager connection from (\d+.\d+.\d+.\d+). +desc=PIX $1 Denied Manager from $2 +action=create nmg_$1; add nmg_$1 %t; add nmg_$1 %s; add nmg_$1 $0; report nmg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nmg_$1 + +# FIXME -- Add log code FWSM +type=Single +continue=takenext +ptype=RegExp +pattern==^PIXLOG (\S+)\^ .*Denied SSH session from (\d+.\d+.\d+.\d+) on interface.* +desc=PIX $1 Denied SSH from $2 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 %s; add ssh_$1 $0; report ssh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ssh_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Permitted manager connection from (IP_addar). +desc=PIX $1 Allowed Manager from $2 +action=create ymg_$1; add ymg_$1 %t; add ymg_$1 %s; add ymg_$1 $0; report ymg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ymg_$1 + +# FIXME +# SET \d+.\d+.\d+.\d+ TO ! 128.135.0.x +#type=Single +#continue=takenext +#ptype=RegExp +#pattern=^PIXLOG (\S+)\^ .*Permitted SSH session from (\d+.\d+.\d+.\d+) on interface.*for user "user_id" +#desc=PIX $1 Permitted ssh $3 from $2 +#action=create fsh_$1; add fsh_$1 %t; add fsh_$1 %s; add fsh_$1 $0; report fsh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsh_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*SSH login session failed from (\d+.\d+.\d+.\d+) on \((num) attempts\) on interface.*by user "(\S+)" +desc=PIX $1 SSH $3 Failures from $2 by $4 +action=create lsh_$1; add lsh_$1 %t; add lsh_$1 %s; add lsh_$1 $0; report lsh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lsh_$1 + +# 402101 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*decaps: rec\'d IPSEC packet has invalid spi for destaddr=(\d+.\d+.\d+.\d+).* +desc=PIX $1 IPSEC: Invalid SPI in packet from $2 (possible attack) +action=create spi_$1; add spi_$1 %t; add spi_$1 %s; add spi_$1 $0; report spi_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spi_$1 + +# 402101 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*decapsulate: packet missing (.*), destadr=(\d+.\d+.\d+.\d+) +desc=PIX $1 IPSEC: Packet to $3 did not have type $2 (possible attack) +action=create itp_$1; add itp_$1 %t; add itp_$1 %s; add itp_$1 $0; report itp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete itp_$1 + +# 402103 +# FIXME -- This is messy +#type=Single +#continue=takenext +#ptype=RegExp +#pattern=^PIXLOG (\S+)\^ .*dentity doesn't match negotiated identity \((ip)\) dest_addr= (\d+.\d+.\d+.\d+), src_addr= (\d+.\d+.\d+.\d+), prot= protocol, \((ident)\) local=(\d+.\d+.\d+.\d+), remote=(\d+.\d+.\d+.\d+), local_proxy=(\d+.\d+.\d+.\d+/\d+.\d+.\d+.\d+/port/port), remote_proxy=(\d+.\d+.\d+.\d+/\d+.\d+.\d+.\d+/port/port) +#desc=PIX $1 IPSEC: Peer $2 is attempting to send other packets through us $3 $4 $5 $6 $7 +#action=create per_$1; add per_$1 %t; add per_$1 %s; add per_$1 $0; report per_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete per_$1 + +# 402115 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Received a packet from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) containing.*data instead of.*data. +desc=PIX $1 IPSEC: packet from $2 to $3 doesn't match negotiated proto +action=create ipx_$1; add ipx_$1 %t; add ipx_$1 %s; add ipx_$1 $0; report ipx_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ipx_$1 + +# 402115 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Received an.*packet.*from (\d+.\d+.\d+.\d+).*to (\d+.\d+.\d+.\d+).*The decapsulated inner packet doesn't match the negotiated policy in the SA +desc=PIX $1 IPSEC: packet from $2 to $3 is encapsulated with unexpected data. +action=create enc_$1; add enc_$1 %t; add enc_$1 %s; add enc_$1 $0; report enc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enc_$1 + +# 402118 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Received an.*packet.*from (\d+.\d+.\d+.\d+).*to (\d+.\d+.\d+.\d+) containing an illegal IP fragment.* +desc=PIX $1 IPSEC: packet from $2 to $3 has invalid fragment +action=create enc_$1; add enc_$1 %t; add enc_$1 %s; add enc_$1 $0; report enc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enc_$1 + +# 403103 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PPP virtual interface max connections reached. +desc=PIX $1 PPP interfaces exhausted +action=create pie_$1; add pie_$1 %t; add pie_$1 %s; add pie_$1 $0; report pie_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pie_$1 + +# 403109 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Rec\'d packet not an PPTP packet. \(.*\) dest_addr= (\d+.\d+.\d+.\d+), src_addr= (\d+.\d+.\d+.\d+).* +desc=PIX $1 Spoofed PPTP Packet from $3 to $2 +action=create spp_$1; add spp_$1 %t; add spp_$1 %s; add spp_$1 $0; report spp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spp_$1 + +# 404101 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*ISAKMP: Failed to allocate address for client from pool (\S+) +desc=PIX $1 IPSEC: Failed to allocate addr from $2 +action=create faa_$1; add faa_$1 %t; add faa_$1 %s; add faa_$1 $0; report faa_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete faa_$1 + +# 405001 +#type=Single +#continue=takenext +#ptype=RegExp +#pattern=PIXLOG (\S+)\^ .*Received ARP.*collision from (\d+.\d+.\d+.\d+\/....\.....\.....) on.* +#desc=PIX $1 ARP Collision: $2 +#action=create mac_$1; add mac_$1 %t; add mac_$1 %s;add mac_$1 %s; add mac_$1 $0; report mac_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mac_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Configuration replication failed for command (\S+) +desc=PIX $1 Failover replication command $2 failed +action=create rcf_$1; add rcf_$1 %t; add rcf_$1 %s; add rcf_$1 $0; report rcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rcf_$1 + +# 709001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*FO replication failed: cmd=(.*) returned=.* +desc=PIX $1 Failover: Command replication failed for Peer: $2 +action=create rcf_$1; add rcf_$1 %t; add rcf_$1 %s; add rcf_$1 $0; report rcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rcf_$1 + +# 316001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Denied new tunnel to (\d+.\d+.\d+.\d+). VPN peer limit.*exceeded.* +desc=PIX $1 VPN Peer limit exceeded for $2 +action=create plm_$1; add plm_$1 %t; add plm_$1 %s; add plm_$1 $0; report plm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete plm_$1 + +# 317003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*IP routing table creation failure - (.*) +desc=PIX $1 Route table Error: $2 +action=create rte_$1; add rte_$1 %t; add rte_$1 %s; add rte_$1 $0; report rte_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rte_$1 + +# 317004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*IP routing table limit warning +desc=PIX $1 Routing table limit reached +action=create rtl_$1; add rtl_$1 %t; add rtl_$1 %s; add rtl_$1 $0; report rtl_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rtl_$1 + +# 317005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*IP routing table limit exceeded - (.*), (\d+.\d+.\d+.\d+).* +desc=PIX $1 Route table limit breached by $3: $2 +action=create rtb_$1; add rtb_$1 %t; add rtb_$1 %s; add rtb_$1 $0; report rtb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rtb_$1 + +# 323005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) can not be powered on completely +desc=PIX $1 Slot $2 will not power on +action=create slp_$1; add slp_$1 %t; add slp_$1 %s; add slp_$1 $0; report slp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete slp_$1 + +# 411002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Line protocol on interface (\S+) changed state to down +desc=PIX $1 Interface $2 is DOWN! +action=create lpd_$1; add ldp_$1 %t; add ldp_$1 %s; add lpd_$1 $0; report lpd_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lpd_$1 + +# 412002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Detected bridge table full while inserting MAC (....\.....\.....) on interface .* +desc=PIX $1 MAC Address table is FULL! +action=create brf_$1; add brf_$1 %t; add brf_$1 %s; add brf_$1 $0; report brf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete brf_$1 + +# 505001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) is shutting down. Please.* +desc=PIX $1 Slot $2 is shutting down! +action=create sht_$1; add sht_$1 %t; add sht_$1 %s; add sht_$1 $0; report sht_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sht_$1 + +# 505002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) is reloading. Please.* +desc=PIX $1 Slot $2 is reloading! +action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 + +# 605004 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Login denied from (.*) to (.*) for user "(\S+)" +desc=PIX $1 Auth Attack from $2 to $3 ($4) +action=create ath_$1; add ath_$1 %t; add ath_$1 %s; add ath_$1 $0; report ath_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ath_$1 +window=10 +thresh=6 + +# 611102 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User authentication failed: Uname: (\S+) +desc=PIX $1 Auth Attach from $2 +action=create ath_$1; add ath_$1 %t; add ath_$1 %s; add ath_$1 $0; report ath_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ath_$1 +window=10 +thresh=6 + +# 615002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*vlan number not available for firewall interface +desc=PIX $1 VLAN Error for FWSM +action=create vln_$1; add vln_$1 %t; add vln_$1 %s; add vln_$1 $0; report vln_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete vln_$1 + +# diff --git a/pix-security.sec b/pix-security.sec index fa99013..44b19f6 100644 --- a/pix-security.sec +++ b/pix-security.sec @@ -1,5 +1,10 @@ #################################################################### # SEC ruleset for Cisco PIX 6.x, 7.x +# +# Copyright (C) 2003-2009 Chris Sawall +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. #################################################################### # Process various events from PIX syslog output @@ -19,7 +24,7 @@ type=SingleWithThreshold ptype=RegExp pattern=\s*.*Deny\s+(\w+)\s+src.*:(.*)/.*:(.*)/(\b2\d\b).*$ desc=Unusual Failures:$1 $4/$2 -> $3 -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 window=10 thresh=10 @@ -31,7 +36,7 @@ continue=dontcont ptype=RegExp pattern=(212\.147\.14[12]\.) desc=Possible PHEL Trojan (1) -action=create phel_$1; add phel_$1 Local Time = %t; add phel_$1 $0; report phel_$1 /bin/mail -s "%s" email01@domain.com; delete phel_$1 +action=create phel_$1; add phel_$1 Local Time = %t; add phel_$1 $0; report phel_$1 /bin/mail -s "%s" email01@example.com; delete phel_$1 # ------------------------------------------------------------------ # Watch for firewall failovers @@ -50,7 +55,7 @@ continue=takenext ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Primary\).*$ desc=Secondary firewall for $1 - failure/reload -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 # Failure of secondary (standby) firewall while primary is active # Works for PIX 7.x @@ -62,7 +67,7 @@ continue=takenext ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Secondary\).*$ desc=Primary firewall for $1 - failure/reload -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 # Failure of secondary (active), primary assumes active # Works for PIX 7.x @@ -79,7 +84,7 @@ action=logonly ptype2=RegExp pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Primary\).*Peer state Standby Ready desc2=Secondary (was active) firewall ($1) has failed. Primary is now active. -action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 window=5 # Failure of primary (active), secondary assumes active @@ -97,7 +102,7 @@ action=logonly ptype2=RegExp pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Secondary\).*Peer state Standby Ready desc2=Primary firewall ($1) has failed. Secondary is now active. -action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 window=5 # ------------------------------------------------------------------ @@ -114,7 +119,7 @@ continue=dontcont ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX reload.*$ desc=$1 has been manually rebooted -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com ; delete ffo_$1 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com ; delete ffo_$1 # Manual reload of PIX # Works for PIX 7.x @@ -126,7 +131,7 @@ continue=dontcont ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Orderly reload.*Reload reason:\s(\S+) desc=$1 has been manually rebooted, reason: $2 -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 # ------------------------------------------------------------------ # Watch for SSH logins/failures on firewalls @@ -152,7 +157,7 @@ continue=dontcont ptype=RegExp pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'.*to\s(\d+\.\d+\.\d+\.\d+)\/0.*SSH desc=Admin Auth to $1.$2 -> $3 from $4 -action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # Successful Admin SSH session # Works for PIX 7.x @@ -165,7 +170,7 @@ continue=dontcont ptype=RegExp pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'\sfrom\s(\d+\.\d+\.\d+\.\d+)\/0.*/22.*$ desc=Admin Auth to $1.$2 -> $3 from $4 -action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # Failed Admin SSH session # Works for PIX 6.x @@ -178,7 +183,7 @@ continue=takenext ptype=RegExp pattern=Authentication failed.*\'(\S+)\'.*SSH desc=Admin Auth FAILED -> $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # Failed Admin SSH session # Works for PIX 7.x @@ -191,7 +196,7 @@ continue=takenext ptype=RegExp pattern=Authentication failed.*\'(\S+)\'.*/22.*$ desc=Admin Auth FAILED -> $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # Normal SSH termination # Works for both PIX 6.x and 7.x @@ -202,7 +207,7 @@ type=Single ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*\"(\S+)\".*terminated normally desc=ADMIN END $1 -> $2 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # SSH session timeout or abnormal termination # Works for PIX 6.x @@ -214,7 +219,7 @@ type=Single ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*disconnected by SSH server desc=Firewall session END - timeout $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # ------------------------------------------------------------------ # Watch for firewall commands @@ -228,7 +233,7 @@ type=Single ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*write\sm.* desc=User wrote config to memory -> $1 -action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@domain.com; delete fwcmd_$1 +action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1 # Watch for HIGH CPU Utilization # Works for PIX 6.x @@ -237,5 +242,5 @@ type=Single ptype=RegExp pattern=PIX-.-211003 desc=HIGH CPU Utilization -action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@domain.com; delete fwcmd_$1 +action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1 diff --git a/pix-url.sec b/pix-url.sec index 306169a..a6e9879 100644 --- a/pix-url.sec +++ b/pix-url.sec @@ -1,5 +1,10 @@ #################################################################### # SEC ruleset for Monitoring Keywords +# +# Copyright (C) 2003-2009 Chris Sawall +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. #################################################################### # This particular ruleset was designed to monitor PIX syslog traffic @@ -41,7 +46,7 @@ type=Single ptype=PerlFunc pattern=sub {($_[0] =~ /($list)/) } desc=Inappropriate word in URL -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # # Examples of "watch4badwords" and "watch4excludes" diff --git a/portscan.sec b/portscan.sec index 85303af..1b2effe 100644 --- a/portscan.sec +++ b/portscan.sec @@ -1,5 +1,10 @@ ################################################################ # Sample SEC ruleset for "PORTSCAN FROM ip1 TO ip2:port" events +# +# Copyright (C) 2003-2009 Risto Vaarandi +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. ################################################################ # process "PORTSCAN FROM ip1 TO ip2:port" events, and if a certain @@ -35,6 +40,6 @@ context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ continue=DontCont desc=$1 has scanned more than 10 destinations action=report HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ - mail -s 'Horizontal port sweep from $1 target port $3' root@localhost; \ + mail -s 'Horizontal port sweep from $1 target port $3' root@example.com; \ delete HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3; \ eval %o ( delete $portscans{"$1:$3"} ) diff --git a/sec.init b/sec.init index 7c06c9e..0c15c30 100755 --- a/sec.init +++ b/sec.init @@ -1,88 +1,102 @@ #!/bin/bash # -# sec This starts and stops SEC +# sec Start and stop SEC. # -# chkconfig: - 26 74 +# chkconfig: - 20 80 # description: Simple Event Correlator script to filter log file entries -# processname: /usr/bin/sec -# config: /etc/sysconfig/sec -# pidfile: /var/run/sec.pid -# -# Source function library. - . /etc/rc.d/init.d/functions +. /etc/rc.d/init.d/functions -# Default to a clean return value - RETVAL=0 +prog="sec" +exec="/usr/bin/sec" +lockfile="/var/lock/subsys/sec" -# Program we'll be executing - EXEC='/usr/bin/sec' - prog='sec' - - [ -f $EXEC ] || exit 0 - -# Source the config - [ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog - -# No options defined means that sec can't run - [ -z "$SEC_ARGS" ] && exit 0 - -# And away we go... +[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog start() { - for n in `seq 0 $((${#SEC_ARGS[*]} - 1))`; do - echo -n $"Starting $prog instance "$(($n + 1))": " - daemon $EXEC ${SEC_ARGS[$n]} - RETVAL=$? - [ $RETVAL -ne 0 ] && return $RETVAL - done - touch /var/lock/subsys/$prog - return $RETVAL + [ -x $exec ] || exit 5 + for n in `seq 0 $((${#SEC_ARGS[*]} - 1))`; do + echo -n $"Starting $prog instance "$(($n + 1))": " + daemon $exec ${SEC_ARGS[$n]} + RETVAL=$? + echo + [ $RETVAL -ne 0 ] && return $RETVAL + done + touch $lockfile + return $RETVAL } stop() { - echo -n $"Stopping $prog: " - killproc $prog - RETVAL=$? - echo - [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$prog - return $RETVAL -} - -reload() { - echo -n $"Reloading configuration: " - killproc $prog -HUP - RETVAL=$? - echo - return $RETVAL + echo -n $"Stopping $prog: " + killproc $prog + RETVAL=$? + echo + [ $RETVAL -eq 0 ] && rm -f $lockfile + return $RETVAL } restart() { - stop - start + stop + start +} + +reload() { + echo -n $"Reloading $prog: " + killproc $prog -HUP + RETVAL=$? + echo + return $RETVAL +} + +force_reload() { + restart +} + +rh_status() { + status $prog +} + +rh_status_q() { + rh_status >/dev/null 2>&1 } dump() { - echo -n $"Dumping state in /tmp/sec.dump: " - killproc $prog -USR1 - RETVAL=$? - echo - return $RETVAL -} - -sec_status() { - status $prog + echo -n $"Dumping state of $prog in /tmp/sec.dump: " + killproc $prog -USR1 + RETVAL=$? + echo + return $RETVAL } case "$1" in - start|stop|reload|restart|dump) - $1 - ;; - status) - sec_status - ;; - *) - echo $"Usage: $0 {start|stop|reload|restart|dump|status}" - exit 2 + start) + start + ;; + stop) + stop + ;; + restart) + restart + ;; + condrestart|try-restart) + rh_status_q || exit 0 + restart + ;; + reload) + reload + ;; + force-reload) + force_reload + ;; + status) + rh_status + ;; + dump) + dump + ;; + *) + echo $"Usage: $0 {start|stop|restart|condrestart|try-restart|reload|force-reload|status|dump}" + exit 2 esac +exit $? diff --git a/sec.logrotate b/sec.logrotate index d536a75..87b02c3 100644 --- a/sec.logrotate +++ b/sec.logrotate @@ -3,6 +3,6 @@ notifempty sharedscripts postrotate - /sbin/service sec reload 2> /dev/null > /dev/null || true + /sbin/service sec reload >/dev/null 2>&1 || true endscript } diff --git a/sec.spec b/sec.spec index a4318c3..53b1db2 100644 --- a/sec.spec +++ b/sec.spec @@ -1,198 +1,121 @@ -# -# Specfile for SEC, the simple event correlator -# -# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169345 -# - Name: sec -Version: 2.4.1 -Release: 4%{?dist} -Summary: SEC (simple event correlator) - +Version: 2.5.2 +Release: 1%{?dist} +Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ -URL: http://www.estpak.ee/~risto/sec/ - -################################################################################ - +URL: http://simple-evcorr.sourceforge.net/ Source0: http://dl.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz Source1: sec.sysconfig Source2: sec.init Source3: sec.logrotate - # Example files and configuration info -Source100: conf.README -Source101: http://www.estpak.ee/~risto/sec/examples/syslog-ng.txt -Source102: 001_init.sec -Source103: http://www.bleedingsnort.com/sec/amavisd.sec -Source104: http://www.bleedingsnort.com/sec/bsd-MONITOR.sec -Source105: http://www.bleedingsnort.com/sec/bsd-PHYSMOD.sec -Source106: http://www.bleedingsnort.com/sec/bsd-USERACT.sec -Source107: http://www.bleedingsnort.com/sec/clamav.sec -Source108: http://www.bleedingsnort.com/sec/cvs.sec -Source109: http://www.bleedingsnort.com/sec/dameware.sec -Source110: http://www.bleedingsnort.com/sec/dbi-example.sec -Source111: http://www.bleedingsnort.com/sec/general.sec -Source112: http://www.bleedingsnort.com/sec/hp-openview.sec -Source113: http://www.bleedingsnort.com/sec/labrea.sec -Source114: http://www.bleedingsnort.com/sec/mpd.sec -Source115: http://www.bleedingsnort.com/sec/pix-security.sec -Source116: http://www.bleedingsnort.com/sec/pix-url.sec -Source117: http://www.bleedingsnort.com/sec/portscan.sec -Source118: http://www.bleedingsnort.com/sec/snort.sec -Source119: http://www.bleedingsnort.com/sec/snortsam.sec -Source120: http://www.bleedingsnort.com/sec/ssh-brute.sec -Source121: http://www.bleedingsnort.com/sec/ssh.sec -Source122: http://www.bleedingsnort.com/sec/vtund.sec -Source123: http://www.bleedingsnort.com/sec/windows.sec +Source4: conf.README +Source5: http://simple-evcorr.sourceforge.net/rulesets/amavisd.sec +Source6: http://simple-evcorr.sourceforge.net/rulesets/bsd-MONITOR.sec +Source7: http://simple-evcorr.sourceforge.net/rulesets/bsd-PHYSMOD.sec +Source8: http://simple-evcorr.sourceforge.net/rulesets/bsd-USERACT.sec +Source9: http://simple-evcorr.sourceforge.net/rulesets/bsd-general.sec +Source10: http://simple-evcorr.sourceforge.net/rulesets/bsd-mpd.sec +Source11: http://simple-evcorr.sourceforge.net/rulesets/cisco-syslog.sec +Source12: http://simple-evcorr.sourceforge.net/rulesets/cvs.sec +Source13: http://simple-evcorr.sourceforge.net/rulesets/dameware.sec +Source14: http://simple-evcorr.sourceforge.net/rulesets/hp-openview.sec +Source15: http://simple-evcorr.sourceforge.net/rulesets/labrea.sec +Source16: http://simple-evcorr.sourceforge.net/rulesets/pix-general.sec +Source17: http://simple-evcorr.sourceforge.net/rulesets/pix-security.sec +Source18: http://simple-evcorr.sourceforge.net/rulesets/pix-url.sec +Source19: http://simple-evcorr.sourceforge.net/rulesets/portscan.sec +Source20: http://simple-evcorr.sourceforge.net/rulesets/snort.sec +Source21: http://simple-evcorr.sourceforge.net/rulesets/snortsam.sec +Source22: http://simple-evcorr.sourceforge.net/rulesets/ssh-brute.sec +Source23: http://simple-evcorr.sourceforge.net/rulesets/ssh.sec +Source24: http://simple-evcorr.sourceforge.net/rulesets/vtund.sec +Source25: http://simple-evcorr.sourceforge.net/rulesets/windows.sec +BuildArch: noarch -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +# The init script uses arrays, so we need bash +Requires: bash +Requires: logrotate -BuildArch: noarch - -################################################################################ - -Requires(post): chkconfig +Requires(post): chkconfig Requires(postun): initscripts Requires(preun): initscripts, chkconfig -# The init script uses arrays, so we need bash -Requires: bash - -# Not required specifically by SEC, but our examples use it so we might as well -# create a requirement for logrotate. -Requires: logrotate - -# Some alternate names for the package that users might search for -Provides: simple-evcorr -Provides: sec.pl - -################################################################################ - %description -SEC is an open source and platform independent event correlation tool that -was designed to fill the gap between commercial event correlation systems and -homegrown solutions that usually comprise a few simple shell scripts. -SEC accepts input from regular files, named pipes, and standard input, and can -thus be employed as an event correlator for any application that is able to -write its output events to a file stream. - -################################################################################ +SEC is a simple event correlation tool that reads lines from files, named +pipes, or standard input, and matches the lines with regular expressions, +Perl subroutines, and other patterns for recognizing input events. +Events are then correlated according to the rules in configuration files, +producing output events by executing user-specified shell commands, by +writing messages to pipes or files, etc. %prep %setup -q -# Replace some tags in the config files - sed -i -e 's/@@NAME@@/%{name}/' \ - %{SOURCE1} \ - %{SOURCE2} \ - %{SOURCE3} - -# Fix the bindir in case a user wants it put in a different location - sed -i -e 's#/usr/bin/sec#%{_bindir}/sec#' \ - %{SOURCE2} - -################################################################################ +%build %install - -rm -rf $RPM_BUILD_ROOT - -# Create the directories we'll need - install -d -m 755 $RPM_BUILD_ROOT%{_initrddir} - install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/log - install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/run - install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d - install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig - install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples - # Install SEC and its associated files - install -D -p -m 755 sec.pl $RPM_BUILD_ROOT%{_bindir}/sec - install -D -p -m 644 sec.pl.man $RPM_BUILD_ROOT%{_mandir}/man1/sec.1 - install -p -m 644 %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/sec - install -p -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/sec - install -p -m 755 %{SOURCE2} $RPM_BUILD_ROOT%{_initrddir}/sec +install -D -m 0755 -p sec.pl %{buildroot}%{_bindir}/sec +install -D -m 0644 -p sec.pl.man %{buildroot}%{_mandir}/man1/sec.1 +install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_sysconfdir}/sysconfig/sec +install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec +install -D -m 0755 -p %{SOURCE2} %{buildroot}%{_initrddir}/sec # Install the example config files and readme - install -p -m 644 %{SOURCE100} \ - $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/README - install -p -m 644 %{SOURCE101} \ - $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/syslog-ng.sec - install -p -m 644 %{SOURCE102} \ - %{SOURCE103} \ - %{SOURCE104} \ - %{SOURCE105} \ - %{SOURCE106} \ - %{SOURCE107} \ - %{SOURCE108} \ - %{SOURCE109} \ - %{SOURCE110} \ - %{SOURCE111} \ - %{SOURCE112} \ - %{SOURCE113} \ - %{SOURCE114} \ - %{SOURCE115} \ - %{SOURCE116} \ - %{SOURCE117} \ - %{SOURCE118} \ - %{SOURCE119} \ - %{SOURCE120} \ - %{SOURCE121} \ - %{SOURCE122} \ - %{SOURCE123} \ - $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/ +install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/README +install -d -m 0755 examples +install -m 0644 -p %{SOURCE5} %{SOURCE6} %{SOURCE7} %{SOURCE8} \ + %{SOURCE9} %{SOURCE10} %{SOURCE11} %{SOURCE12} \ + %{SOURCE13} %{SOURCE14} %{SOURCE15} %{SOURCE16} \ + %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} \ + %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} \ + %{SOURCE25} examples/ -# Replace all "email.com" in sample scripts with an actual fake domain: example.com - grep -rl 'email.com' $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/ \ - | xargs sed -i -e 's/email.com/example.com/g' - -# Create ghost files so rpm doesn't complain about them being gone - touch $RPM_BUILD_ROOT%{_localstatedir}/log/sec - touch $RPM_BUILD_ROOT%{_localstatedir}/run/sec.pid - -################################################################################ +# Remove executable bits because these files get packed as docs +chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %post - -if [ $1 = 1 ]; then - /sbin/chkconfig --add sec +if [ $1 -eq 1 ]; then + /sbin/chkconfig --add sec fi %preun - -if [ $1 = 0 ]; then - /sbin/service sec stop > /dev/null 2>&1 || : - /sbin/chkconfig --del sec +if [ $1 -eq 0 ]; then + /sbin/service sec stop >/dev/null 2>&1 + /sbin/chkconfig --del sec fi %postun - -if [ $1 = 1 ]; then - /sbin/service sec condrestart +if [ $1 -eq 1 ]; then + /sbin/service sec condrestart >/dev/null 2>&1 fi %clean - -rm -rf $RPM_BUILD_ROOT - -################################################################################ +rm -rf %{buildroot} %files - %defattr(-,root,root,-) -%doc ChangeLog COPYING README +%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples +%config(noreplace) %{_sysconfdir}/%{name} %config(noreplace) %{_sysconfdir}/sysconfig/sec -%config(noreplace) %verify (not md5 size mtime) %{_sysconfdir}/logrotate.d/sec -%{_sysconfdir}/%{name} -%{_bindir}/sec +%config(noreplace) %{_sysconfdir}/logrotate.d/sec %{_initrddir}/sec -%{_mandir}/man1/* -%ghost %verify (not md5 size mtime) %{_localstatedir}/log/sec -%ghost %verify (not md5 size mtime) %{_localstatedir}/run/sec.pid - -################################################################################ +%{_bindir}/sec +%{_mandir}/man1/sec.1* %changelog +* Tue Sep 29 2009 Stefan Schulze Frielinghaus - 2.5.2-1 +- New upstream release +- SPEC file cleanup +- Init script cleanup +- Removed some examples because of licensing issues. Upstream has clarified + and changed most of the license tags to GPLv2. Additionally, upstream + will include the examples in the next release. +- Removed a provide statement since a period was in the name and no other + package required that special name. + * Sun Jul 26 2009 Fedora Release Engineering - 2.4.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild diff --git a/snort.sec b/snort.sec index 17e60d6..9cfe1ae 100644 --- a/snort.sec +++ b/snort.sec @@ -1,5 +1,10 @@ #################################################################### # Sample SEC ruleset for Snort IDS +# +# Copyright (C) 2003-2009 Risto Vaarandi +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. #################################################################### # ------------------------------------------------------------------ @@ -52,7 +57,8 @@ pattern=PRIORITY 1 INCIDENT FROM (\S+) TO \S+: .+ context=ATTACK_FROM_$1 continue=TakeNext desc=Priority 1 attack started from $1 -action=create ATTACK_FROM_$1; add ALERT_REPORT %t: %s; pipe '%t: %s' +action=create ATTACK_FROM_$1; add ALERT_REPORT %t: %s; pipe '%t: %s' \ + /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1' alerts@example.com # For every priority 1 incident, add an entry to the context by its IP; @@ -66,7 +72,7 @@ continue=TakeNext desc=Priority 1 incident from $1 to $2: $3 action=add ATTACK_FROM_$1 %t: %s; \ set ATTACK_FROM_$1 300 ( report ATTACK_FROM_$1 \ - /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1 (report)' alerts@email.com ) + /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1 (report)' alerts@example.com ) # ------------------------------------------------------------------ @@ -116,7 +122,7 @@ continue=TakeNext desc=Create activity contexts for $1 action=create ACTIVITY_LIST_FOR_$1_LIFETIME; \ create ACTIVITY_LIST_FOR_$1 7200 ( report ACTIVITY_LIST_FOR_$1 \ - /usr/bin/mail -s 'SNORT: $1 has been active for 2 hours' alerts@email.com; \ + /usr/bin/mail -s 'SNORT: $1 has been active for 2 hours' alerts@example.com; \ delete ACTIVITY_LIST_FOR_$1_LIFETIME ) @@ -142,7 +148,7 @@ type=Calendar time=0 12 * * * desc=Sending alert report... action=report ALERT_REPORT \ - /usr/bin/mail -s 'SNORT: Hourly alert report' alerts@email.com; \ + /usr/bin/mail -s 'SNORT: Hourly alert report' alerts@example.com; \ delete ALERT_REPORT @@ -152,6 +158,6 @@ type=Calendar time=0 9 * * * desc=Sending portscan report... action=report PORTSCAN_REPORT \ - /usr/bin/mail -s 'SNORT: daily portscan report' alerts@email.com; \ + /usr/bin/mail -s 'SNORT: daily portscan report' alerts@example.com; \ delete PORTSCAN_REPORT diff --git a/snortsam.sec b/snortsam.sec index b0a687c..05aa074 100644 --- a/snortsam.sec +++ b/snortsam.sec @@ -1,10 +1,17 @@ - +############################################################################# +# Snort SAM events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# type=single ptype=regexp pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Error: Could not bind socket. desc = $0 -action=pipe '$1 Snortsam Bind Failed -- NEEDS ATTENTION!: %s' /usr/bin/mail -s "Snortsam Bind Failure: NEEDS ATTENTION on $1" alerts@yourdomain.com +action=pipe '$1 Snortsam Bind Failed -- NEEDS ATTENTION!: %s' /usr/bin/mail -s "Snortsam Bind Failure: NEEDS ATTENTION on $1" alerts@example.com type=single @@ -24,7 +31,7 @@ action=add SNORTSAM_REPORT $1 Extending Block for $3 for $4 #ptype=regexp #pattern=([A-Za-z0-9._-]+)snortsam\[([0-9]+)\]: [*], [:0-9]+, -, ipf, (.*) Failed #desc = Snortsam ipf error -#action=pipe '$1 Snortsam IPF Command Failed' /usr/bin/mail -s "%s" alerts@yourdomain.com +#action=pipe '$1 Snortsam IPF Command Failed' /usr/bin/mail -s "%s" alerts@example.com ##action=add SNORTSAM_REPORT ERROR $1 IPF Command Failure: $2 @@ -52,13 +59,13 @@ type=single ptype=regexp pattern=([A-Za-z0-9._-]+) root: (.*) ipf, Error: Command (.*) Failed desc = $0 -action=pipe '$1 Snortsam IPF Command Failed: $1 $2 $3' /usr/bin/mail -s "Snortsam IPF Command Failed on $1" alerts@yourdomain.com +action=pipe '$1 Snortsam IPF Command Failed: $1 $2 $3' /usr/bin/mail -s "Snortsam IPF Command Failed on $1" alerts@example.com type=single ptype=regexp pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Snortsam Station .* using wrong password, trying to resync. desc = $0 -action=pipe '$1 Snortsam Password Failure: $1' /usr/bin/mail -s "Snortsam Password Failure on $1" alerts@yourdomain.com +action=pipe '$1 Snortsam Password Failure: $1' /usr/bin/mail -s "Snortsam Password Failure on $1" alerts@example.com #Send hourly snortsam report @@ -66,5 +73,5 @@ type=Calendar time=0 * * * * desc=Sending snortsam report... action=report SNORTSAM_REPORT \ - /usr/bin/mail -s 'SNORTSAM report' alerts@yourdomain.com; \ + /usr/bin/mail -s 'SNORTSAM report' alerts@example.com; \ delete SNORTSAM_REPORT diff --git a/sources b/sources index c2c00db..506f351 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -f233b3acf7cebdb573f4ff1f441866c3 sec-2.4.1.tar.gz +0e5e3c2e4e3ef6c21fc32a809c6263bb sec-2.5.2.tar.gz diff --git a/ssh-brute.sec b/ssh-brute.sec index 78ad658..a4397d4 100644 --- a/ssh-brute.sec +++ b/ssh-brute.sec @@ -1,4 +1,10 @@ ################## ssh brute force attack blocker +# Copyright (C) 2003-2009 Mark Bergman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +################## +# # This sec ruleset monitors syslog messages for indications that an ssh brute-force # login attack is underway. The trigger is an ssh login failure. # @@ -15,10 +21,6 @@ # 2 hours. # # Vulnerabilities of this ruleset are: -# DoS attack: if the attacker is aware of this ruleset, they could -# spoof a series of victim IP addresses (for example, the -# AOL proxy address), thus causing the server running sec -# to deny service to the victim. # # persistent firewall rules: # if the sec daemon crashes or is restarted, any existing rules @@ -31,7 +33,7 @@ # window2=7200 # sliding window (2 hours) for the second event match # thresh2=0 ############### -# RCSversion="$Header: /home/fedora/jkeating/pkgs/rpms/sec/devel/ssh-brute.sec,v 1.1 2006/09/01 20:54:01 xris Exp $" +# RCSversion="$Header: /home/fedora/jkeating/pkgs/rpms/sec/devel/ssh-brute.sec,v 1.2 2009/10/03 07:35:41 stefansf Exp $" # # Representative log file entries: # Aug 28 04:43:03 10.1.1.18 sshd(pam_unix)[22344]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=www.ace.ne.jp diff --git a/ssh.sec b/ssh.sec index b718248..d9704e9 100644 --- a/ssh.sec +++ b/ssh.sec @@ -1,6 +1,13 @@ -# a ruleset to accumulate errors from a parent and child sshd process +########################################################################### +# SEC ruleset to accumulate errors from a parent and child sshd process # into a single context. This allows reporting of the authenticated # user information with the error's generated by the child sshd process. +# +# Copyright (C) 2003-2009 John P. Rouillard +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +########################################################################### # note handling of deferred reporting until after tie events received # is still in flux. My old rules hanlded it by resubmitting all the @@ -38,7 +45,7 @@ action=create EVENT_PROCESSED #ptype=regexp #pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Connection from ([0-9.]+) port [0-9]+ #action=pipe session_log_$1_$2 \ -# /usr/bin/mail -s "ssh failed to generate tie event for $1" alerts@email.com +# /usr/bin/mail -s "ssh failed to generate tie event for $1" alerts@example.com #desc2=Link parent and child contexts #ptype2=regexp #pattern2=$1 [A-z0-9]+\[[0-9]+\]: \[[^]]+\] SSHD child process +([0-9]+) spawned by $2 @@ -86,7 +93,7 @@ desc=Report immediate on request. ptype=regexp pattern=^sshd: Report (.*) if needed$ context = session_log_report_$1 -action= report session_log_$1 /usr/bin/mailx -s "sshd error on $1" alerts@email.com ;\ +action= report session_log_$1 /usr/bin/mailx -s "sshd error on $1" alerts@example.com ;\ delete session_log_report_$1 type=suppress @@ -144,7 +151,7 @@ pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel context = $3 < 1025 && tie_event_received_$1_$2 action = add session_log_$1_$2 $0 ; \ report session_log_report_$1_$2 \ - /usr/bin/mailx -s "sshd bind < 1025 on $1" alerts@email.com + /usr/bin/mailx -s "sshd bind < 1025 on $1" alerts@example.com # end immediate rules here @@ -178,7 +185,7 @@ pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: A context = ssh_port_forward_errors_$1_$2 desc = send report on ssh forward errors if pass threshold (bind) action = report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh port forward errors host $1" alerts@email.com; \ + /usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com; \ delete ssh_port_forward_errors_$1_$2 thresh=5 window=600 @@ -211,7 +218,7 @@ pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel context = ssh_channel_setup_errors_$1_$2 desc = send report on ssh channel setup errors action = report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh port forward errors host $1" alerts@email.com ; \ + /usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com ; \ delete ssh_channel_setup_errors_$1_$2 thresh=5 window=600 @@ -234,7 +241,7 @@ pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: desc = create context to report ssh errors for host $1 pid $2 in 5 minutes context = ! session_log_5min_timer_$1_$2 action = create session_log_5min_timer_$1_$2 300 report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh errors for host $1 pid $2" alerts@email.com + /usr/bin/mailx -s "ssh errors for host $1 pid $2" alerts@example.com type=single continue = dontcont diff --git a/syslog-ng.txt b/syslog-ng.txt deleted file mode 100644 index 8bc90fc..0000000 --- a/syslog-ng.txt +++ /dev/null @@ -1,95 +0,0 @@ -################################################################ -# SEC ruleset for syslog-ng (contributed by Peter Straka) -################################################################ -#date host proces[pid]: [ID number facility.level] txt - -################################################################ -# internal -################################################################ -# setings parameters for next use -# -# %A,%B,%C,%D = parameters -# %F = output file for write -# %E = email list -# %M = mail program -################################################################ - -#rule beno#1 -type=Single -ptype=RegExp -pattern=(SEC_STARTUP|SEC_RESTART|SEC_SHUTDOWN) -context=SEC_INTERNAL_EVENT -desc=SEC internal -action=shellcmd /bin/echo -- %t %s $0;\ - assign %F /tmp/sec.out;\ - assign %E root@localhost;\ - assign %M /bin/mail -s "SEC production event";\ - add OUT %t "starting";\ - -################################################################ -# statistics -################################################################ - -#rule beno#2 -type=Single -continue=TakeNext -ptype=RegExp -pattern=\s(\S+)\s(\S+)\[\d+\]\:\s\[ID \d+ (\S+)\.(\S+)\]\s -desc=log level and facility counter + host and proces counter -action= assign %A $1;\ - assign %B $2;\ - assign %C $3;\ - assign %D $4;\ - eval %Z ($host{"%A"}++; $proces{"%B"}++; $facility{"%C"}++; $level{"%D"}++;); - -#rule beno#3 -#write statistics and null counters every hour -type=Calendar -time=0 * * * * -desc=log level and facility counter + host and proces counter -action=eval %Z (\ - my @ret; \ - push(@ret,"*******************************\n***** LEVEL:\n");\ - foreach $x (keys %level) {push(@ret,sprintf "%%s=%d\n",$x,$level{$x}) if $level{$x}; $level{$x}=0}; \ - push(@ret,"\n***** FACILITY:\n");\ - foreach $x (keys %facility) {push(@ret,sprintf "%%s=%d\n",$x,$facility{$x}) if $facility{$x}; $facility{$x}=0}; \ - push(@ret,"\n***** HOSTS:\n");\ - foreach $x (keys %host) {push(@ret,sprintf "%%s=%d\n",$x,$host{$x}) if $host{$x}; $host{$x}=0}; \ - push(@ret,"\n***** PROCES:\n");\ - foreach $x (keys %proces) {push(@ret,sprintf "%%s=%d\n",$x,$proces{$x}) if $proces{$x}; $proces{$x}=0}; \ -push(@ret,"\n********************************************************\n");\ - return "@ret"); \ - write %F %t %Z; \ - add STAT %Z; \ - report STAT %M %E; \ - delete STAT ; - -################################################################ -# hourly statistics -################################################################ - -#rule beno#4 -type=Single -continue=TakeNext -ptype=RegExp -pattern=\S+\s+\d+\s+(\d+)\:\d+\:\d+\s -desc=hourly counter -action=assign %A H$1;\ - eval %Z ($hour{%A}++;); - -#rule beno#5 -#write statistics and null counters at midnight -type=Calendar -time=25 16 * * * -desc=hourly counter -action=eval %Z (\ - my @ret; \ - push(@ret,"*******************************\n");\ - foreach $x (keys %hour) {push(@ret,sprintf "%%s:00=%d\n",$x,$hour{$x});$hour{$x}=0}; \ -push(@ret,"\n********************************************************\n");\ - return "@ret"); \ - write %F %t %Z; \ - add HOUR_STAT %Z; \ - report HOUR_STAT %M %E; \ - delete HOUR_STAT - diff --git a/vtund.sec b/vtund.sec index 3eb7ef0..1bc167f 100644 --- a/vtund.sec +++ b/vtund.sec @@ -1,4 +1,11 @@ -#VTUN Events +############################################################################# +# VTUN events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# type=Single ptype=RegExp @@ -58,14 +65,3 @@ pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (/S+) closed desc=$0 action=add GENERAL_REPORT %t: VTUN Session $2 Closed on $1 - - -#Send 12 hours vtun report - -type=Calendar -time=0 0,12 * * * -desc=Sending vtun report... -action=report VTUN_REPORT \ - /usr/bin/mail -s 'VTUN: VTUN Report' alerts@yourdomain.com; \ - delete VTUN_REPORT0 - diff --git a/windows.sec b/windows.sec index 34110e8..9e63e3c 100644 --- a/windows.sec +++ b/windows.sec @@ -1,4 +1,11 @@ -#Windows events +############################################################################# +# Windows events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# type=Single ptype=RegExp @@ -17,21 +24,21 @@ type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Locked Out: Target Account Name: (\S+) .* desc=$0 -action=pipe '$1 Windows Account Lockout: %s' /usr/bin/mail -s "Windows Account Locked on $1" alerts@yourdomain.com +action=pipe '$1 Windows Account Lockout: %s' /usr/bin/mail -s "Windows Account Locked on $1" alerts@example.com type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Changed: (/S+)\. .* desc=$0 -action=pipe '$1 Windows Account Change: %s' /usr/bin/mail -s "Windows Account Changed on $1: $2" alerts@yourdomain.com +action=pipe '$1 Windows Account Change: %s' /usr/bin/mail -s "Windows Account Changed on $1: $2" alerts@example.com type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+NetBT: N\/A: A duplicate name has been detected on the TCP network\. .* desc=$0 -action=pipe '$1 Duplicate Netbios Name Detected: %s' /usr/bin/mail -s "Duplicate Netbios Name on $1" alerts@yourdomain.com +action=pipe '$1 Duplicate Netbios Name Detected: %s' /usr/bin/mail -s "Duplicate Netbios Name on $1" alerts@example.com From 2f28bb01d92e17164699228416336d91c136b503 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Fri, 6 Nov 2009 09:15:05 +0000 Subject: [PATCH 08/85] Fixed URL of Source0 --- sec.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 53b1db2..87d6eaf 100644 --- a/sec.spec +++ b/sec.spec @@ -5,7 +5,7 @@ Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ URL: http://simple-evcorr.sourceforge.net/ -Source0: http://dl.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz +Source0: http://prdownloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz Source1: sec.sysconfig Source2: sec.init Source3: sec.logrotate From 073a24c895878098807a2aef1d3ef7ce19b61b70 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 7 Nov 2009 09:35:20 +0000 Subject: [PATCH 09/85] Fixed Source0 URL. --- sec.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 87d6eaf..01784de 100644 --- a/sec.spec +++ b/sec.spec @@ -5,7 +5,7 @@ Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ URL: http://simple-evcorr.sourceforge.net/ -Source0: http://prdownloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz +Source0: http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz Source1: sec.sysconfig Source2: sec.init Source3: sec.logrotate From edcc9d08a6e3d9122dd8fe4f06a3224deef02dc8 Mon Sep 17 00:00:00 2001 From: Bill Nottingham Date: Wed, 25 Nov 2009 23:15:28 +0000 Subject: [PATCH 10/85] Fix typo that causes a failure to update the common directory. (releng #2781) --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index a45a953..4f1bdb0 100644 --- a/Makefile +++ b/Makefile @@ -1,10 +1,10 @@ # Makefile for source rpm: sec -# $Id$ +# $Id: Makefile,v 1.1 2006/09/01 20:49:05 xris Exp $ NAME := sec SPECFILE = $(firstword $(wildcard *.spec)) define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done +for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done endef MAKEFILE_COMMON := $(shell $(find-makefile-common)) From 973b9acad50b5f70b0aae9c5c5b2909c7879a84a Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Thu, 10 Dec 2009 17:35:42 +0000 Subject: [PATCH 11/85] New upstream release --- .cvsignore | 2 +- import.log | 1 + sec.spec | 7 +++++-- sources | 2 +- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.cvsignore b/.cvsignore index d14f9ac..ec684c7 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -sec-2.5.2.tar.gz +sec-2.5.3.tar.gz diff --git a/import.log b/import.log index e20fa49..48d6b51 100644 --- a/import.log +++ b/import.log @@ -1 +1,2 @@ sec-2_5_2-1_fc11:HEAD:sec-2.5.2-1.fc11.src.rpm:1254555264 +sec-2_5_3-0_fc11:HEAD:sec-2.5.3-0.fc11.src.rpm:1260466421 diff --git a/sec.spec b/sec.spec index 01784de..076dc89 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.5.2 -Release: 1%{?dist} +Version: 2.5.3 +Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Thu Dec 10 2009 Stefan Schulze Frielinghaus - 2.5.3-0 +- New upstream release + * Tue Sep 29 2009 Stefan Schulze Frielinghaus - 2.5.2-1 - New upstream release - SPEC file cleanup diff --git a/sources b/sources index 506f351..9c12a8e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -0e5e3c2e4e3ef6c21fc32a809c6263bb sec-2.5.2.tar.gz +11bb84273daf24d265a96624ab6413ca sec-2.5.3.tar.gz From 059c196ebb29dbaef947abe89e7ba9a74bbf708c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 29 Jul 2010 12:19:48 +0000 Subject: [PATCH 12/85] dist-git conversion --- .cvsignore => .gitignore | 0 Makefile | 21 --------------------- import.log | 2 -- 3 files changed, 23 deletions(-) rename .cvsignore => .gitignore (100%) delete mode 100644 Makefile delete mode 100644 import.log diff --git a/.cvsignore b/.gitignore similarity index 100% rename from .cvsignore rename to .gitignore diff --git a/Makefile b/Makefile deleted file mode 100644 index 4f1bdb0..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: sec -# $Id: Makefile,v 1.1 2006/09/01 20:49:05 xris Exp $ -NAME := sec -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/import.log b/import.log deleted file mode 100644 index 48d6b51..0000000 --- a/import.log +++ /dev/null @@ -1,2 +0,0 @@ -sec-2_5_2-1_fc11:HEAD:sec-2.5.2-1.fc11.src.rpm:1254555264 -sec-2_5_3-0_fc11:HEAD:sec-2.5.3-0.fc11.src.rpm:1260466421 From 71d2907d38dfdfaf6bc4f3d4d1e6b179092fd6e3 Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Wed, 9 Feb 2011 07:00:39 -0600 Subject: [PATCH 13/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 076dc89..8451ef0 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.5.3 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Wed Feb 09 2011 Fedora Release Engineering - 2.5.3-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + * Thu Dec 10 2009 Stefan Schulze Frielinghaus - 2.5.3-0 - New upstream release From dec5aa69f2314521585b8489bcf0d2dff143eac4 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 20 Mar 2011 12:31:24 +0100 Subject: [PATCH 14/85] New upstream release --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index ec684c7..9006988 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ sec-2.5.3.tar.gz +/sec-2.6.0.tar.gz diff --git a/sources b/sources index 9c12a8e..fea9046 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -11bb84273daf24d265a96624ab6413ca sec-2.5.3.tar.gz +fa91666f37ab57524e2a0bd2c28acb52 sec-2.6.0.tar.gz From 7b7d37f22fc9e6ade4508667f533429284b6738b Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 20 Mar 2011 12:31:55 +0100 Subject: [PATCH 15/85] New upstream release (spec file) --- sec.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/sec.spec b/sec.spec index 8451ef0..1c59813 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.5.3 +Version: 2.6.0 Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -57,8 +57,8 @@ writing messages to pipes or files, etc. %install # Install SEC and its associated files -install -D -m 0755 -p sec.pl %{buildroot}%{_bindir}/sec -install -D -m 0644 -p sec.pl.man %{buildroot}%{_mandir}/man1/sec.1 +install -D -m 0755 -p sec %{buildroot}%{_bindir}/sec +install -D -m 0644 -p sec.man %{buildroot}%{_mandir}/man1/sec.1 install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_sysconfdir}/sysconfig/sec install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec install -D -m 0755 -p %{SOURCE2} %{buildroot}%{_initrddir}/sec @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Sun Mar 20 2011 Stefan Schulze Frielinghaus - 2.6.0-1 +- New upstream release + * Wed Feb 09 2011 Fedora Release Engineering - 2.5.3-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild From 2f9ec2f3ea169c54b652ef29079ea7a46249dd72 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 11 Jun 2011 22:41:13 +0200 Subject: [PATCH 16/85] example config file changes --- hp-openview.sec | 16 ++++++++-------- portscan.sec | 6 +++--- snort.sec | 16 ++++++++-------- ssh-brute.sec | 2 +- 4 files changed, 20 insertions(+), 20 deletions(-) diff --git a/hp-openview.sec b/hp-openview.sec index d579dbf..7ece030 100644 --- a/hp-openview.sec +++ b/hp-openview.sec @@ -1,7 +1,7 @@ ################################################################ # Sample SEC ruleset for HP OpenView ITO # -# Copyright (C) 2003-2009 Risto Vaarandi +# Copyright (C) 2003-2010 Risto Vaarandi # This is free software. You may redistribute copies of it under the terms of # the GNU General Public License version 2. # There is NO WARRANTY, to the extent permitted by law. @@ -12,12 +12,12 @@ type=PairWithWindow ptype=RegExp -pattern=node=(\S+).*msg_text=cisco linkdown trap on interface (\S+) +pattern=node=([\w.-]+) .*msg_text=cisco linkdown trap on interface ([\w-]+)\b desc=CISCO $1 INTERFACE $2 DOWN action=event %s; continue2=TakeNext ptype2=RegExp -pattern2=node=$1.*msg_text=cisco linkup trap on interface $2 +pattern2=node=$1 .*msg_text=cisco linkup trap on interface $2\b desc2=CISCO %1 INTERFACE %2 BOUNCE action2=event %s; window=20 @@ -25,25 +25,25 @@ window=20 type=SingleWithSuppress continue=TakeNext ptype=RegExp -pattern=CISCO (\S+) INTERFACE (\S+) DOWN +pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) DOWN desc=cisco $1 interface $2 down action=reset +1 %s window=60 type=Pair ptype=RegExp -pattern=CISCO (\S+) INTERFACE (\S+) DOWN +pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) DOWN desc=cisco $1 interface $2 down action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major down ptype2=RegExp -pattern2=node=$1.*msg_text=cisco linkup trap on interface $2 +pattern2=node=$1 .*msg_text=cisco linkup trap on interface $2\b desc2=cisco %1 interface %2 up action2=shellcmd /home/opc_op/cisco_msg.sh %1 %2 normal up window=86400 type=SingleWith2Thresholds ptype=RegExp -pattern=CISCO (\S+) INTERFACE (\S+) BOUNCE +pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) BOUNCE desc=cisco $1 interface $2 is unstable action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major unstable window=3600 @@ -79,7 +79,7 @@ thresh2=0 type=SingleWithScript ptype=RegExp -pattern=node=(\S+).*msg_text=APC ups not online +pattern=node=([\w.-]+) .*msg_text=APC ups not online script=/home/opc_op/check_apc.sh $1 desc=APC ups is not online! action=shellcmd /opt/OV/bin/OpC/opcmsg node=$1 app=APC obj=state \ diff --git a/portscan.sec b/portscan.sec index 1b2effe..1f2f5e5 100644 --- a/portscan.sec +++ b/portscan.sec @@ -13,7 +13,7 @@ type=Single ptype=RegExp -pattern=PORTSCAN FROM (\S+) TO \S+:(\d+) +pattern=PORTSCAN FROM ([\d.]+) TO [\d.]+:(\d+) context=!HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2 continue=TakeNext desc=Horizontal port sweep started from source $1 to target port $2 @@ -23,7 +23,7 @@ action=eval %o ( $portscans{"$1:$2"} = {} ); \ type=Single ptype=RegExp -pattern=PORTSCAN FROM (\S+) TO (\S+):(\d+) +pattern=PORTSCAN FROM ([\d.]+) TO ([\d.]+):(\d+) context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 continue=TakeNext desc=Scanned destination IP: $2 @@ -34,7 +34,7 @@ action=eval %o ( $portscans{"$1:$3"}->{$2} = 1 ); \ type=Single ptype=RegExp -pattern=PORTSCAN FROM (\S+) TO (\S+):(\d+) +pattern=PORTSCAN FROM ([\d.]+) TO ([\d.]+):(\d+) context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ && =( scalar(keys(%{$portscans{"$1:$3"}})) > 10 ) continue=DontCont diff --git a/snort.sec b/snort.sec index 9cfe1ae..9b65a71 100644 --- a/snort.sec +++ b/snort.sec @@ -16,7 +16,7 @@ type=Single ptype=RegExp -pattern=End of portscan from (([\d\.]+).*) +pattern=End of portscan from (([\d.]+).*) desc=Portscan from $1 action=add PORTSCAN_REPORT %t: %s; event ACTIVITY_FROM_$2: %s @@ -30,7 +30,7 @@ action=add PORTSCAN_REPORT %t: %s; event ACTIVITY_FROM_$2: %s type=Single ptype=RegExp -pattern=snort(?:\[\d+\])?: \[[0-9:]+\] (.+|!Malware|!MALWARE) \[(.+)\] \[.*Priority: (\d+)\]: \S+ ([\d\.]+):?\d* -> ([\d\.]+):?\d* +pattern=snort(?:\[\d+\])?: \[[0-9:]+\] (.+|!Malware|!MALWARE) \[(.+)\] \[.*Priority: (\d+)\]: \S+ ([\d.]+):?\d* -> ([\d.]+):?\d* desc=PRIORITY $3 INCIDENT FROM $4 TO $5: $1 [$2] action=event %s; event ACTIVITY_FROM_$4: $1 @@ -53,7 +53,7 @@ action=event %s; event ACTIVITY_FROM_$4: $1 type=Single ptype=RegExp -pattern=PRIORITY 1 INCIDENT FROM (\S+) TO \S+: .+ +pattern=PRIORITY 1 INCIDENT FROM ([\d.]+) TO [\d.]+: context=ATTACK_FROM_$1 continue=TakeNext desc=Priority 1 attack started from $1 @@ -66,7 +66,7 @@ action=create ATTACK_FROM_$1; add ALERT_REPORT %t: %s; pipe '%t: %s' \ type=Single ptype=RegExp -pattern=PRIORITY 1 INCIDENT FROM (\S+) TO (\S+): (.+) +pattern=PRIORITY 1 INCIDENT FROM ([\d.]+) TO ([\d.]+): (.+) context=ATTACK_FROM_$1 continue=TakeNext desc=Priority 1 incident from $1 to $2: $3 @@ -85,7 +85,7 @@ action=add ATTACK_FROM_$1 %t: %s; \ type=SingleWithThreshold ptype=RegExp -pattern=PRIORITY (\d+) INCIDENT FROM (\S+) TO \S+: (.+) +pattern=PRIORITY (\d+) INCIDENT FROM ([\d.]+) TO [\d.]+: (.+) continue=TakeNext desc=Snort has seen >= 30 priority $1 incidents from $2: $3 action=add ALERT_REPORT %t: %s; \ @@ -99,7 +99,7 @@ window=3600 type=SingleWithThreshold ptype=RegExp -pattern=PRIORITY \d+ INCIDENT FROM (\S+) TO \S+: .+ +pattern=PRIORITY \d+ INCIDENT FROM ([\d.]+) TO [\d.]+: context=!TURNOFF_$1 desc=Snort has seen >= 150 incidents from $1 action=add ALERT_REPORT %t: %s @@ -116,7 +116,7 @@ window=7200 type=Single ptype=RegExp -pattern=ACTIVITY_FROM_(\S+): +pattern=ACTIVITY_FROM_([\d.]+): context=!ACTIVITY_LIST_FOR_$1 continue=TakeNext desc=Create activity contexts for $1 @@ -131,7 +131,7 @@ action=create ACTIVITY_LIST_FOR_$1_LIFETIME; \ type=Single ptype=RegExp -pattern=ACTIVITY_FROM_(\S+): (.*) +pattern=ACTIVITY_FROM_([\d.]+): (.*) context=ACTIVITY_LIST_FOR_$1 desc=Activity from $1: $2 action=add ACTIVITY_LIST_FOR_$1 %t: %s; \ diff --git a/ssh-brute.sec b/ssh-brute.sec index a4397d4..484bcb3 100644 --- a/ssh-brute.sec +++ b/ssh-brute.sec @@ -33,7 +33,7 @@ # window2=7200 # sliding window (2 hours) for the second event match # thresh2=0 ############### -# RCSversion="$Header: /home/fedora/jkeating/pkgs/rpms/sec/devel/ssh-brute.sec,v 1.2 2009/10/03 07:35:41 stefansf Exp $" +# RCSversion="$Header: /home/bergman/RCS/ssh_block.sec,v 1.3 2006/05/02 04:18:44 bergman Exp bergman $" # # Representative log file entries: # Aug 28 04:43:03 10.1.1.18 sshd(pam_unix)[22344]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=www.ace.ne.jp From 332f982cd7bb6ff49b6d12d2cd7a7c7d445f1e14 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 11 Jun 2011 22:42:31 +0200 Subject: [PATCH 17/85] Upgrade to systemd --- sec.service | 11 +++++++++++ sec.spec | 33 +++++++++++++++++---------------- 2 files changed, 28 insertions(+), 16 deletions(-) create mode 100644 sec.service diff --git a/sec.service b/sec.service new file mode 100644 index 0000000..a8e3136 --- /dev/null +++ b/sec.service @@ -0,0 +1,11 @@ +[Unit] +Description=Simple Event Correlator script to filter log file entries +After=syslog.target + +[Service] +Type=forking +PIDFile=/run/sec.pid +ExecStart=/usr/bin/sec -detach -pid=/run/sec.pid -conf=/etc/sec/*.sec -input=/var/log/messages -log=/var/log/sec -intevents + +[Install] +WantedBy=multi-user.target diff --git a/sec.spec b/sec.spec index 1c59813..ad11542 100644 --- a/sec.spec +++ b/sec.spec @@ -1,13 +1,12 @@ Name: sec Version: 2.6.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ URL: http://simple-evcorr.sourceforge.net/ Source0: http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz -Source1: sec.sysconfig -Source2: sec.init +Source1: sec.service Source3: sec.logrotate # Example files and configuration info Source4: conf.README @@ -34,13 +33,13 @@ Source24: http://simple-evcorr.sourceforge.net/rulesets/vtund.sec Source25: http://simple-evcorr.sourceforge.net/rulesets/windows.sec BuildArch: noarch -# The init script uses arrays, so we need bash -Requires: bash Requires: logrotate -Requires(post): chkconfig -Requires(postun): initscripts -Requires(preun): initscripts, chkconfig +Requires(post): systemd-units +Requires(preun): systemd-units +Requires(postun): systemd-units + +BuildRequires: systemd-units %description SEC is a simple event correlation tool that reads lines from files, named @@ -59,9 +58,8 @@ writing messages to pipes or files, etc. # Install SEC and its associated files install -D -m 0755 -p sec %{buildroot}%{_bindir}/sec install -D -m 0644 -p sec.man %{buildroot}%{_mandir}/man1/sec.1 -install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_sysconfdir}/sysconfig/sec +install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_unitdir}/sec.service install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec -install -D -m 0755 -p %{SOURCE2} %{buildroot}%{_initrddir}/sec # Install the example config files and readme install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/README @@ -78,18 +76,19 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %post if [ $1 -eq 1 ]; then - /sbin/chkconfig --add sec + /bin/systemctl daemon-reload >/dev/null 2>&1 || : fi %preun if [ $1 -eq 0 ]; then - /sbin/service sec stop >/dev/null 2>&1 - /sbin/chkconfig --del sec + /bin/systemctl --no-reload disable sec.service > /dev/null 2>&1 || : + /bin/systemctl stop sec.service > /dev/null 2>&1 || : fi %postun +/bin/systemctl daemon-reload >/dev/null 2>&1 || : if [ $1 -eq 1 ]; then - /sbin/service sec condrestart >/dev/null 2>&1 + /bin/systemctl try-restart sec.service >/dev/null 2>&1 || : fi %clean @@ -99,13 +98,15 @@ rm -rf %{buildroot} %defattr(-,root,root,-) %doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples %config(noreplace) %{_sysconfdir}/%{name} -%config(noreplace) %{_sysconfdir}/sysconfig/sec %config(noreplace) %{_sysconfdir}/logrotate.d/sec -%{_initrddir}/sec %{_bindir}/sec %{_mandir}/man1/sec.1* +%{_unitdir}/sec.service %changelog +* Sat Jun 11 2011 Stefan Schulze Frielinghaus - 2.6.0-2 +- Upgrade to systemd + * Sun Mar 20 2011 Stefan Schulze Frielinghaus - 2.6.0-1 - New upstream release From 7ff059afcca420c5be0b942464f5f58f5f0e5bd5 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Mon, 19 Sep 2011 10:40:10 +0200 Subject: [PATCH 18/85] New upstream release --- sec.spec | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/sec.spec b/sec.spec index ad11542..d276c8a 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.6.0 -Release: 2%{?dist} +Version: 2.6.1 +Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -76,18 +76,21 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %post if [ $1 -eq 1 ]; then + # Initial installation /bin/systemctl daemon-reload >/dev/null 2>&1 || : fi %preun if [ $1 -eq 0 ]; then + # Package removal, not upgrade /bin/systemctl --no-reload disable sec.service > /dev/null 2>&1 || : /bin/systemctl stop sec.service > /dev/null 2>&1 || : fi %postun /bin/systemctl daemon-reload >/dev/null 2>&1 || : -if [ $1 -eq 1 ]; then +if [ $1 -ge 1 ]; then + # Package upgrade, not uninstall /bin/systemctl try-restart sec.service >/dev/null 2>&1 || : fi @@ -104,6 +107,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Mon Sep 19 2011 Stefan Schulze Frielinghaus - 2.6.1-0 +- New upstream release + * Sat Jun 11 2011 Stefan Schulze Frielinghaus - 2.6.0-2 - Upgrade to systemd From 7325fdf2e65d5f1ab75728f10613e5e2d684848b Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Mon, 19 Sep 2011 10:41:38 +0200 Subject: [PATCH 19/85] new sources --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 9006988..24970d2 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ sec-2.5.3.tar.gz /sec-2.6.0.tar.gz +/sec-2.6.1.tar.gz diff --git a/sources b/sources index fea9046..18d0e8d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -fa91666f37ab57524e2a0bd2c28acb52 sec-2.6.0.tar.gz +fda4119dd47880cb8c85e759cb4cf486 sec-2.6.1.tar.gz From d4b9b2a6642e5fc649209f2fde7d3d3238394e36 Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Fri, 13 Jan 2012 21:43:56 -0600 Subject: [PATCH 20/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index d276c8a..9878c9c 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.6.1 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -107,6 +107,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Sat Jan 14 2012 Fedora Release Engineering - 2.6.1-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + * Mon Sep 19 2011 Stefan Schulze Frielinghaus - 2.6.1-0 - New upstream release From ec2d8a9e07b54d4d8b40d5ed544aa8962887bceb Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 5 Feb 2012 14:00:48 +0100 Subject: [PATCH 21/85] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 1 + 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 24970d2..679cfc7 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ sec-2.5.3.tar.gz /sec-2.6.0.tar.gz /sec-2.6.1.tar.gz +/sec-2.6.2.tar.gz diff --git a/sec.spec b/sec.spec index d276c8a..a5835c9 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.6.1 +Version: 2.6.2 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -107,6 +107,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Sun Feb 5 2012 Stefan Schulze Frielinghaus - 2.6.2-0 +- New upstream release + * Mon Sep 19 2011 Stefan Schulze Frielinghaus - 2.6.1-0 - New upstream release diff --git a/sources b/sources index 18d0e8d..01821a3 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ fda4119dd47880cb8c85e759cb4cf486 sec-2.6.1.tar.gz +18d3a0d5b80f7582945a82e2fad56831 sec-2.6.2.tar.gz From 2fd32aa1b6a28ff8a42267bcc2f0fbf2f297e209 Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Sat, 21 Jul 2012 14:16:32 -0500 Subject: [PATCH 22/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 09cb9d0..b7f3900 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.6.2 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -107,6 +107,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Sat Jul 21 2012 Fedora Release Engineering - 2.6.2-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + * Sun Feb 5 2012 Stefan Schulze Frielinghaus - 2.6.2-0 - New upstream release From 70135fb1aadf3bba1b5f64823f7825cd32417754 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Fri, 17 Aug 2012 17:47:21 +0200 Subject: [PATCH 23/85] Apply latest packaging guidelines (systemd scriptlets for F18+) --- sec.spec | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/sec.spec b/sec.spec index b7f3900..2090286 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.6.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -75,24 +75,13 @@ install -m 0644 -p %{SOURCE5} %{SOURCE6} %{SOURCE7} %{SOURCE8} \ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %post -if [ $1 -eq 1 ]; then - # Initial installation - /bin/systemctl daemon-reload >/dev/null 2>&1 || : -fi +%systemd_post sec.service %preun -if [ $1 -eq 0 ]; then - # Package removal, not upgrade - /bin/systemctl --no-reload disable sec.service > /dev/null 2>&1 || : - /bin/systemctl stop sec.service > /dev/null 2>&1 || : -fi +%systemd_preun sec.service %postun -/bin/systemctl daemon-reload >/dev/null 2>&1 || : -if [ $1 -ge 1 ]; then - # Package upgrade, not uninstall - /bin/systemctl try-restart sec.service >/dev/null 2>&1 || : -fi +%systemd_postun_with_restart sec.service %clean rm -rf %{buildroot} @@ -107,6 +96,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Fri Aug 17 2012 Stefan Schulze Frielinghaus - 2.6.2-2 +- Apply latest packaging guidelines (systemd scriptlets for F18+) + * Sat Jul 21 2012 Fedora Release Engineering - 2.6.2-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild From 558ec1be757a475460e8e32907a299b7a76f94cb Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Tue, 9 Oct 2012 08:42:42 +0200 Subject: [PATCH 24/85] systemd requires --- sec.spec | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/sec.spec b/sec.spec index 2090286..9700002 100644 --- a/sec.spec +++ b/sec.spec @@ -35,11 +35,9 @@ BuildArch: noarch Requires: logrotate -Requires(post): systemd-units -Requires(preun): systemd-units -Requires(postun): systemd-units - -BuildRequires: systemd-units +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd %description SEC is a simple event correlation tool that reads lines from files, named From c9eb1a292323508ec0a4abfba99027542c19ddec Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Thu, 14 Feb 2013 17:44:19 -0600 Subject: [PATCH 25/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 9700002..cf717ee 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.6.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -94,6 +94,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Thu Feb 14 2013 Fedora Release Engineering - 2.6.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + * Fri Aug 17 2012 Stefan Schulze Frielinghaus - 2.6.2-2 - Apply latest packaging guidelines (systemd scriptlets for F18+) From eca248f294c956ee91d195ce283b06355fbb8a82 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Fri, 15 Mar 2013 18:43:11 +0100 Subject: [PATCH 26/85] New upstream release --- sec.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sec.spec b/sec.spec index cf717ee..de69212 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.6.2 -Release: 3%{?dist} +Version: 2.7.1 +Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -94,6 +94,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Fri Mar 15 2013 Stefan Schulze Frielinghaus - 2.7.1-0 +- New upstream release + * Thu Feb 14 2013 Fedora Release Engineering - 2.6.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild From 5ef1344991db269904ce456f7e4375f283d378b7 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Fri, 15 Mar 2013 18:45:50 +0100 Subject: [PATCH 27/85] New upstream release (sources) From 2680657d075c82c540648524d4fa7e45718c4397 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Fri, 15 Mar 2013 18:49:07 +0100 Subject: [PATCH 28/85] New sources --- .gitignore | 1 + sources | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 679cfc7..b3acce0 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ sec-2.5.3.tar.gz /sec-2.6.0.tar.gz /sec-2.6.1.tar.gz /sec-2.6.2.tar.gz +/sec-2.7.1.tar.gz diff --git a/sources b/sources index 01821a3..4e0d40d 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -fda4119dd47880cb8c85e759cb4cf486 sec-2.6.1.tar.gz -18d3a0d5b80f7582945a82e2fad56831 sec-2.6.2.tar.gz +e5dde148b8551f9399e6d63f8899558b sec-2.7.1.tar.gz From aa3cbcc1afea16ad20a3e265d8bc4a69da8b95b3 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Mon, 15 Apr 2013 08:54:53 +0200 Subject: [PATCH 29/85] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index b3acce0..10773fe 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ sec-2.5.3.tar.gz /sec-2.6.1.tar.gz /sec-2.6.2.tar.gz /sec-2.7.1.tar.gz +/sec-2.7.2.tar.gz diff --git a/sec.spec b/sec.spec index de69212..767d8fc 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.1 +Version: 2.7.2 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -94,6 +94,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Mon Apr 15 2013 Stefan Schulze Frielinghaus - 2.7.2-0 +- New upstream release + * Fri Mar 15 2013 Stefan Schulze Frielinghaus - 2.7.1-0 - New upstream release diff --git a/sources b/sources index 4e0d40d..6a9778d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -e5dde148b8551f9399e6d63f8899558b sec-2.7.1.tar.gz +97596c53487c31cb96f28ae3e964d6fa sec-2.7.2.tar.gz From aeea426beb205093d02b5eb48664dd7de43f9f13 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 2 Jun 2013 17:56:16 +0200 Subject: [PATCH 30/85] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 10773fe..b3f425b 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ sec-2.5.3.tar.gz /sec-2.6.2.tar.gz /sec-2.7.1.tar.gz /sec-2.7.2.tar.gz +/sec-2.7.3.tar.gz diff --git a/sec.spec b/sec.spec index 767d8fc..a2b4abf 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.2 +Version: 2.7.3 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -94,6 +94,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Sun Jun 2 2013 Stefan Schulze Frielinghaus - 2.7.3-0 +- New upstream release + * Mon Apr 15 2013 Stefan Schulze Frielinghaus - 2.7.2-0 - New upstream release diff --git a/sources b/sources index 6a9778d..ef87c6f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -97596c53487c31cb96f28ae3e964d6fa sec-2.7.2.tar.gz +ceaa72afa338ead80147511bc810720e sec-2.7.3.tar.gz From ff020a9594b3aef9024003748ba8ed693961874d Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 29 Jun 2013 08:10:33 +0200 Subject: [PATCH 31/85] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index b3f425b..d677d24 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ sec-2.5.3.tar.gz /sec-2.7.1.tar.gz /sec-2.7.2.tar.gz /sec-2.7.3.tar.gz +/sec-2.7.4.tar.gz diff --git a/sec.spec b/sec.spec index a2b4abf..fcfb469 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.3 +Version: 2.7.4 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -94,6 +94,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Sat Jun 29 2013 Stefan Schulze Frielinghaus - 2.7.4-0 +- New upstream release + * Sun Jun 2 2013 Stefan Schulze Frielinghaus - 2.7.3-0 - New upstream release diff --git a/sources b/sources index ef87c6f..33917a2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -ceaa72afa338ead80147511bc810720e sec-2.7.3.tar.gz +7006666a47ca5e6f0a405d16fa3024eb sec-2.7.4.tar.gz From 2165c79e7accd49488ef83ee66a5dce564c1f55b Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 29 Jun 2013 08:25:53 +0200 Subject: [PATCH 32/85] Add missing BuildRequire systemd --- sec.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sec.spec b/sec.spec index fcfb469..59dbc0d 100644 --- a/sec.spec +++ b/sec.spec @@ -33,6 +33,8 @@ Source24: http://simple-evcorr.sourceforge.net/rulesets/vtund.sec Source25: http://simple-evcorr.sourceforge.net/rulesets/windows.sec BuildArch: noarch +BuildRequires: systemd + Requires: logrotate Requires(post): systemd From 1b3757196f47f93d4ff58b96c7c6bf915c2645e9 Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Sun, 4 Aug 2013 09:04:07 -0500 Subject: [PATCH 33/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 59dbc0d..b980553 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.7.4 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -96,6 +96,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Sun Aug 04 2013 Fedora Release Engineering - 2.7.4-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + * Sat Jun 29 2013 Stefan Schulze Frielinghaus - 2.7.4-0 - New upstream release From 4ef20f6327e2c2b3e5b2b4f1761103d0d193f41f Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Thu, 16 Jan 2014 18:52:51 +0100 Subject: [PATCH 34/85] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index d677d24..467b87c 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ sec-2.5.3.tar.gz /sec-2.7.2.tar.gz /sec-2.7.3.tar.gz /sec-2.7.4.tar.gz +/sec-2.7.5.tar.gz diff --git a/sec.spec b/sec.spec index b980553..c881156 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.7.4 -Release: 1%{?dist} +Version: 2.7.5 +Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -96,6 +96,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Thu Jan 16 2014 Stefan Schulze Frielinghaus - 2.7.5-0 +- New upstream release + * Sun Aug 04 2013 Fedora Release Engineering - 2.7.4-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild diff --git a/sources b/sources index 33917a2..3e68cea 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -7006666a47ca5e6f0a405d16fa3024eb sec-2.7.4.tar.gz +071371ce1c98e3c397601780d3a5f3c5 sec-2.7.5.tar.gz From a36df2346ebf183f12505e36a275f5a4c41dd0fc Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Sun, 8 Jun 2014 01:04:54 -0500 Subject: [PATCH 35/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index c881156..f23cc5c 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.7.5 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -96,6 +96,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Sun Jun 08 2014 Fedora Release Engineering - 2.7.5-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + * Thu Jan 16 2014 Stefan Schulze Frielinghaus - 2.7.5-0 - New upstream release From 600257a7b564e0af1bc4c807accfbde3b4d6ac8d Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Tue, 15 Jul 2014 16:53:11 +0200 Subject: [PATCH 36/85] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 467b87c..3457e6e 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ sec-2.5.3.tar.gz /sec-2.7.3.tar.gz /sec-2.7.4.tar.gz /sec-2.7.5.tar.gz +/sec-2.7.6.tar.gz diff --git a/sec.spec b/sec.spec index f23cc5c..37dab26 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.7.5 -Release: 1%{?dist} +Version: 2.7.6 +Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -96,6 +96,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Tue Jul 15 2014 Stefan Schulze Frielinghaus - 2.7.6-0 +- New upstream release + * Sun Jun 08 2014 Fedora Release Engineering - 2.7.5-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild diff --git a/sources b/sources index 3e68cea..cd4c443 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -071371ce1c98e3c397601780d3a5f3c5 sec-2.7.5.tar.gz +d94b502e38338b641822226a70e46cd1 sec-2.7.6.tar.gz From 7e08d202744efc4ef588bf29ec5ddb5c8aa22bdb Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Wed, 18 Feb 2015 13:29:33 +0100 Subject: [PATCH 37/85] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 3457e6e..6ca4994 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ sec-2.5.3.tar.gz /sec-2.7.4.tar.gz /sec-2.7.5.tar.gz /sec-2.7.6.tar.gz +/sec-2.7.7.tar.gz diff --git a/sec.spec b/sec.spec index 37dab26..45ac014 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.6 +Version: 2.7.7 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -96,6 +96,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Wed Feb 18 2015 Stefan Schulze Frielinghaus - 2.7.7-0 +- New upstream release + * Tue Jul 15 2014 Stefan Schulze Frielinghaus - 2.7.6-0 - New upstream release diff --git a/sources b/sources index cd4c443..ec9aeb6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -d94b502e38338b641822226a70e46cd1 sec-2.7.6.tar.gz +994bc5e0f5a5046128829ed52f6da8e3 sec-2.7.7.tar.gz From 2b6814bde4f09a5d864e44ef253d1719f94bf9f1 Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Fri, 19 Jun 2015 00:35:56 +0000 Subject: [PATCH 38/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 45ac014..b0ec8e6 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.7.7 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -96,6 +96,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Fri Jun 19 2015 Fedora Release Engineering - 2.7.7-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + * Wed Feb 18 2015 Stefan Schulze Frielinghaus - 2.7.7-0 - New upstream release From d23dff5feeb199561a37cc099b38d5bd007bcc29 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Wed, 14 Oct 2015 22:11:20 +0200 Subject: [PATCH 39/85] While rotating logfiles do not do a full restart of the sec instance --- sec.init | 102 -------------------------------------------------- sec.logrotate | 2 +- sec.spec | 12 +++++- sec.sysconfig | 34 +++++++---------- sec@.service | 12 ++++++ 5 files changed, 36 insertions(+), 126 deletions(-) delete mode 100755 sec.init create mode 100644 sec@.service diff --git a/sec.init b/sec.init deleted file mode 100755 index 0c15c30..0000000 --- a/sec.init +++ /dev/null @@ -1,102 +0,0 @@ -#!/bin/bash -# -# sec Start and stop SEC. -# -# chkconfig: - 20 80 -# description: Simple Event Correlator script to filter log file entries - -. /etc/rc.d/init.d/functions - -prog="sec" -exec="/usr/bin/sec" -lockfile="/var/lock/subsys/sec" - -[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog - -start() { - [ -x $exec ] || exit 5 - for n in `seq 0 $((${#SEC_ARGS[*]} - 1))`; do - echo -n $"Starting $prog instance "$(($n + 1))": " - daemon $exec ${SEC_ARGS[$n]} - RETVAL=$? - echo - [ $RETVAL -ne 0 ] && return $RETVAL - done - touch $lockfile - return $RETVAL -} - -stop() { - echo -n $"Stopping $prog: " - killproc $prog - RETVAL=$? - echo - [ $RETVAL -eq 0 ] && rm -f $lockfile - return $RETVAL -} - -restart() { - stop - start -} - -reload() { - echo -n $"Reloading $prog: " - killproc $prog -HUP - RETVAL=$? - echo - return $RETVAL -} - -force_reload() { - restart -} - -rh_status() { - status $prog -} - -rh_status_q() { - rh_status >/dev/null 2>&1 -} - -dump() { - echo -n $"Dumping state of $prog in /tmp/sec.dump: " - killproc $prog -USR1 - RETVAL=$? - echo - return $RETVAL -} - -case "$1" in - start) - start - ;; - stop) - stop - ;; - restart) - restart - ;; - condrestart|try-restart) - rh_status_q || exit 0 - restart - ;; - reload) - reload - ;; - force-reload) - force_reload - ;; - status) - rh_status - ;; - dump) - dump - ;; - *) - echo $"Usage: $0 {start|stop|restart|condrestart|try-restart|reload|force-reload|status|dump}" - exit 2 -esac - -exit $? diff --git a/sec.logrotate b/sec.logrotate index 87b02c3..917a7bc 100644 --- a/sec.logrotate +++ b/sec.logrotate @@ -3,6 +3,6 @@ notifempty sharedscripts postrotate - /sbin/service sec reload >/dev/null 2>&1 || true + [ ! -f /run/sec.pid ] || kill -USR2 `cat /run/sec.pid` endscript } diff --git a/sec.spec b/sec.spec index b0ec8e6..f04b673 100644 --- a/sec.spec +++ b/sec.spec @@ -1,12 +1,13 @@ Name: sec Version: 2.7.7 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ URL: http://simple-evcorr.sourceforge.net/ Source0: http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz Source1: sec.service +Source2: sec@.service Source3: sec.logrotate # Example files and configuration info Source4: conf.README @@ -31,6 +32,8 @@ Source22: http://simple-evcorr.sourceforge.net/rulesets/ssh-brute.sec Source23: http://simple-evcorr.sourceforge.net/rulesets/ssh.sec Source24: http://simple-evcorr.sourceforge.net/rulesets/vtund.sec Source25: http://simple-evcorr.sourceforge.net/rulesets/windows.sec +# +Source26: sec.sysconfig BuildArch: noarch BuildRequires: systemd @@ -70,6 +73,8 @@ install -m 0644 -p %{SOURCE5} %{SOURCE6} %{SOURCE7} %{SOURCE8} \ %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} \ %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} \ %{SOURCE25} examples/ +install -m 0644 -p %{SOURCE2} sec@.service +install -m 0644 -p %{SOURCE26} sec.sysconfig # Remove executable bits because these files get packed as docs chmod 0644 contrib/convert.pl contrib/swatch2sec.pl @@ -88,7 +93,7 @@ rm -rf %{buildroot} %files %defattr(-,root,root,-) -%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples +%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples sec@.service sec.sysconfig %config(noreplace) %{_sysconfdir}/%{name} %config(noreplace) %{_sysconfdir}/logrotate.d/sec %{_bindir}/sec @@ -96,6 +101,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Wed Oct 14 2015 Fedora Release Engineering - 2.7.7-2 +- While rotating logfiles do not do a full restart of the sec instance + * Fri Jun 19 2015 Fedora Release Engineering - 2.7.7-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild diff --git a/sec.sysconfig b/sec.sysconfig index db96875..1db90e2 100644 --- a/sec.sysconfig +++ b/sec.sysconfig @@ -1,25 +1,17 @@ +# This is an example config file if multiple instances of SEC should be started. +# This file should be located in +# /etc/sysconfig/sec +# and used together with the systemd service file +# sec@.service +# which allows to run multiple sec instances. # -# Because SEC usage varies so widely from user to user, it is configured by -# default to not run. Please read `sec --help` for valid options to use in -# this configuration directive, or use the sample defaults included below. -# -# If you would like to run multiple instances of sec in order to track more -# than one log file, you can use also use $SEC_OPTIONS as an array. -# -# Also, please don't forget to read the sec man page or look at the -# configuration options for /etc/sec/. # +# Below you find an example configuration of two instances named FOO and BAR. +# The instances can be started via the commands +# systemctl start sec@FOO and systemctl start sec@BAR +# For further configuration options, consult the systemd file: +# /lib/systemd/system/sec@.service -# -# Default: -# -# SEC_ARGS="-detach -conf=/etc/sec/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.pid" -# +OPTIONS_FOO="-input=/var/log/messages" -# -# For Multiple instances of SEC, use something like: -# -# SEC_ARGS[0]="-detach -conf=/etc/sec/sys/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.sys.pid" -# -# SEC_ARGS[1]="-detach -conf=/etc/sec/mail/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.mail.pid" -# +OPTIONS_BAR="-input=/var/log/syslog" diff --git a/sec@.service b/sec@.service new file mode 100644 index 0000000..f89b139 --- /dev/null +++ b/sec@.service @@ -0,0 +1,12 @@ +[Unit] +Description=Simple Event Correlator (instance %I) +After=syslog.target + +[Service] +Type=forking +PIDFile=/run/sec-%I.pid +ExecStart=/usr/bin/sec -detach -pid=/run/sec-%I.pid -conf=/etc/sec/%I/*.sec -input=/var/log/messages -log=/var/log/sec-%I -intevents $OPTIONS_%I +EnvironmentFile=/etc/sysconfig/sec + +[Install] +WantedBy=multi-user.target From b4169b071eaeb3cb7cf86d92f66331571f5436ee Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 6 Dec 2015 09:51:14 +0100 Subject: [PATCH 40/85] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 6ca4994..25593db 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ sec-2.5.3.tar.gz /sec-2.7.5.tar.gz /sec-2.7.6.tar.gz /sec-2.7.7.tar.gz +/sec-2.7.8.tar.gz diff --git a/sec.spec b/sec.spec index f04b673..1611caa 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.7.7 -Release: 2%{?dist} +Version: 2.7.8 +Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -101,6 +101,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Sun Dec 6 2015 Stefan Schulze Frielinghaus - 2.7.8-0 +- New upstream release + * Wed Oct 14 2015 Fedora Release Engineering - 2.7.7-2 - While rotating logfiles do not do a full restart of the sec instance diff --git a/sources b/sources index ec9aeb6..453e2e5 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -994bc5e0f5a5046128829ed52f6da8e3 sec-2.7.7.tar.gz +cb0a840b603fb7d32d16b91bd5f23be7 sec-2.7.8.tar.gz From d49e5610e75dd6800a3d812947206e0e2f43c6b3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 4 Feb 2016 23:49:29 +0000 Subject: [PATCH 41/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 1611caa..676e69f 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.7.8 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -101,6 +101,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Thu Feb 04 2016 Fedora Release Engineering - 2.7.8-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + * Sun Dec 6 2015 Stefan Schulze Frielinghaus - 2.7.8-0 - New upstream release From 633686556d3aa7046b8408ccb1618dbd4d730899 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 2 Apr 2016 18:04:46 +0200 Subject: [PATCH 42/85] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 25593db..d6513f9 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ sec-2.5.3.tar.gz /sec-2.7.6.tar.gz /sec-2.7.7.tar.gz /sec-2.7.8.tar.gz +/sec-2.7.9.tar.gz diff --git a/sec.spec b/sec.spec index 1611caa..31c943a 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.8 +Version: 2.7.9 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -101,6 +101,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Sat Apr 2 2016 Stefan Schulze Frielinghaus - 2.7.9-0 +- New upstream release + * Sun Dec 6 2015 Stefan Schulze Frielinghaus - 2.7.8-0 - New upstream release diff --git a/sources b/sources index 453e2e5..ab9e47e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -cb0a840b603fb7d32d16b91bd5f23be7 sec-2.7.8.tar.gz +6c88c7fbb19e0eaea704aaf87924a6a9 sec-2.7.9.tar.gz From 5c6f8b4bac4ccfc07649a332a1a38cec2080625b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Fri, 24 Jun 2016 10:26:18 +0200 Subject: [PATCH 43/85] Mandatory Perl build-requires added --- sec.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/sec.spec b/sec.spec index 889df31..9a6b31e 100644 --- a/sec.spec +++ b/sec.spec @@ -36,6 +36,7 @@ Source25: http://simple-evcorr.sourceforge.net/rulesets/windows.sec Source26: sec.sysconfig BuildArch: noarch +BuildRequires: perl-generators BuildRequires: systemd Requires: logrotate From ff8e4a10b7b7644522a8853fb2fc9d4a3e1bf4ce Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Fri, 24 Jun 2016 17:08:01 +0200 Subject: [PATCH 44/85] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d6513f9..21db9e5 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ sec-2.5.3.tar.gz /sec-2.7.7.tar.gz /sec-2.7.8.tar.gz /sec-2.7.9.tar.gz +/sec-2.7.10.tar.gz diff --git a/sec.spec b/sec.spec index 9a6b31e..8c45a99 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.9 +Version: 2.7.10 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -102,6 +102,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Fri Jun 24 2016 Stefan Schulze Frielinghaus - 2.7.10-0 +- New upstream release + * Sat Apr 2 2016 Stefan Schulze Frielinghaus - 2.7.9-0 - New upstream release diff --git a/sources b/sources index ab9e47e..d6ee327 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -6c88c7fbb19e0eaea704aaf87924a6a9 sec-2.7.9.tar.gz +ece054278a50f21b7132f9743fa2b8ac sec-2.7.10.tar.gz From 9f00f4ea00a62f42d5c8c16261d77f3cee8c4623 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 5 Feb 2017 15:59:25 +0100 Subject: [PATCH 45/85] New upload release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 21db9e5..17a1100 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ sec-2.5.3.tar.gz /sec-2.7.8.tar.gz /sec-2.7.9.tar.gz /sec-2.7.10.tar.gz +/sec-2.7.11.tar.gz diff --git a/sec.spec b/sec.spec index 8c45a99..6d0512d 100644 --- a/sec.spec +++ b/sec.spec @@ -1,10 +1,10 @@ Name: sec -Version: 2.7.10 +Version: 2.7.11 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ -URL: http://simple-evcorr.sourceforge.net/ +URL: http://simple-evcorr.github.io/ Source0: http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz Source1: sec.service Source2: sec@.service @@ -102,6 +102,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Sun Feb 5 2017 Stefan Schulze Frielinghaus - 2.7.11-0 +- New upstream release + * Fri Jun 24 2016 Stefan Schulze Frielinghaus - 2.7.10-0 - New upstream release diff --git a/sources b/sources index d6ee327..22632da 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -ece054278a50f21b7132f9743fa2b8ac sec-2.7.10.tar.gz +SHA512 (sec-2.7.11.tar.gz) = 2de3c131f85029a91e7db1405be236b8ef31454bdffa28d5a2f912af73a2d0b0fbfb37a2f1548f7899ae3c43248e9c20084b7cb55a6b309c00d103d8b8019e80 From 2deab263542f1eaeb3278ecae5d4544157804738 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 27 Jul 2017 18:23:22 +0000 Subject: [PATCH 46/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 6d0512d..de3d919 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.7.11 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -102,6 +102,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Thu Jul 27 2017 Fedora Release Engineering - 2.7.11-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + * Sun Feb 5 2017 Stefan Schulze Frielinghaus - 2.7.11-0 - New upstream release From e25b46f607f253d165550b5ef511f528b2480159 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Wed, 13 Dec 2017 18:14:18 +0100 Subject: [PATCH 47/85] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 17a1100..a8c4882 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ sec-2.5.3.tar.gz /sec-2.7.9.tar.gz /sec-2.7.10.tar.gz /sec-2.7.11.tar.gz +/sec-2.7.12.tar.gz diff --git a/sec.spec b/sec.spec index de3d919..4cd197b 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.7.11 -Release: 1%{?dist} +Version: 2.7.12 +Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -102,6 +102,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Wed Dec 13 2017 Stefan Schulze Frielinghaus - 2.7.12-0 +- New upstream release + * Thu Jul 27 2017 Fedora Release Engineering - 2.7.11-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild diff --git a/sources b/sources index 22632da..8bf645b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.7.11.tar.gz) = 2de3c131f85029a91e7db1405be236b8ef31454bdffa28d5a2f912af73a2d0b0fbfb37a2f1548f7899ae3c43248e9c20084b7cb55a6b309c00d103d8b8019e80 +SHA512 (sec-2.7.12.tar.gz) = 927ce602057c58993d7abd0aca0a7cde7ce6f77af01f72a414d165b93326a8e0a12bb5bc8c1f8d7737416beb16de92911db5ea20a8109e343e2e26e8efc649bd From b39775d6333ea767b09595de6ec268202336cafe Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 9 Feb 2018 16:27:32 +0000 Subject: [PATCH 48/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 4cd197b..d26c1ed 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.7.12 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -102,6 +102,9 @@ rm -rf %{buildroot} %{_unitdir}/sec.service %changelog +* Fri Feb 09 2018 Fedora Release Engineering - 2.7.12-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + * Wed Dec 13 2017 Stefan Schulze Frielinghaus - 2.7.12-0 - New upstream release From fd052c3ece12749d0ffcd84abcf5a865ae458e3d Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Wed, 14 Feb 2018 07:39:09 +0100 Subject: [PATCH 49/85] Remove %clean section None of currently supported distributions need that. Last one was EL5 which is EOL for a while. Signed-off-by: Igor Gnatenko --- sec.spec | 3 --- 1 file changed, 3 deletions(-) diff --git a/sec.spec b/sec.spec index d26c1ed..08ece2d 100644 --- a/sec.spec +++ b/sec.spec @@ -89,9 +89,6 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %postun %systemd_postun_with_restart sec.service -%clean -rm -rf %{buildroot} - %files %defattr(-,root,root,-) %doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples sec@.service sec.sysconfig From 11f2b3f9e269a54164fb0263fa6590fd4af244ff Mon Sep 17 00:00:00 2001 From: Jason Tibbitts Date: Tue, 10 Jul 2018 01:19:51 -0500 Subject: [PATCH 50/85] Remove needless use of %defattr --- sec.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/sec.spec b/sec.spec index 08ece2d..f1e143b 100644 --- a/sec.spec +++ b/sec.spec @@ -90,7 +90,6 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %systemd_postun_with_restart sec.service %files -%defattr(-,root,root,-) %doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples sec@.service sec.sysconfig %config(noreplace) %{_sysconfdir}/%{name} %config(noreplace) %{_sysconfdir}/logrotate.d/sec From b0d5827e00fc14be7d3c9edc3f2600de7ba7d522 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 14 Jul 2018 05:55:40 +0000 Subject: [PATCH 51/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index f1e143b..00b872a 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.7.12 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -98,6 +98,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec.service %changelog +* Sat Jul 14 2018 Fedora Release Engineering - 2.7.12-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Fri Feb 09 2018 Fedora Release Engineering - 2.7.12-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild From 7c7145cdb7ee7d9ec3e62bcf5230542971e27b45 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 2 Sep 2018 14:04:43 +0200 Subject: [PATCH 52/85] New upstream release --- sec.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sec.spec b/sec.spec index 00b872a..7315995 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.7.12 -Release: 2%{?dist} +Version: 2.8.0 +Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -98,6 +98,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec.service %changelog +* Sun Sep 2 2018 Stefan Schulze Frielinghaus - 2.8.0-0 +- New upstream release + * Sat Jul 14 2018 Fedora Release Engineering - 2.7.12-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From b7b7a56cfdf37aafa8c8055e7982b325a076fc69 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 2 Sep 2018 14:07:53 +0200 Subject: [PATCH 53/85] New upstream release sources --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index a8c4882..2c2f284 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,4 @@ sec-2.5.3.tar.gz /sec-2.7.10.tar.gz /sec-2.7.11.tar.gz /sec-2.7.12.tar.gz +/sec-2.8.0.tar.gz diff --git a/sources b/sources index 8bf645b..be96213 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.7.12.tar.gz) = 927ce602057c58993d7abd0aca0a7cde7ce6f77af01f72a414d165b93326a8e0a12bb5bc8c1f8d7737416beb16de92911db5ea20a8109e343e2e26e8efc649bd +SHA512 (sec-2.8.0.tar.gz) = e0a4bdc07c80ef6b061b20d4b444ff8dc406a63cf48a77defa3563d6980f5b5bc9f6ff8d70b2ff51e9f40955655ad3c750be5a01726a848b80a84aec0d6d1bad From f14e51518ef945b1f405a781d29a192da998b578 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Wed, 3 Oct 2018 19:52:44 +0200 Subject: [PATCH 54/85] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 2c2f284..a286282 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,4 @@ sec-2.5.3.tar.gz /sec-2.7.11.tar.gz /sec-2.7.12.tar.gz /sec-2.8.0.tar.gz +/sec-2.8.1.tar.gz diff --git a/sec.spec b/sec.spec index 7315995..d4ece2f 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.8.0 +Version: 2.8.1 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -98,6 +98,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec.service %changelog +* Wed Oct 3 2018 Stefan Schulze Frielinghaus - 2.8.1-0 +- New upstream release + * Sun Sep 2 2018 Stefan Schulze Frielinghaus - 2.8.0-0 - New upstream release diff --git a/sources b/sources index be96213..d3e3552 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.8.0.tar.gz) = e0a4bdc07c80ef6b061b20d4b444ff8dc406a63cf48a77defa3563d6980f5b5bc9f6ff8d70b2ff51e9f40955655ad3c750be5a01726a848b80a84aec0d6d1bad +SHA512 (sec-2.8.1.tar.gz) = 03c7acd1e1cfd6dc11143e0ff35758925ddc75e460987a91d5606564f0caa45afade497b8653ec2d8865cfcfab4d87743777eb104e1a16f79069cf61e17d0661 From d46d8d5c5ffabc044cc63f8bf8de01ae1abda43d Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Mon, 28 Jan 2019 20:18:25 +0100 Subject: [PATCH 55/85] Remove obsolete Group tag References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag --- sec.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/sec.spec b/sec.spec index d4ece2f..11d9567 100644 --- a/sec.spec +++ b/sec.spec @@ -2,7 +2,6 @@ Name: sec Version: 2.8.1 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries -Group: System Environment/Daemons License: GPLv2+ URL: http://simple-evcorr.github.io/ Source0: http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz From 396b86cb01ac77f1989e7e7e3094cc05e84b71e3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 2 Feb 2019 15:09:17 +0000 Subject: [PATCH 56/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 11d9567..f5af46a 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.8.1 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: http://simple-evcorr.github.io/ @@ -97,6 +97,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec.service %changelog +* Sat Feb 02 2019 Fedora Release Engineering - 2.8.1-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Wed Oct 3 2018 Stefan Schulze Frielinghaus - 2.8.1-0 - New upstream release From 7d72ccb757ec8e1d634a3c7e7e3eeedcf5349766 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Thu, 6 Jun 2019 19:47:55 +0200 Subject: [PATCH 57/85] - New upstream release - Clean up spec file - Added an environment file /etc/sysconfig/sec in order to specify command line options --- .gitignore | 1 + amavisd.sec | 24 -- bsd-MONITOR.sec | 59 --- bsd-PHYSMOD.sec | 50 --- bsd-USERACT.sec | 81 ---- bsd-general.sec | 307 -------------- bsd-mpd.sec | 26 -- cisco-syslog.sec | 477 --------------------- conf.README | 14 +- cvs.sec | 44 -- dameware.sec | 24 -- hp-openview.sec | 114 ----- labrea.sec | 36 -- pix-general.sec | 1046 ---------------------------------------------- pix-security.sec | 246 ----------- pix-url.sec | 80 ---- portscan.sec | 45 -- sec.service | 3 +- sec.spec | 57 +-- sec.sysconfig | 14 +- sec@.service | 2 +- snort.sec | 163 -------- snortsam.sec | 77 ---- sources | 2 +- ssh-brute.sec | 69 --- ssh.sec | 260 ------------ vtund.sec | 67 --- windows.sec | 44 -- 28 files changed, 37 insertions(+), 3395 deletions(-) delete mode 100644 amavisd.sec delete mode 100644 bsd-MONITOR.sec delete mode 100644 bsd-PHYSMOD.sec delete mode 100644 bsd-USERACT.sec delete mode 100644 bsd-general.sec delete mode 100644 bsd-mpd.sec delete mode 100644 cisco-syslog.sec delete mode 100644 cvs.sec delete mode 100644 dameware.sec delete mode 100644 hp-openview.sec delete mode 100644 labrea.sec delete mode 100644 pix-general.sec delete mode 100644 pix-security.sec delete mode 100644 pix-url.sec delete mode 100644 portscan.sec delete mode 100644 snort.sec delete mode 100644 snortsam.sec delete mode 100644 ssh-brute.sec delete mode 100644 ssh.sec delete mode 100644 vtund.sec delete mode 100644 windows.sec diff --git a/.gitignore b/.gitignore index a286282..ab8805b 100644 --- a/.gitignore +++ b/.gitignore @@ -16,3 +16,4 @@ sec-2.5.3.tar.gz /sec-2.7.12.tar.gz /sec-2.8.0.tar.gz /sec-2.8.1.tar.gz +/sec-2.8.2.tar.gz diff --git a/amavisd.sec b/amavisd.sec deleted file mode 100644 index d022e1c..0000000 --- a/amavisd.sec +++ /dev/null @@ -1,24 +0,0 @@ -############################################################################# -# Amavisd events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -#Sep 4 15:43:02 xxxxx clamd[581]: /var/amavisd/amavis-20050904T153955-46858/parts/part-00001: HTML.Phishing.Bank-1 FOUND -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+clamd\[\d+\]: .*amavis-200\d+.*: (.*) FOUND -desc=$0 -action=add GENERAL_REPORT CLAMD: $2 on $1 - -#Sep 4 00:02:46 xxxxx amavis[57825]: (57825-12) TROUBLE in check_mail: creating_partsdir FAILED: DBD::mysql::st execute failed: L -ost connection to MySQL server during query at (eval 53) line 238, line 1789. -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+amavis\[\d+\]: .* TROUBLE .* -desc=$0 -action=add GENERAL_REPORT AMAVISD: $1: %s - diff --git a/bsd-MONITOR.sec b/bsd-MONITOR.sec deleted file mode 100644 index 889ec98..0000000 --- a/bsd-MONITOR.sec +++ /dev/null @@ -1,59 +0,0 @@ -# -# SEC rules to pick up disruptive monitoring -# events. -# -# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html -# -# Copyright (C) 2003-2009 Jim Brown -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -# -#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR) -#---------------------------------------------------------------------- -#Nov 15 20:02:48 foohost syslogd: exiting on signal 15 -#Nov 22 02:00:02 foohost syslogd: restart -#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled -#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled -# - -# -# Syslog Exit -# ----------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+) -desc=$0 -action=write - MONITOR: $1 syslog exit on signal $2 at %t - -# -# Syslog Restart -# --------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart -desc=$0 -action=write - MONITOR: $1 syslog restart at %t - -# -# Syslog Exit -# ----------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+) -desc=$0 -action=write - MONITOR: $1 $2 promiscuous mode $3 at %t - -# -# Swapspace failure -# - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+kernel: swap_pager_getswapspace\(\S\): .* -desc=$0 -action=pipe '$1 GET SWAP FAILURE: %s' /usr/bin/mail -s "SWAP SPACE FAIL on $1" alerts@example.com - diff --git a/bsd-PHYSMOD.sec b/bsd-PHYSMOD.sec deleted file mode 100644 index 03b348f..0000000 --- a/bsd-PHYSMOD.sec +++ /dev/null @@ -1,50 +0,0 @@ -# -# PHYSMOD.conf - Events concerning physical modifications -# to the system. -# -# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html -# -# Copyright (C) 2003-2009 Jim Brown -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -# -#Logs involving physical modifications (PHYSMOD) -#------------------------------------------------ -#Nov 14 21:11:19 foohost /kernel: pccard: card inserted, slot 0 -#Nov 14 22:28:09 foohost /kernel: pccard: card removed, slot 0 -#Nov 12 19:46:31 foohost /kernel: de0: link down: cable problem? -#Nov 12 19:46:42 foohost /kernel: de0: autosense failed: cable problem? -#Oct 18 06:26:37 foohost pccardd[49]: ep0: 3Com Corporation (/3C589/) inserted. -#Oct 18 06:26:42 foohost pccardd[49]: pccardd started -# - -# -# PCMCIA Card Insertion, Removal -# -------------------------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pccard: card (\S+), slot (\d+) -desc=$0 -action=write - PHYSMOD: $1 pccard: card $2 in slot $3 at %t - -# -# PCMCIA Card Daemon -# -------------------------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+pccardd\[\d+\]: (.*) -desc=$0 -action=write - PHYSMOD: $1 pccardd: $2 at %t - -# -# Cabling Problem -# ---------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem -desc=$0 -action=write - PHYSMOD: $1 cable problem on $2, text: $3 at %t diff --git a/bsd-USERACT.sec b/bsd-USERACT.sec deleted file mode 100644 index edf2557..0000000 --- a/bsd-USERACT.sec +++ /dev/null @@ -1,81 +0,0 @@ -# -# Events concerning user activities. -# -# From http://sixshooter.v6.thrupoint.net/SEC-examples/article.html -# -# Copyright (C) 2003-2009 Jim Brown -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -# -#Logs involving logins, change of UID and privilege escalations (USERACT) -#------------------------------------------------------------------------- -#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1 -#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100 -#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for jpb from 192.168.1.1 port 1077 ssh2 -#Nov 14 12:55:29 foohost sshd[3425]: Accepted keyboard-interactive/pam for jpb from fe80::2c0:4fff:fe18:13fd%ep0 port 27492 ssh2 -#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2 -#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql -#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0 -#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1 -#Oct 18 06:11:11 foohost login: login on ttyv0 as root -#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 -#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 -#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 -# - -# -# sshd Problems -# -------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) -desc=$0 -action=write - USERACT: $1 sshd $2 problem, text: $3 at %t - -# -# sshd Accepted -# -------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*) -desc=$0 -action=write - USERACT: $1 sshd accepted login, text: $2 at %t - -# -# login FAILURES -# --------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*) -desc=$0 -action=write - USERACT: $1 login $2 on $4 at %t - -# -# su bad -# ----------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+) -desc=$0 -action=write - USERACT: $1 su: $2 $3 to $4 on $5 at %t - -#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 -#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 -#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 -# -# -# su good to root -# ----------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+) -desc=$0 -action=write - USERACT: $1 su: $2 to ROOT on $4 at %t - - diff --git a/bsd-general.sec b/bsd-general.sec deleted file mode 100644 index 457b39b..0000000 --- a/bsd-general.sec +++ /dev/null @@ -1,307 +0,0 @@ -# General log events, unix systems. From various sources -# -# Copyright (C) 2003-2009 Jim Brown -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -# -# Bad su -# ----------- -# -type=Single -ptype=RegExp -desc=$0 -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) -action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com - -type=Single -ptype=RegExp -desc=$0 -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) -action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com - - -# MONITOR.conf - SEC rules to pick up disruptive monitoring -# events. -# -#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR) -#---------------------------------------------------------------------- -#Nov 15 20:02:48 foohost syslogd: exiting on signal 15 -#Nov 22 02:00:02 foohost syslogd: restart -#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled -#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled -# - -# -# Syslog Exit -# ----------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+) -desc=$0 -action=write - MONITOR: $1 syslog exit on signal $2 at %t - -# -# Syslog Restart -# --------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart -desc=$0 -action=write - MONITOR: $1 syslog restart at %t - -# -# Syslog Exit -# ----------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+) -desc=$0 -action=write - MONITOR: $1 $2 promiscuous mode $3 at %t - - -# -# sshd Problems -# -------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) -desc=$0 -action=write - USERACT: $1 sshd $2 problem, text: $3 at %t - -# -# sshd Accepted -# -------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*) -desc=$0 -action=write - USERACT: $1 sshd accepted login, text: $2 at %t - -# -# login FAILURES -# --------------- -# -#type=Single -#ptype=RegExp -#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*) -#desc=$0 -#action=write - USERACT: $1 login $2 on $4 at %t - - -#SSH Auth failure on bsd 5 -#type=Single -#ptype=RegExp -#pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: error: PAM: authentication error for (/S+) from (/S+) -#desc=$0 -#action=pipe 'SSHD: 1 $1 2 $2 3 $3 to 4 $4 on 5 $5 at %t' /usr/bin/mail -s "SSHD: $1 $2 $3 to $4 on $5 at %t' alerts@example.com - -# -# su bad -# ----------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+) -desc=$0 -action=pipe 'USER: $1 SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com - -#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 -#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 -#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 -# -# -# su good to root -# ----------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+) -desc=$0 -action=pipe 'USER: $1 GOOD SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com -#action=write - USERACT: $1 su: $2 to ROOT on $4 at %t - -# -# Cabling Problem -# ---------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem -desc=$0 -action=event 0 $1 PHYSMOD:ORANGE cable problem on $2, text: $3 at %t - - - -# USERACT - Events concerning user activities. -# -# Sample BSD logs involving logins, change of UID and privilege escalations. -#--------------------------------------------------------------------------- -#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1 -#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100 -#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for foouser from 192.168.1.1 port 1077 ssh2 -#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2 -#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql -#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0 -#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1 -#Oct 18 06:11:11 foohost login: login on ttyv0 as root -#Nov 10 19:40:03 foohost su: foouser to root on /dev/ttyp0 -#Nov 18 09:37:38 foohost su: BAD SU foouser to root on /dev/ttyp3 -#Nov 22 12:26:44 foohost su: BAD SU goodboy to root on /dev/ttyp0 -# - -# -# sshd Problems -# -------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) -desc=$0 -action=pipe 'USER: $1 su: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com -#action=event 0 $1 USERACT:YELLOW sshd $2 problem, text: $3 at %t - -# -# login FAILURES -# --------------- -# ORANGE -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(sshd|login): (.*?FAILURE.)(.*?ON) (.*) -desc=$0 -action=pipe 'USER: $1: Login Failure $2 on $4 at %t' /usr/bin/mail -s "USER: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com -#action=event 0 $1 USERACT:YELLOW login $2 on $4 at %t - - -# NETWACT - SEC rules to pick up suspicious network events. -# -# Sample BSD logs involving odd or suspicious network activity. -#-------------------------------------------------------------- -#Jun 3 17:46:24 foohost named[38298]: client 10.12.127.176#3714: request has invalid signature: tsig verify failure -#Apr 14 16:23:08 foohost /kernel: arp: 10.10.152.12 moved from 00:90:27:37:35:cf to 00:d0:59:aa:61:11 on de0 -#Apr 1 11:23:39 sixshooter /kernel: Limiting closed port RST response from 368 to 200 packets per second - - -# -# named Dynamic DNS Update rejection -# ---------------------------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+named\[\d+\]: client (\S+): request has invalid signature:(.*) -desc=$0 -action=pipe 'NET: $1 dyndns attempt from $2' /usr/bin/mail -s "NET: $1 dyndns attempt from $2, text: $3 at %t" alerts@example.com - -# -# MAC address moved -# ----------------- -# ORANGE -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: arp: (\S+) moved from (\S+) to (\S+) on (\S+) -desc=$0 -action=pipe 'NET: $1 arp moved on $2' /usr/bin/mail -s "NET: $1 arp moved on $2 from: $3 to $4 on $5 at %t" alerts@example.com - -# -# DoS RST rate limit -# ------------------ -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Limiting closed port RST response from (\d+) to (\d+) -desc=$0 -action=pipe 'NET: $1 RST limit enforced: $2 to $3 at %t' /usr/bin/mail =s "NET: $1 RST limit enforced: $2 to $3" alerts@example.com - - - -# COMPROM - SEC rules to pick up potential system compromise events. -# -# Sample BSD logs involving potential system compromise. -#------------------------------------------------------- -#May 25 18:09:55 foohost ntpd[1325]: ntpd exiting on signal 11 -#Jul 21 18:33:16 foohost /kernel: pid 55454 (ftpd), uid 1001: exited on signal 8 -#Apr 9 12:57:06 foohost /kernel: pid 28039 (telnet), uid 0: exited on signal 3 (core dumped) - -# -# ntpd crash -# ------------------ -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+ntpd\[\d+\]: ntpd exiting on signal (\d+) -desc=$0 -action=pipe 'CRASH: $1 ntpd crashed on signal $2 at %t' /usr/bin/mail -s "CRASH: $1 ntpd crashed" alerts@example.com - -# -# Process crash -# ------------------ -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pid \d+ \(\S+\), uid (\d+): exited on signal (\d+) -desc=$0 -action=pipe 'CRASH: $1 $2 crashed on signal $4, uid $3 at %t' /usr/bin/mail -s "CRASH: $1 $2 crashed" alerts@example.com - - - -# PROCESS - SEC rules to pick up suspicious process events. -# -# Sample BSD logs involving unusual processes. -#--------------------------------------------- -#Mar 23 08:05:52 foohost thttpd[126]: thttpd/2.25b 29dec2003 starting on port 8090 - -# -# Suspicious processes -# -------------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(thttpd)\[(\d+)\]:(.*) -desc=$0 -action=pipe 'SUSPROC: $1 suspicious process $2 pid $3, text: $4 at %t' /usr/bin/mail -s "SUSPROC: $1 suspicious process $2" alerts@example.com - - - -# SHUTRST - SEC rules to pick up system shutdown, restart events. -# -# Sample BSD logs involving system shutdown and reset. -#----------------------------------------------------- -#Mar 6 16:28:13 foohost reboot: rebooted by foouser -#Jul 15 17:35:49 foohost halt: halted by root -#Mar 6 16:29:17 foohost /kernel: Copyright (c) 1992-2003 The FreeBSD Project. - -# -# Reboot message -# -------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+reboot: rebooted by (\S+) -desc=$0 -action=pipe 'REBOOT: $1 rebooted by $2' /usr/bin/mail -s "REBOOT: $1 rebooted by $2" alerts@example.com - -# -# Halt message -# -------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+halt: halted by (\S+) -desc=$0 -action=pipe 'HALT: $1 halted by $2' /usr/bin/mail -s "HALT: $1 halted by $2" alerts@example.com - -# -# Restart message -# -------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Copyright \(c\) (\S+) The FreeBSD Project -desc=$0 -action=pipe 'RESTART: $1 restart message at %t' /usr/bin/mail -s "RESTART: $1 restart message" alerts@example.com - diff --git a/bsd-mpd.sec b/bsd-mpd.sec deleted file mode 100644 index 594c556..0000000 --- a/bsd-mpd.sec +++ /dev/null @@ -1,26 +0,0 @@ -############################################################################# -# BSD mpd events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -type=single -desc = mpd connection start -ptype=regexp -pattern=([A-z._0-9-]*) mpd: PPTP connection from (\d+\.\d+\.\d+\.\d+):\d+ -action=add GENERAL_REPORT MPD Start from $2 on $1 - -type=single -ptype=regexp -pattern=([A-z._0-9-]*) mpd: Name: (.*) -desc = mpd user auth -action=add GENERAL_REPORT MPD User $2 Auth on $1 - -type=Single -ptype=RegExp -pattern=([A-z._0-9-]*) mpd: pptp\d: killing connection with (\d+\.\d+\.\d+\.\d+):\d+ -desc=mpd connection end -action=add GENERAL_REPORT MPD Connection end from $2 on $1 diff --git a/cisco-syslog.sec b/cisco-syslog.sec deleted file mode 100644 index 3ee22ea..0000000 --- a/cisco-syslog.sec +++ /dev/null @@ -1,477 +0,0 @@ -############################################################################# -# SEC rules for processing Cisco syslog messages -# -# Copyright (C) 2008-2009 Omer Ben-Shalom, Risto Vaarandi -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -# ----- Process system configuration events ----- - -# System configuration events -# suppressed because we don't care about it -# -type=suppress -ptype=substr -pattern=%SYS-5-CONFIG_I: -desc=device configuration - -# System configuration sync to standby router -# suppressed because we don't care about it -# -type=suppress -ptype=substr -pattern=%PFINIT-SP-5-CONFIG_SYNC: -desc=config sync - -# ----- Process reload and restart events ----- - -# Looks for a reload -# -type=single -continue=takeNext -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD: (.*) -desc=(WARNING) reload requested for $1 -action=pipe '%s details:$2' mail -s 'cisco event' root@example.com - -# Looks for a reload followed by a restart event -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD: -desc=(CRITICAL) $1 RELOAD_PROBLEM -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=($1).*?%SYS-5-RESTART: -desc2=(NOTICE) $1 RELOAD_OK -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=300 - -# Looks for a restart without reload command -# -type=single -ptype=regexp -pattern=(\S+) \d+:.*?%SYS-5-RESTART: -desc=(CRITICAL) $1 restart without reload command -action=pipe '%s' mail -s 'cisco event' root@example.com - -# ----- process SNMP authentication failure events ----- - -# this rule handles the SNMP authentication failures -# only one notification is sent for each source that is doing this per day -# -type=singleWithSuppress -ptype=regexp -pattern=(\S+) \d+:.*?%SNMP-3-AUTHFAIL: Authentication failure for SNMP req from host (\S+) -desc=(WARNING) Auth fail coming from $2 -action=pipe '%s' mail -s 'cisco event' root@example.com -window=86400 - -# ----- process OSPF neighbor change events ----- - -# This rule handles OSPF neighbor changes -# -type=single -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OSPF-5-ADJCHG:.*?Nbr (\S+) on (\S+) from (\S+) to (\S+), (.*) -desc=(MINOR) OSPF adjacency change: Router $1 reports that the neighbor on $3 ($2) changed from state $4 to state $5 detail:$6 -action=event %s; pipe '%s' mail -s 'cisco event' root@example.com - -# This rule escalates to CRITICAL if there are more than 5 neighbor changes -# in 5 seconds -# -type=SingleWithThreshold -ptype=substr -pattern=(MINOR) OSPF adjacency change -desc=(CRITICAL) More than 5 OSPF neighbor changes in 5 seconds -action=pipe '%s' mail -s 'cisco event' root@example.com -thresh=5 -window=5 - -# ----- process HSRP events ----- - -# This rule assembles together all HSRP events -# -type=single -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%STANDBY-6-STATECHANGE: (\S+).*?state (\S+) -> (\S+) -desc=HSRP change for $1 interface $2 - changed from $3 to $4 -action=add HSRP_$1 %t: %s; set HSRP_$1 5 (report HSRP_$1 mail -s 'cisco events' root@example.com) - -# ----- process duplex mismatch events ----- - -# this rule handles the duplex mismatch event -# only one notification is sent for each port that has duplex mismatch -# reported per day -# -type=singleWithSuppress -ptype=regexp -pattern=(\S+) \d+:.*?%CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on (not \S+) \((.*?)\), with (\S+) (\S+) \((.*?)\) -desc=(WARNING) Duplex mismatch between $1 port $2 ($3), other side is $4 port $5 ($6) -action=pipe '%s' mail -s 'cisco event' root@example.com -window=86400 - -# ----- process link down and link up events ----- - -# This rule deals with link down events -# -type=PairWithWindow -ptype=RegExp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINK-3-UPDOWN: Interface (\S+), changed state to down -desc=(MINOR) $1 INTERFACE $2 DOWN and not up in one minute -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=RegExp -pattern2=($1)\s+\d+:.*?%LINK-3-UPDOWN: Interface ($2), changed state to up -desc2=(WARNING) %1 INTERFACE %2 BOUNCE -action2=event %s -window=60 - -# when the first bounce event is seen, create a reporting trigger -# -type=Single -continue=TakeNext -ptype=regexp -pattern=(\S+) INTERFACE \S+ BOUNCE -context=!INTERFACE_BOUNCE_WAIT_$1 -desc=interface bounce summary event for router $1 -action=create INTERFACE_BOUNCE_WAIT_$1 10 (report INTERFACE_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete INTERFACE_BOUNCE_$1) - -# accumulate all interface bounce events into a context -# -type=Single -ptype=regexp -pattern=(\S+) INTERFACE (\S+) BOUNCE -desc=interface bounce for router $1 interface $2 detected -action=add INTERFACE_BOUNCE_$1 %t: %s - -# ----- process line protocol down and line protocol up events ----- - -# This rule deals with protocol up/down events -# -type=PairWithWindow -ptype=RegExp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface (\S+), changed state to down -desc=(MINOR) $1 INTERFACE $2 line protocol DOWN and not up in one minute -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=RegExp -pattern2=($1)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface ($2), changed state to up -desc2=(WARNING) %1 INTERFACE %2 line protocol BOUNCE -action2=event %s -window=60 - -# when the first bounce event is seen, create a reporting trigger -# -type=Single -continue=TakeNext -ptype=regexp -pattern=(\S+) INTERFACE \S+ line protocol BOUNCE -context=!LINE_PROTOCOL_BOUNCE_WAIT_$1 -desc=line protocol bounce for router $1 -action=create LINE_PROTOCOL_BOUNCE_WAIT_$1 10 (report LINE_PROTOCOL_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete LINE_PROTOCOL_BOUNCE_$1) - -# accumulate all line protocol bounce events into a context -# -type=Single -ptype=regexp -pattern=(\S+) INTERFACE (\S+) line protocol BOUNCE -desc=line protocol bounce for router $1 interface $2 detected -action=add LINE_PROTOCOL_BOUNCE_$1 %t: %s - -# ----- process late collision events ----- - -# Late collision alerts -# -type=SingleWithThreshold -ptype=RegExp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%PM_SCP-SP-4-LCP_FW_ABLC: Late collision message from module (\d+), port:(\d+) -desc=(MINOR) Multiple late collision events on $1 module $2 port $3 -action=pipe '%s' mail -s 'cisco event' root@example.com -window=3600 -thresh=5 - -# ----- process host flap events ----- - -# host flapping on single vlan -# -type=SingleWithThreshold -continue=TakeNext -ptype=RegExp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+) -desc=(MINOR) multiple hosts flapping between ports $4 and $5 in $1 vlan $3 -action=pipe '%s' mail -s 'cisco event' root@example.com -window=300 -thresh=5 - -# host flapping on multiple vlans -# -type=SingleWithThreshold -continue=TakeNext -ptype=RegExp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+) -desc=(MINOR) multiple hosts are flapping between ports $4 and $5 in $1 (potentially on multiple VLANs) -action=pipe '%s' mail -s 'cisco event' root@example.com -window=300 -thresh=20 - -# ----- process misc hw events ----- - -# %FILESYS-SP-STDBY-5-DEV:# flash disk removal -# -type=single -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%FILESYS-SP-STDBY-5-DEV:.*?PCMCIA flash card removed from (\S+) -desc=(WARNING) Flash card removed from $1 $2 -action=pipe '%s' mail -s 'cisco event' root@example.com - -# %OIR-SP-STDBY-6-CONSOLE -# -type=suppress -ptype=substr -pattern=%OIR-SP-STDBY-6-CONSOLE -desc=console access to route processor changed - -# %OIR-SP-6-INSCARD: - card inserted -# -type=single -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OIR-SP-6-INSCARD: Card inserted in slot (\d+), (.*) -desc=(HARMLESS) card inserted in $1 slot $2 status:$3 -action=pipe '%s' mail -s 'cisco event' root@example.com - -# ----- process module events ----- - -# %DIAG-SP-3-TEST_FAIL - diagnostics failed on a module -# -type=single -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DIAG-SP-3-TEST_FAIL: Module (\d+): (.*) -desc=(WARNING) diagnostics failed for $1 module $2 detail:$3 -action=pipe '%s' mail -s 'cisco event' root@example.com - -# %SNMP-5-MODULETRAP -# Looks for a module down followed by module up event -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-MODULETRAP: Module (\d+) [Down] Trap -desc=(MINOR) $1 Module DOWN (not back up in a minute) -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=($1) .*? %SNMP-5-MODULETRAP: Module ($2) [Up] Trap -desc2=(WARNING) $1 Module $2 BOUNCE (down and back up within a minute) -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=60 - -# ----- process irrelevant events (by suppressing) ----- - -# %SYS-SP-STDBY-5-RESTART - system restarted part of the boot - interesting? -# -type=suppress -ptype=substr -pattern=SYS-SP-STDBY-5-RESTART -desc=system restarted - -# %DIAG-SP-6-TEST_RUNNING - Running system test -# -type=suppress -ptype=substr -pattern=%DIAG-SP-6-TEST_RUNNING -desc=running diagnostics on a module - -# %FABRIC-SP-5-FABRIC_MODULE_BACKUP - module changed to backup state -# -type=suppress -ptype=substr -pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP -desc=module became backup - -# %DIAG-SP-6-RUN_MINIMUM - diagnostics are run -# -type=suppress -ptype=substr -pattern=%DIAG-SP-6-RUN_MINIMUM -desc=diagnostics running on switch - -# %DIAG-SP-6-DIAG_OK - diagnostics results are OK -# -type=suppress -ptype=substr -pattern=%DIAG-SP-6-DIAG_OK -desc=diagnostics results are OK - -# %PFREDUN-SP-STDBY-6-STANDBY - SSO events -# -type=suppress -ptype=substr -pattern=%PFREDUN-SP-STDBY-6-STANDBY -desc=SSO event (startup) - -# %PFREDUN-SP-STDBY-6-STANDBY - SSO events -# -type=suppress -ptype=substr -pattern=%PFREDUN-SP-6-ACTIVE -desc=SSO event (startup) - -# %FABRIC-SP-5-FABRIC_MODULE_BACKUP: - secondary sup is up and is secondary -# -type=suppress -ptype=substr -pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP: -desc=secondary sup is up and is secondary - -# %PFINIT-SP-5-CONFIG_SYNC - startup config on standby router sync -# -type=suppress -ptype=substr -pattern=%PFINIT-SP-5-CONFIG_SYNC -desc=startup config on standby router sync - -# %C4K_REDUNDANCY - Cayt 4K configuration/vlan database succesful sync -# the success match is to allow fails in sync to not be suppress -# -type=suppress -ptype=regexp -pattern=%C4K_REDUNDANCY.*?success -desc=config sync with standby supervisor - -# %SCP-SP-5-ASYNC_WATERMARK: SCP long queue wait -# the success match is to allow fails in sync to not be suppress -# -type=suppress -ptype=substr -pattern=%SCP-SP-5-ASYNC_WATERMARK: -desc=SCP control protocol pending queue is longer than notification threshold - -# %MLS_RATE-4-DISABLING: - Layer2 Rate Limiters have been disabled. Is this interesting? -# -type=suppress -ptype=substr -pattern=%MLS_RATE-4-DISABLING: -desc=Layer2 Rate Limiters have been disabled - -# ----- process native VLAN mismatch events ----- - -# %CDP-4-NATIVE_VLAN_MISMATCH: - native VLAN mismatch between switches, will repeat every minute until fixed -# -type=singleWithSuppress -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on (\S+) \((\d+)\), with (\S+) (\S+) \((\d+)\) -desc=(MINOR) A native VLAN mistmatch reported between $1 interface $2 (native VLAN $3) and host $4 interface $5 (native VLAN $6) -action=pipe '%s' mail -s 'cisco event' root@example.com -window=60 - -# ----- process snmp trapblock messages ----- - -# %SNMP-3-TRAPBLOCK - A process tried to create a trap it is not entitled to create -# See Cisco http://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi?action=search&counter=0&paging=5&query=SNMP-3-TRAPBLOCK -# -type=suppress -ptype=substr -pattern=%SNMP-3-TRAPBLOCK -desc=a process tried to create a trap it is not entitled to create - -# ----- process chassis alarm events ----- - -# %SNMP-5-CHASSISALARM - this rule handles the tmpAlarm -# -type=pairWithWindow -continue=takeNext -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(ON\) -desc=(MINOR) $1 temprature alarm signaled and not cleared in five minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -continue2=takeNext -ptype2=regexp -pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(OFF\) -desc2=(WARNING) $1 temprature alarm went on and was cleared in under five minutes -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=300 - -# %SNMP-5-CHASSISALARM - this rule handles the minorAlarm -# -type=pairWithWindow -continue=takeNext -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(ON\) -desc=(MINOR) $1 minor alarm reported and not cleared in three minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -continue2=takeNext -desc2=(WARNING) $1 minor alarm went on and was cleared in under three minutes -ptype2=regexp -pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(OFF\) -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=180 - -# %SNMP-5-CHASSISALARM - this rule handles the majorAlarm -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(ON\) -desc=(MINOR) $1 major alarm signaled and not cleared in two minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(OFF\) -desc2=(WARNING) $1 major alarm went on and was cleared in under two minutes -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=120 - -# ----- process power supply related events ----- - -# %C4K_IOSMODPORTMAN events - this one is about power supplies only -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD: Power Supply (\d+) has failed or been turned off -desc=(MINOR) $1 power supply $2 reported bad and event not cleared in two minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=($1) .*? %C4K_IOSMODPORTMAN-6-POWERSUPPLYGOOD: Power Supply ($2) is Okay -desc2=(WARNING) $1 power supply $2 alarm went on and was cleared in under two minutes -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=120 - -# ----- process neighbor down and neighbor up events ----- - -# %DVMRP-5-NBRDOWN -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DVMRP-5-NBRDOWN: Neighbor (\S+) went down on (\S+) -desc=(MINOR) $1 lost DVMRP neighbor $2 on interface $3 and it did not come up in two minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=($1) .*? %DVMRP-5-NBRUP: Neighbor ($2) is up on ($3) -desc2=(WARNING) $1 lost DVMRP neighbor $2 on interface $3 but id come up within two minutes -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=120 - -# ----- process fan power supply failure/ok events ----- - -# %C6KENV-SP-4-PSFANF events - this one is about fan failures -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C6KENV-SP-4-PSFANFAILED: the fan in power supply (\d+) has failed -desc=(MINOR) $1 fan in power supply $2 was reported bad and event not cleared in two minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=($1) .*? %C6KENV-SP-4-PSFANOK: the fan in power supply (\d+) is OK -desc2=(WARNING) $1 fan in power supply $2 alarm went on and was cleared in under two minutes -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=120 - -# ----- process events that have not been matched by any of above rules ----- - -# Default match -# this rule will match anything not previously matched but allows only -# one notification per day for each new event class seen -# -type=singleWithSuppress -ptype=regexp -pattern=(%.*?:) -desc=$1 -action=pipe '$0' mail -s 'cisco event' root@example.com -window=86400 diff --git a/conf.README b/conf.README index 7365c13..252ae6f 100644 --- a/conf.README +++ b/conf.README @@ -2,9 +2,11 @@ This is the SEC configuration directory. Because SEC usage varies so widely from user to user, this package is configured by default to not run. The commented-out default settings in /etc/sysconfig/sec will load any file in -this directory with a .sec suffix. Please look through the example files -included in /usr/share/doc/sec-/examples/ and install the ones you -want here (taking into account that the examples are generic and some of them -may need to be tweaked to work with your setup). You should also read the SEC -man page so you have at least a basic understanding of the SEC configuration -commands. +this directory with a .sec suffix. You can find several example rules at + + https://github.com/simple-evcorr/rulesets + +and install the ones you want here (taking into account that the examples are +generic and some of them may need to be tweaked to work with your setup). You +should also read the SEC man page so you have at least a basic understanding of +the SEC configuration commands. diff --git a/cvs.sec b/cvs.sec deleted file mode 100644 index ae5af5d..0000000 --- a/cvs.sec +++ /dev/null @@ -1,44 +0,0 @@ -############################################################################# -# CVS events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -#Jul 31 19:54:21 xxxx xinetd[2088]: START: cvspserver pid=16385 from=xx.xx.xx.xx - -type=single -desc = cvsp server connection start -ptype=regexp -pattern=([A-z._0-9-]*) xinetd\[\d+\]: START: cvspserver pid=\d+ from=(\d+\.\d+\.\d+\.\d+) -action=add GENERAL_REPORT CVS Connection from $2 on $1 - - -#Aug 5 10:38:29 xxxx cvs: password mismatch for username in /usr/local/cvsroot: PMOv/9hZsf6v. vs. PMMlzZLYrbthY - -type=single -ptype=regexp -pattern=([A-z._0-9-]*) cvs: password mismatch for (.*) in (.*) -desc = cvs login failure -action=pipe '$1 $2 CVS Login Failure: User $2 from $3' /usr/bin/mail -s '$1 $2 CVS Login Failure: $2 from $3' alerts@example.com - - -#Aug 5 10:38:49 xxxx cvs: attempt to root from account: username - -type=single -ptype=regexp -pattern=([A-z._0-9-]*) cvs: attempt to root from account: (.*) -desc = cvs login to root attempt -action=pipe ' $1 $2 CVS Login to Root Attempt: User $2 ' /usr/bin/mail -s '$1 CVS Login to Root Failure: $2' alerts@example.com - - -#Aug 5 10:42:37 xxxx cvs: login failure (for /usr/local/cvsroot) - -type=single -ptype=regexp -pattern=([A-z._0-9-]*) cvs: login failure \(for /usr/local/cvsroot\) -desc = cvs login failure -action=pipe '$1 $2 CVS Login Failure ' /usr/bin/mail -s '$1 CVS Login Failure' alerts@example.com - diff --git a/dameware.sec b/dameware.sec deleted file mode 100644 index 8dd5201..0000000 --- a/dameware.sec +++ /dev/null @@ -1,24 +0,0 @@ -############################################################################# -# Dameware events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -#Dameware Connect -type=single -ptype=regexp -pattern=([A-z._0-9-]*) DMWRCS: (.*) Connect: (.*) -desc = Dameware Connect -action=add WINDOWS_REPORT DAMEWARE CONNECT: %s; \ -pipe 'DAMEWARE Connect -- : %s' /usr/bin/mail -s 'DAMEWARE CONNECT' alerts@example.com - - -#Dameware Disconnect -type=single -ptype=regexp -pattern=([A-z._0-9-]*) DMWRCS: (.*) Disconnect: (.*) -desc = Dameware Disconnect -action=add WINDOWS_REPORT DAMEWARE DISCONNECT: %s diff --git a/hp-openview.sec b/hp-openview.sec deleted file mode 100644 index 7ece030..0000000 --- a/hp-openview.sec +++ /dev/null @@ -1,114 +0,0 @@ -################################################################ -# Sample SEC ruleset for HP OpenView ITO -# -# Copyright (C) 2003-2010 Risto Vaarandi -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -################################################################ - -# process Cisco linkDown/linkUp trap events received from -# HP OpenView ITO trap template through itostream plugin - -type=PairWithWindow -ptype=RegExp -pattern=node=([\w.-]+) .*msg_text=cisco linkdown trap on interface ([\w-]+)\b -desc=CISCO $1 INTERFACE $2 DOWN -action=event %s; -continue2=TakeNext -ptype2=RegExp -pattern2=node=$1 .*msg_text=cisco linkup trap on interface $2\b -desc2=CISCO %1 INTERFACE %2 BOUNCE -action2=event %s; -window=20 - -type=SingleWithSuppress -continue=TakeNext -ptype=RegExp -pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) DOWN -desc=cisco $1 interface $2 down -action=reset +1 %s -window=60 - -type=Pair -ptype=RegExp -pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) DOWN -desc=cisco $1 interface $2 down -action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major down -ptype2=RegExp -pattern2=node=$1 .*msg_text=cisco linkup trap on interface $2\b -desc2=cisco %1 interface %2 up -action2=shellcmd /home/opc_op/cisco_msg.sh %1 %2 normal up -window=86400 - -type=SingleWith2Thresholds -ptype=RegExp -pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) BOUNCE -desc=cisco $1 interface $2 is unstable -action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major unstable -window=3600 -thresh=10 -desc2=cisco $1 interface $2 is stable again -action2=shellcmd /home/opc_op/cisco_msg.sh $1 $2 normal stable -window2=10800 -thresh2=0 - -# -# the cisco_msg.sh script: -# -##!/bin/sh -# -#NODE=$1 -#IF=$2 -#SEV=$3 -#TEXT=$4 -# -## use snmpget utility from Net-SNMP package -#IFNAME=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.2.1.2.2.1.2.$IF` -#DESCR=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.4.1.9.2.2.1.1.28.$IF` -# -#MSG=`echo "Interface $IFNAME ($DESCR) $TEXT" | sed s/\"/\'/g` -# -#/opt/OV/bin/OpC/opcmsg node=$NODE app=cisco obj=if \ -# sev=$SEV msg_grp=Network msg_text="$MSG" -# - - -# process APC ups "not online" trap events received from -# HP OpenView ITO trap template through itostream plugin - -type=SingleWithScript -ptype=RegExp -pattern=node=([\w.-]+) .*msg_text=APC ups not online -script=/home/opc_op/check_apc.sh $1 -desc=APC ups is not online! -action=shellcmd /opt/OV/bin/OpC/opcmsg node=$1 app=APC obj=state \ - msg_grp=UPS sev=critical msg_text='%s' - -# -# the check_apc.sh script -# -##!/bin/sh -# -## sleep for a few seconds and check if the UPS error is still present; -## if it is, exit with 0, otherwise exit with 1 -# -#UPS=$1 -#sleep 5 -# -## use snmpget utility from Net-SNMP package -#STATUS=`/usr/bin/snmpget -c public -OQve $UPS .1.3.6.1.4.1.318.1.1.1.4.1.1.0` -# -## According to the APC Powernet MIB the variable .1.3.6.1.4.1.318.1.1.1.4.1.1 -## takes the the following values: unknown(1), onLine(2), onBattery(3), -## onSmartBoost(4), timedSleeping(5), softwareBypass(6), off(7), rebooting(8), -## switchedBypass(9), hardwareFailureBypass(10), sleepingUntilPowerReturn(11), -## and onSmartTrim(12), where onLine(2) is the normal state for the UPS -# -#if [ $STATUS -eq 2 ] -#then -# exit 1 -#else -# exit 0 -#fi -# diff --git a/labrea.sec b/labrea.sec deleted file mode 100644 index d27153a..0000000 --- a/labrea.sec +++ /dev/null @@ -1,36 +0,0 @@ -############################################################################# -# Labrea tarpit events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Initial Connect \(tarpitting\): (\d+\.\d+\.\d+\.\d+\s\d+) \-> \d+\.\d+\.\d+\.\d+\s(.*) -desc=$0 -action=add TARPIT_REPORT %t: $1 New Tarpitted Connect from $2 on port $3 - -#type=Single -#ptype=RegExp -#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Additional Activity: (\d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+ (\d+)* -#desc=$0 -#action=add TARPIT_REPORT %t: %s; -# - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Responded to a PING: (d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+ -desc=$0 -action=add TARPIT_REPORT %t: PING Sweep from $@ on $3 - -#Send hourly tarpit report - -type=Calendar -time=0 8,12,20 * * * -desc=Sending tarpit report... -action=report TARPIT_REPORT \ - /usr/bin/mail -s 'Tarpits: Tarpit Victim report' alerts@example.com; \ - delete TARPIT_REPORT diff --git a/pix-general.sec b/pix-general.sec deleted file mode 100644 index 1aa9b87..0000000 --- a/pix-general.sec +++ /dev/null @@ -1,1046 +0,0 @@ -#################################################################### -# SEC ruleset for Cisco PIX 6.x, 7.x, FWSM 2.x -# -# Copyright (C) 2003-2009 Colin Hudler -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -#################################################################### - -# Process various events from PIX syslog output -# -# TODO -- A few FWSM log lines will not match. - -# Setup our variables -- not the right way to do this? Needs tweaking for your log lines -type=Single -ptype=RegExp -pattern=^(.* [0-9].:[0-9].:[0-9].) (.*)\.yourdomain\.edu.*?%(PIX|FWSM)-[0-9]-.*?:(.*) -desc=PIXLOG $2^ $1 $4 -action=event %s - -# 106001 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Inbound TCP connection denied from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+).* -desc=PIX $1 TCP connection denid HAMMER $2 to $3 -action=create ham1_$1; add ham1_$1 %t; add ham1_$1 %s;add ham1_$1 %s; add ham1_$1 $0; report ham1_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham1_$1 -window=10 -thresh=6 - -# 106006 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Connection denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+) -desc=PIX $1 denied by list HAMMER $2 to $3 -action=create ham2_$1; add ham2_$1 %t; add ham2_$1 %s; add ham2_$1 $0; report ham2_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham2_$1 -window=10 -thresh=6 - -# 106007 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny inbound UDP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) due to DNS.* -desc=PIX $1 Denied inbound UDP HAMMER $2 to $3 -action=create ham3_$1; add ham3_$1 %t; add ham3_$1 %s; add ham3_$1 $0; report ham3_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham3_$1 -window=10 -thresh=6 - -# 106010 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny inbound.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+).* -desc=PIX $1 Denied inbound HAMMER $2 to $3 -action=create ham4_$1; add ham4_$1 %t; add ham4_$1 %s; add ham4_$1 $0; report ham4_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham4_$1 -window=10 -thresh=6 - -# 106012 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny IP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+), IP options.* -desc=PIX $1 Denied IP Options HAMMER $2 to $3 -action=create ham5_$1; add ham5_$1 %t; add ham5_$1 %s; add ham5_$1 $0; report ham5_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham5_$1 -window=10 -thresh=6 - -# 106013 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Dropping echo request from (\d+.\d+.\d+.\d+) to PAT address -desc=PIX $1 Echo HAMMER $2 to PAT Address -action=create ham6_$1; add ham6_$1 %t; add ham6_$1 %s; add ham6_$1 $0; report ham7_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham8_$1 -window=10 -thresh=6 - -# 106014 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny inbound icmp src.*: (\d+.\d+.\d+.\d+) dst.*: (\d+.\d+.\d+.\d+) -desc=PIX $1 Deny inbound ICMP HAMMER $2 to $3 -action=create ham9_$1; add ham9_$1 %t; add ham9_$1 %s; add ham9_$1 $0; report ham9_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham9_$1 -window=10 -thresh=6 - -# 106015 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny.*\(no connection\) from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) -desc=PIX $1 Deny (no connection) HAMMER $2 to $3 -action=create ham10_$1; add ham10_$1 %t; add ham10_$1 %s; add ham10_$1 $0; report ham10_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham10_$1 -window=10 -thresh=30 - -# 106016,106017,106020,106021,106022 is further down this list... - -# 106018 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*ICMP packet type.*denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+) -desc=PIX $1 Deny ICMP type HAMMER $2 to $3 -action=create ham11_$1; add ham11_$1 %t; add ham11_$1 %s; add ham11_$1 $0; report ham11_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham11_$1 -window=10 -thresh=6 - -# 106023 -#Deny udp src outside:128.135.93.11/137 dst inside:128.135.211.65/137 by access-group "inward" -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+) by .* -desc=PIX $1 Deny by ACL HAMMER $2 to $3 -action=create ham12_$1; add ham12_$1 %t; add ham12_$1 %s; add ham12_$1 $0; report ham12_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham12_$1 -window=10 -thresh=32 - -# This is broken... still fix? TODO -# 106001 -- Report -#type=SingleWithThreshold -#continue=takenext -#ptype=RegExp -#pattern=^PIXLOG (\S+)\^ .*(Inbound TCP connection denied from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+).*)|\ -#(Connection denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+))|\ -#(Deny inbound UDP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) due to DNS)|\ -#(Deny inbound.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+))|\ -#(Deny IP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+), IP options)|\ -#(Dropping echo request from (\d+.\d+.\d+.\d+) to PAT address)|\ -#(Deny inbound icmp src.*: (\d+.\d+.\d+.\d+) dst.*: (\d+.\d+.\d+.\d+))|\ -#(Deny.*\(no connection\) from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+))|\ -#(ICMP packet type.*denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+))|\ -#(Deny.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+) by ) -#desc=PIX Conn Denied 10 times from $2 -#action=create rpt_$1; add rpt_$1 %t; add rpt_$1 %s;add rpt_$1 %s; add rpt_$1 $0; report rpt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpt_$1 -#window=10 -#thresh=30 - -# 101002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Bad failover cable. -desc=PIX $1 Bad Failover Cable -action=create bfc_$1; add bfc_$1 %t; add bfc_$1 %s; add bfc_$1 $0; report bfc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete bfc_$1 - -# 101003/4 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Failover cable not connected -desc=PIX $1 Failover cable gone -action=create nfc_$1; add nfc_$1 %t; add nfc_$1 %s; add nfc_$1 $0; report nfc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nfc_$1 - -# 101005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Error reading failover cable status -desc=PIX $1 Failover cable ERROR -action=create fce_$1; add fce_$1 %t; add fce_$1 %s; add fce_$1 $0; report fce_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fce_$1 - -# 102001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Power failure/System reload -desc=PIX $1 Peer Lost Power -action=create fpp_$1; add fpp_$1 %t; add fpp_$1 %s; add fpp_$1 $0; report fpp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpp_$1 - -# 103001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*No response from other firewall -desc=PIX $1 Peer Gone Away -action=create fnp_$1; add fnp_$1 %t; add fnp_$1 %s; add fnp_$1 $0; report fnp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fnp_$1 - -# 103003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Other firewall network interface (\S+) failed -desc=PIX $1 Peer interface $2 died -action=create fpi_$1; add fpi_$1 %t; add fpi_$1 %s; add fpi_$1 $0; report fpi_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpi_$1 - -# 103004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Other firewall reports this firewall failed -desc=PIX $1 Peer says I failed -action=create fif_$1; add fif_$1 %t; add fif_$1 %s; add fif_$1 $0; report fif_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fif_$1 - -# 103005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Other firewall reporting failure -desc=PIX $1 Peer reports failure -action=create fpf_$1; add fpf_$1 %t; add fpf_$1 %s; add fpf_$1 $0; report fpf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpf_$1 - -# 104001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*(Primary|Secondary) Switching to ACTIVE \(cause: (.*)\) -desc=PIX $1 FAILOVER! Becoming ACTIVE because $2 -action=create fba_$1; add fba_$1 %t; add fba_$1 %s; add fba_$1 $0; report fba_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fba_$1 - -# 104002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*(Primary|Secondary) Switching to STNDBY \(cause: (.*)\) -desc=PIX $1 FAILOVER! Becoming STNDBY because $2 -action=create fbs_$1; add fbs_$1 %t; add fbs_$1 %s; add fsb_$1 $0; report fbs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fbs_$1 - -# 104003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Switching to FAILED -desc=PIX $1 IN FAILED STATE! -action=create ffs_$1; add ffs_$1 %t; add ffs_$1 %s; add ffs_$1 $0; report ffs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ffs_$1 - -# 104004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Switching to OK. -desc=PIX $1 Failed Unit is ok -action=create ffs_$1; add ffs_$1 %t; add ffs_$1 %s; add ffs_$1 $0; report ffs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ffs_$1 - -# 105005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Lost Failover communications with mate on interface -desc=PIX $1 Peer Gone Away -action=create fnp_$1; add fnp_$1 %t; add fnp_$1 %s; add fnp_$1 $0; report fnp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fnp_$1 - -# 105007 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Link status \'Down\' on interface (\S+).* -desc=PIX $1 interface $2 is DOWN -action=create ind_$1; add ind_$1 %t; add ind_$1 %s; add ind_$1 $0; report ind_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ind_$1 - -# 105011 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Failover cable communication failure -desc=PIX $1 Failver cable failed -action=create fcf_$1; add fcf_$1 %t; add fcf_$1 %s; add fcf_$1 $0; report fcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fcf_$1 - -# 105021 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Standby unit failed to sync due to a locked (\S+) config. Lock held by (\S+) -desc=PIX $1 Failover Sync failed because $2 is locked by $3 -action=create lck_$1; add fcf_$1 %t; add fcf_$1 %s; add lck_$1 $0; report lck_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lck_$1 - -# 10532 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LAN Failover interface is down -desc=PIX $1 Failover interface is down -action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 - -# 10535 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Receive a LAN failover interface down msg from peer. -desc=PIX $1 Failover Peer reports LAN interface down -action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 - -# 10536 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*dropped a LAN Failover command message. -desc=PIX $1 Failover Dropped a LAN packet -action=create fdr_$1; add fdr_$1 %t; add fdr_$1 %s; add fdr_$1 $0; report fdr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fdr_$1 - -# 10537 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*The primary and standby units are switching back -desc=PIX $1 Failover: primary and standby units are switching back -action=create fsw_$1; add fsw_$1 %t; add fsw_$1 %s; add fsw_$1 $0; report fsw_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsw_$1 - -# 10543 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Failover interface failed -desc=PIX $1 Failover LAN Interface is down! -action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 - -# messages from 106001 moved to top - -# 106011 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny inbound (No xlate).* -desc=PIX $1 Same-Side Traffic Attack -action=create sst_$1; add sst_$1 %t; add sst_$1 %s; add sst_$1 $0; report sst_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sst_$1 - -# 106016 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny IP spoof from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) on interface -desc=PIX $1 IP Spoof from $2 to $3 -action=create spf_$1; add spf_$1 %t; add spf_$1 %s; add spf_$1 $0; report spf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spf_$1 - -# 106017 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny IP due to Land Attack from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) -desc=PIX $1 IP LAND Attack -action=create lnd_$1; add lnd_$1 %t; add lnd_$1 %s; add lnd_$1 $0; report lnd_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lnd_$1 - -# 106020 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny IP teardrop fragment.*from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) -desc=PIX $1 Teardrop Attack -action=create tdr_$1; add tdr_$1 %t; add tdr_$1 %s; add tdr_$1 $0; report tdr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tdr_$1 - -# 106021 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny.*reverse path check from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+).* -desc=PIX $1 Reverse Path Check Attack from $2 to $3 -action=create rpc_$1; add rpc_$1 %t; add rpc_$1 %s; add rpc_$1 $0; report rpc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpc_$1 - -# 106022 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny.*connection spoof from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+).* -desc=PIX $1 Connection Spoof Attack from $2 to $3 -action=create spf_$1; add spf_$1 %t; add spf_$1 %s; add spf_$1 $0; report spf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spf_$1 - -# 106024 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Access rules memory exhausted -desc=PIX $1 Out of ACL Memory! -action=create ame_$1; add ame_$1 %t; add ame_$1 %s; add ame_$1 $0; report ame_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ame_$1 - -# 106025/6 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Failed to determine the security context for the packet:(\S+):(\d+.\d+.\d+.\d+) (\d+.\d+.\d+.\d+) (\d+) (\d+).* -desc=PIX $1 failed getting context for vlan $2 $3:$4 to $5:$6 -action=create ctx_$1; add ctx_$1 %t; add ctx_$1 %s; add ctx_$1 $0; report ctx_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ctx_$1 - -# 107001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*RIP auth failed from (\d+.\d+.\d+.\d+).* -desc=PIX $1 RIP Auth Attack from $2 -action=create rip_$1; add rip_$1 %t; add rip_$1 %s; add rip_$1 $0; report rip_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rip_$1 - -# 107002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*RIP pkt failed from (\d+.\d+.\d+.\d+).* -desc=PIX $1 Invalid RIP Packet from $2 -action=create rpk_$1; add rpk_$1 %t; add rpk_$1 %s; add rpk_$1 $0; report rpk_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpk_$1 - -# 109003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Auth from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+\/\d+) failed \(all servers failed\).* -desc=PIX $1 All AAA Failed from $2 to $3 -action=create aaa_$1; add aaa_$1 %t; add aaa_$1 %s; add aaa_$1 $0; report aaa_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete aaa_$1 - -# 109006/8 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*(Authentication|Authorization) (failed|denied) for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) -desc=PIX $1 Auth Guessing Attack by $2 from $3 to $4 -action=create brt_$1; add brt_$1 %t; add brt_$1 %s; add brt_$1 $0; report brt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete brt_$1 -window=10 -thresh=6 - -# 109010 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Auth from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) failed \(too many pending auths\).* -desc=PIX $1 Max Auths Reached for $2 to $3 -action=create mth_$1; add mth_$1 %t; add mth_$1 %s; add mth_$1 $0; report mth_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mth_$1 - -# 109017 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User at (\d+.\d+.\d+.\d+) exceeded auth proxy connection -desc=PIX $1 $2 has opened to many proxy conns -action=create pcn_$1; add pcn_$1 %t; add pcn_$1 %s; add pcn_$1 $0; report pcn_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pcn_$1 - -# 109024 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Authorization denied.*for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) -desc=PIX $1 Authorization Denied HAMMER $2 from $3 to $4 -action=create uhm_$1; add uhm_$1 %t; add uhm_$1 %s; add uhm_$1 $0; report uhm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete uhm_$1 -window=10 -thresh=6 - -# 109025 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Authorization denied \(acl=.*\) for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) on interface.* -desc=PIX $1 Authorization Denied HAMMER $2 from $3 to $4 -action=create uhm_$1; add uhm_$1 %t; add uhm_$1 %s; add uhm_$1 $0; report uhm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete uhm_$1 -window=10 -thresh=6 - -# 111001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Begin configuration: (\d+.\d+.\d+.\d+) writing to (\S+) -desc=PIX $1 Config saved to $3 by $2 -action=create sav_$1; add sav_$1 %t; add sav_$1 %s; add sav_$1 $0; report sav_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sav_$1 - -# 111002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Begin configuration: (\d+.\d+.\d+.\d+) reading from (\S+) -desc=PIX $1 Config read from $3 by $2 -action=create sav_$1; add sav_$1 %t; add sav_$1 %s; add sav_$1 $0; report sav_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sav_$1 - -# 111003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*(\d+.\d+.\d+.\d+) Erase configuration -desc=PIX $1 WRITE ERASE WAS ISSUED $2 -action=create ers_$1; add ers_$1 %t; add ers_$1 %s; add ers_$1 $0; report ers_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ers_$1 - -# 111004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*(\d+.\d+.\d+.\d+) end configuration: \[FAILED\] -desc=PIX $1 FAILED CONFIGURING $2 -action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# 111008 -type=Single -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User \'(\S+)\' executed the command (.*) -desc=PIX $1 $2 executed: $3 -action=add CMD_REPORT $2 : $3 -#create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# FIXME -- Add syslog number -# FSWM Style -type=Single -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User \'(\S+)\' executed the \'(.*)\' command.* -desc=PIX $1 $2 executed: $3 -action=add CMD_REPORT $2 : $3 -#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - - -# 111008 -type=Single -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User (\S+) executed cmd:(.*) -desc=PIX $1 $2 executed: $3 -action=add CMD_REPORT $2 : $3 -#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 -#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# 113001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Unable to open AAA session. Session limit -desc=PIX $1 AAA Reached session limit -action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# 113005 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*AAA user authentication Rejected: reason = (.*) server = .* User = (\S+).* -desc=PIX $1 IPSEC: User Auth Attack: $2 for $3 -action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 -window=10 -thresh=6 - -# 113006 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User (\S+) locked out on exceeding number successive failed authentication attempts -desc=PIX $1 User Locked out: $2 -action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# 113020 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Kerberos error : Clock skew with server (\d+.\d+.\d+.\d+).* -desc=PIX $1 User Locked out: $2 -action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# Might be only 6.x -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Console Login from user at (\d+.\d+.\d+.\d+) -desc=PIX $1 Console Login from $2 -action=create con_$1; add con_$1 %t; add con_$1 %s; add con_$1 $0; report con_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete con_$1 - -# 112001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*clear (finished|complete)\. -desc=PIX $1 Clear Command Executed -action=create clr_$1; add clr_$1 %t; add clr_$1 %s; add clr_$1 $0; report clr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete clr_$1 - -# 199002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*[rR]eload command executed from.*(\d+.\d+.\d+.\d+) -desc=PIX $1 Reloaded by $2 -action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 - -# 199002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Orderly reload started at.*by (\S+). Reload.* -desc=PIX $1 Reloaded by $2 -action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 - -# 201002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+).*Too many.*connections on (static|xlate) (\d+.\d+.\d+.\d+) -desc=PIX $1 Max Embryonics to $3 (not attack) -action=create max_$1; add max_$1 %t; add max_$1 %s; add max_$1 $0; report max_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete max_$1 - -# 201003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Embryonic limit exceeded.*for (\d+.\d+.\d+.\d+\/\d+) \((\d+.\d+.\d+.\d+)\) (\d+.\d+.\d+.\d+\/\d+) -desc=PIX $1 Max Embryonics from $2 to $3 ($4) Attack -action=create emb_$1; add emb_$1 %t; add emb_$1 %s; add emb_$1 $0; report emb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete emb_$1 - -# 201008 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*The PIX is disallowing new connections. -desc=PIX $1 No longer allowing connections! -action=create stp_$1; add stp_$1 %t; add stp_$1 %s; add stp_$1 $0; report stp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete stp_$1 - -# 202001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Out of address translation slots! -desc=PIX $1 Out of NAT Slots -action=create nnt_$1; add nnt_$1 %t; add nnt_$1 %s; add nnt_$1 $0; report nnt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nnt_$1 - -# 209003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Fragment database limit of.*exceeded: src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* -desc=PIX $1 No room to assemble more frags from $2 to $3 -action=create frg_$1; add frg_$1 %t; add frg_$1 %s; add frg_$1 $0; report frg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete frg_$1 - -# 209004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Invalid IP fragment, size =.*exceeds maximum size =.*src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* -desc=PIX $1 Frag is invalid from $2 to $3 -action=create lrg_$1; add lrg_$1 %t; add lrg_$1 %s; add lrg_$1 $0; report lrg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lrg_$1 - -# 209005 -# FIXME -- Cisco log message doesnt match this -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Discard IP fragment set with more than.*elements:src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* -desc=PIX $1 To many frags from $2 to $3 -action=create _$1; add _$1 %t; add _$1 %s; add _$1 $0; report _$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete _$1 - -# 210002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU allocate block .* failed. -desc=PIX $1 Failover Block Alocation Failed -action=create fba_$1; add fba_$1 %t; add fba_$1 %s; add fba_$1 $0; report fba_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fba_$1 - -# 210005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU allocate connection failed -desc=PIX $1 Failover Connection Failed -action=create fcf_$1; add fcf_$1 %t; add fcf_$1 %s; add fcf_$1 $0; report fcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fcf_$1 - -# 210003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Unknown LU Object.* -desc=PIX $1 Failover: Unknown LU Object -action=create ulu_$1; add ulu_$1 %t; add ulu_$1 %s; add ulu_$1 $0; report ulu_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ulu_$1 - -# 210006 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU look NAT for (\d+.\d+.\d+.\d+) failed -desc=PIX $1 Failover NAT Sync failed for $2 -action=create fns_$1; add fns_$1 %t; add fns_$1 %s; add fns_$1 $0; report fns_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fns_$1 - -# 210007 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU allocate xlate failed -desc=PIX $1 Failover xlate Sync Failed -action=create fxs_$1; add fxs_$1 %t; add fxs_$1 %s; add fxs_$1 $0; report fxs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxs_$1 - -# 210008 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU no xlate for (\d+.\d+.\d+.\d+\/\d+) (\d+.\d+.\d+.\d+\/\d+) -desc=PIX $1 Failover xlate Sync Failure for $2 to $3 -action=create fxs_$1; add fxs_$1 %t; add fxs_$1 %s; add fxs_$1 $0; report fxs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxs_$1 - -# 210010 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU make UDP connection for (\d+.\d+.\d+.\d+:\d+) (\d+.\d+.\d+.\d+:\d+) failed -desc=PIX $1 Failover UDP Conn sync failure for $2 to $3 -action=create fus_$1; add fus_$1 %t; add fus_$1 %s; add fus_$1 $0; report fus_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fus_$1 - -# 210020 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU PAT port (\d+) reserve failed -desc=PIX $1 Failover PAT Sync for $2 failed -action=create fps_$1; add fps_$1 %t; add fps_$1 %s; add fps_$1 $0; report fps_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fps_$1 - -# 210021 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU create static xlate (\d+.\d+.\d+.\d+).*failed -desc=PIX $1 Failover Static xlate failed for $2 -action=create fxf_$1; add fxf_$1 %t; add fxf_$1 %s; add fxf_$1 $0; report fxf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxf_$1 - -# 210022 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU missed (\d+) updates -desc=PIX $1 Failover Sync failed for $2 updates -action=create fsf_$1; add fsf_$1 %t; add fsf_$1 %s; add fsf_$1 $0; report fsf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsf_$1 - -# 211001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Memory allocation Error -desc=PIX $1 Memory allocation Error! -action=create mae_$1; add mae_$1 %t; add mae_$1 %s; add mae_$1 $0; report mae_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mae_$1 - -# 211003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*CPU utilization for (\d+) seconds = (.*) -desc=PIX $1 CPU high ($2) for $3 secs -action=create cpu_$1; add cpu_$1 %t; add cpu_$1 %s; add cpu_$1 $0; report cpu_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cpu_$1 - -# 211003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Dropping SNMP request from (\d+.\d+.\d+.\d+\/\d+) to.*:(\d+.\d+.\d+.\d+\/\d+).* -desc=PIX $1 SNMP Attempt from $2 to $3 -action=create snp_$1; add snp_$1 %t; add snp_$1 %s; add snp_$1 $0; report snp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete snp_$1 - -# 213001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PPTP control daemon socket io.*errno = (\d+) -desc=PIX $1 PPTP Error $2 -action=create ppt_$1; add ppt_$1 %t; add ppt_$1 %s; add ppt_$1 $0; report ppt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppt_$1 - -# 213002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PPTP tunnel hashtable insert failed, peer = (\d+.\d+.\d+.\d+) -desc=PIX $1 PPTP hash table insert failed for $2 -action=create pht_$1; add pht_$1 %t; add pht_$1 %s; add pht_$1 $0; report pht_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pht_$1 - -# 213003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PPP virtual interface (\S+) isn't opened. -desc=PIX $1 PPP Virtual Int $2 failed to close -action=create ppp_$1; add ppp_$1 %t; add ppp_$1 %s; add ppp_$1 $0; report ppp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppp_$1 - -# 213004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PPP virtual interface (\S+) client ip allocation failed. -desc=PIX $1 PPP Virutal interface $2 failure (pool depleted) -action=create ppl_$1; add ppl_$1 %t; add ppl_$1 %s; add ppl_$1 $0; report ppl_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppl_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Denied Telnet login session from (\d+.\d+.\d+.\d+) on interface (int_name). -desc=PIX $1 Denid Telnet from $2 ($3) !! -action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Permitted Telnet login session from (\d+.\d+.\d+.\d+) -desc=PIX $1 Permitted Telnet from $2 ! -action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*telnet login session failed from (\d+.\d+.\d+.\d+).* -desc=PIX $1 Telnet login guessing attack -action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 - -# 308001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PIX console enable password incorrect for (num) tries \(from (\d+.\d+.\d+.\d+)\). -desc=PIX $1 Many Enable Password failures for $3 -action=create enb_$1; add enb_$1 %t; add enb_$1 %s; add enb_$1 $0; report enb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enb_$1 - -# 315011 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*SSH session from (\d+.\d+.\d+.\d+) on interface.*for user (\S+) disconnected by SSH server, reason:.* -desc=PIX $1 SSH Auth Attach from $2 ($3) -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 %s; add ssh_$1 $0; report ssh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ssh_$1 -window=10 -thresh=6 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Denied manager connection from (\d+.\d+.\d+.\d+). -desc=PIX $1 Denied Manager from $2 -action=create nmg_$1; add nmg_$1 %t; add nmg_$1 %s; add nmg_$1 $0; report nmg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nmg_$1 - -# FIXME -- Add log code FWSM -type=Single -continue=takenext -ptype=RegExp -pattern==^PIXLOG (\S+)\^ .*Denied SSH session from (\d+.\d+.\d+.\d+) on interface.* -desc=PIX $1 Denied SSH from $2 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 %s; add ssh_$1 $0; report ssh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ssh_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Permitted manager connection from (IP_addar). -desc=PIX $1 Allowed Manager from $2 -action=create ymg_$1; add ymg_$1 %t; add ymg_$1 %s; add ymg_$1 $0; report ymg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ymg_$1 - -# FIXME -# SET \d+.\d+.\d+.\d+ TO ! 128.135.0.x -#type=Single -#continue=takenext -#ptype=RegExp -#pattern=^PIXLOG (\S+)\^ .*Permitted SSH session from (\d+.\d+.\d+.\d+) on interface.*for user "user_id" -#desc=PIX $1 Permitted ssh $3 from $2 -#action=create fsh_$1; add fsh_$1 %t; add fsh_$1 %s; add fsh_$1 $0; report fsh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsh_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*SSH login session failed from (\d+.\d+.\d+.\d+) on \((num) attempts\) on interface.*by user "(\S+)" -desc=PIX $1 SSH $3 Failures from $2 by $4 -action=create lsh_$1; add lsh_$1 %t; add lsh_$1 %s; add lsh_$1 $0; report lsh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lsh_$1 - -# 402101 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*decaps: rec\'d IPSEC packet has invalid spi for destaddr=(\d+.\d+.\d+.\d+).* -desc=PIX $1 IPSEC: Invalid SPI in packet from $2 (possible attack) -action=create spi_$1; add spi_$1 %t; add spi_$1 %s; add spi_$1 $0; report spi_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spi_$1 - -# 402101 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*decapsulate: packet missing (.*), destadr=(\d+.\d+.\d+.\d+) -desc=PIX $1 IPSEC: Packet to $3 did not have type $2 (possible attack) -action=create itp_$1; add itp_$1 %t; add itp_$1 %s; add itp_$1 $0; report itp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete itp_$1 - -# 402103 -# FIXME -- This is messy -#type=Single -#continue=takenext -#ptype=RegExp -#pattern=^PIXLOG (\S+)\^ .*dentity doesn't match negotiated identity \((ip)\) dest_addr= (\d+.\d+.\d+.\d+), src_addr= (\d+.\d+.\d+.\d+), prot= protocol, \((ident)\) local=(\d+.\d+.\d+.\d+), remote=(\d+.\d+.\d+.\d+), local_proxy=(\d+.\d+.\d+.\d+/\d+.\d+.\d+.\d+/port/port), remote_proxy=(\d+.\d+.\d+.\d+/\d+.\d+.\d+.\d+/port/port) -#desc=PIX $1 IPSEC: Peer $2 is attempting to send other packets through us $3 $4 $5 $6 $7 -#action=create per_$1; add per_$1 %t; add per_$1 %s; add per_$1 $0; report per_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete per_$1 - -# 402115 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Received a packet from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) containing.*data instead of.*data. -desc=PIX $1 IPSEC: packet from $2 to $3 doesn't match negotiated proto -action=create ipx_$1; add ipx_$1 %t; add ipx_$1 %s; add ipx_$1 $0; report ipx_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ipx_$1 - -# 402115 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Received an.*packet.*from (\d+.\d+.\d+.\d+).*to (\d+.\d+.\d+.\d+).*The decapsulated inner packet doesn't match the negotiated policy in the SA -desc=PIX $1 IPSEC: packet from $2 to $3 is encapsulated with unexpected data. -action=create enc_$1; add enc_$1 %t; add enc_$1 %s; add enc_$1 $0; report enc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enc_$1 - -# 402118 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Received an.*packet.*from (\d+.\d+.\d+.\d+).*to (\d+.\d+.\d+.\d+) containing an illegal IP fragment.* -desc=PIX $1 IPSEC: packet from $2 to $3 has invalid fragment -action=create enc_$1; add enc_$1 %t; add enc_$1 %s; add enc_$1 $0; report enc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enc_$1 - -# 403103 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PPP virtual interface max connections reached. -desc=PIX $1 PPP interfaces exhausted -action=create pie_$1; add pie_$1 %t; add pie_$1 %s; add pie_$1 $0; report pie_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pie_$1 - -# 403109 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Rec\'d packet not an PPTP packet. \(.*\) dest_addr= (\d+.\d+.\d+.\d+), src_addr= (\d+.\d+.\d+.\d+).* -desc=PIX $1 Spoofed PPTP Packet from $3 to $2 -action=create spp_$1; add spp_$1 %t; add spp_$1 %s; add spp_$1 $0; report spp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spp_$1 - -# 404101 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*ISAKMP: Failed to allocate address for client from pool (\S+) -desc=PIX $1 IPSEC: Failed to allocate addr from $2 -action=create faa_$1; add faa_$1 %t; add faa_$1 %s; add faa_$1 $0; report faa_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete faa_$1 - -# 405001 -#type=Single -#continue=takenext -#ptype=RegExp -#pattern=PIXLOG (\S+)\^ .*Received ARP.*collision from (\d+.\d+.\d+.\d+\/....\.....\.....) on.* -#desc=PIX $1 ARP Collision: $2 -#action=create mac_$1; add mac_$1 %t; add mac_$1 %s;add mac_$1 %s; add mac_$1 $0; report mac_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mac_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Configuration replication failed for command (\S+) -desc=PIX $1 Failover replication command $2 failed -action=create rcf_$1; add rcf_$1 %t; add rcf_$1 %s; add rcf_$1 $0; report rcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rcf_$1 - -# 709001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*FO replication failed: cmd=(.*) returned=.* -desc=PIX $1 Failover: Command replication failed for Peer: $2 -action=create rcf_$1; add rcf_$1 %t; add rcf_$1 %s; add rcf_$1 $0; report rcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rcf_$1 - -# 316001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Denied new tunnel to (\d+.\d+.\d+.\d+). VPN peer limit.*exceeded.* -desc=PIX $1 VPN Peer limit exceeded for $2 -action=create plm_$1; add plm_$1 %t; add plm_$1 %s; add plm_$1 $0; report plm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete plm_$1 - -# 317003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*IP routing table creation failure - (.*) -desc=PIX $1 Route table Error: $2 -action=create rte_$1; add rte_$1 %t; add rte_$1 %s; add rte_$1 $0; report rte_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rte_$1 - -# 317004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*IP routing table limit warning -desc=PIX $1 Routing table limit reached -action=create rtl_$1; add rtl_$1 %t; add rtl_$1 %s; add rtl_$1 $0; report rtl_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rtl_$1 - -# 317005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*IP routing table limit exceeded - (.*), (\d+.\d+.\d+.\d+).* -desc=PIX $1 Route table limit breached by $3: $2 -action=create rtb_$1; add rtb_$1 %t; add rtb_$1 %s; add rtb_$1 $0; report rtb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rtb_$1 - -# 323005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) can not be powered on completely -desc=PIX $1 Slot $2 will not power on -action=create slp_$1; add slp_$1 %t; add slp_$1 %s; add slp_$1 $0; report slp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete slp_$1 - -# 411002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Line protocol on interface (\S+) changed state to down -desc=PIX $1 Interface $2 is DOWN! -action=create lpd_$1; add ldp_$1 %t; add ldp_$1 %s; add lpd_$1 $0; report lpd_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lpd_$1 - -# 412002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Detected bridge table full while inserting MAC (....\.....\.....) on interface .* -desc=PIX $1 MAC Address table is FULL! -action=create brf_$1; add brf_$1 %t; add brf_$1 %s; add brf_$1 $0; report brf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete brf_$1 - -# 505001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) is shutting down. Please.* -desc=PIX $1 Slot $2 is shutting down! -action=create sht_$1; add sht_$1 %t; add sht_$1 %s; add sht_$1 $0; report sht_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sht_$1 - -# 505002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) is reloading. Please.* -desc=PIX $1 Slot $2 is reloading! -action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 - -# 605004 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Login denied from (.*) to (.*) for user "(\S+)" -desc=PIX $1 Auth Attack from $2 to $3 ($4) -action=create ath_$1; add ath_$1 %t; add ath_$1 %s; add ath_$1 $0; report ath_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ath_$1 -window=10 -thresh=6 - -# 611102 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User authentication failed: Uname: (\S+) -desc=PIX $1 Auth Attach from $2 -action=create ath_$1; add ath_$1 %t; add ath_$1 %s; add ath_$1 $0; report ath_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ath_$1 -window=10 -thresh=6 - -# 615002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*vlan number not available for firewall interface -desc=PIX $1 VLAN Error for FWSM -action=create vln_$1; add vln_$1 %t; add vln_$1 %s; add vln_$1 $0; report vln_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete vln_$1 - -# diff --git a/pix-security.sec b/pix-security.sec deleted file mode 100644 index 44b19f6..0000000 --- a/pix-security.sec +++ /dev/null @@ -1,246 +0,0 @@ -#################################################################### -# SEC ruleset for Cisco PIX 6.x, 7.x -# -# Copyright (C) 2003-2009 Chris Sawall -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -#################################################################### - -# Process various events from PIX syslog output -# -# Submitted by Chris Sawall -# email: sawall -[at]- gmail -[dot]- com -# Last Updated: 5/20/05 - -# ------------------------------------------------------------------ -# Watch for weird failures - possible trojan/worm -# ------------------------------------------------------------------ - -# Watch for 10 denies within 10 seconds. Especially useful to monitor -# for certain trojans and mass mailers -# -type=SingleWithThreshold -ptype=RegExp -pattern=\s*.*Deny\s+(\w+)\s+src.*:(.*)/.*:(.*)/(\b2\d\b).*$ -desc=Unusual Failures:$1 $4/$2 -> $3 -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 -window=10 -thresh=10 - -# Monitor for occurrances of certain variant of PHEL trojan destined -# for two different class C networks -# -type=Single -continue=dontcont -ptype=RegExp -pattern=(212\.147\.14[12]\.) -desc=Possible PHEL Trojan (1) -action=create phel_$1; add phel_$1 Local Time = %t; add phel_$1 $0; report phel_$1 /bin/mail -s "%s" email01@example.com; delete phel_$1 - -# ------------------------------------------------------------------ -# Watch for firewall failovers -# ------------------------------------------------------------------ - -# Firewall failures/failovers -# Works for PIX 7.x - -# Failure of secondary (standby) firewall while primary is active -# Works for PIX 7.x -# -# $1 is the IP address of the primary firewall -# -type=Single -continue=takenext -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Primary\).*$ -desc=Secondary firewall for $1 - failure/reload -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 - -# Failure of secondary (standby) firewall while primary is active -# Works for PIX 7.x -# -# $1 is the IP address of the primary firewall -# -type=Single -continue=takenext -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Secondary\).*$ -desc=Primary firewall for $1 - failure/reload -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 - -# Failure of secondary (active), primary assumes active -# Works for PIX 7.x -# -# The first "desc" and "action" don't really do anything here. But SEC requires them to be present. -# $1 is the IP address of the primary firewall -# -type=Pair -continue=dontcont -ptype=RegExp -pattern=PIX-1-102001:\s+\(Primary\).*$ -desc=$0 -action=logonly -ptype2=RegExp -pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Primary\).*Peer state Standby Ready -desc2=Secondary (was active) firewall ($1) has failed. Primary is now active. -action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 -window=5 - -# Failure of primary (active), secondary assumes active -# Works for PIX 7.x -# -# The first "desc" and "action" don't really do anything here. But SEC requires them to be present. -# $1 is the IP address of the primary firewall -# -type=Pair -continue=dontcont -ptype=RegExp -pattern=PIX-1-102001:\s+\(Secondary\).*$ -desc=$0 -action=logonly -ptype2=RegExp -pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Secondary\).*Peer state Standby Ready -desc2=Primary firewall ($1) has failed. Secondary is now active. -action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 -window=5 - -# ------------------------------------------------------------------ -# Watch for firewall reloads -# ------------------------------------------------------------------ - -# Manual reload of PIX -# Works for PIX 6.x -# -# $1 is the IP address of the primary firewall -# -type=Single -continue=dontcont -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX reload.*$ -desc=$1 has been manually rebooted -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com ; delete ffo_$1 - -# Manual reload of PIX -# Works for PIX 7.x -# -# $1 is the IP address of the primary firewall -# -type=Single -continue=dontcont -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Orderly reload.*Reload reason:\s(\S+) -desc=$1 has been manually rebooted, reason: $2 -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 - -# ------------------------------------------------------------------ -# Watch for SSH logins/failures on firewalls -# ------------------------------------------------------------------ - -# Suppress emails concerning pixbkup account -# In this case, the pixbkup acct is used to backup the PIX firewalls -# Keeping email alerts to a minimum, this skips past these alerts -# -type=Suppress -continue=dontcont -ptype=RegExp -pattern=pixbkup - -# Successful Admin SSH session -# Works for PIX 6.x -# -# Monitor for successful SSH connections to the PIX firewall -# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr -# -type=Single -continue=dontcont -ptype=RegExp -pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'.*to\s(\d+\.\d+\.\d+\.\d+)\/0.*SSH -desc=Admin Auth to $1.$2 -> $3 from $4 -action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# Successful Admin SSH session -# Works for PIX 7.x -# -# Monitor for successful SSH connections to the PIX firewall -# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr -# -type=Single -continue=dontcont -ptype=RegExp -pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'\sfrom\s(\d+\.\d+\.\d+\.\d+)\/0.*/22.*$ -desc=Admin Auth to $1.$2 -> $3 from $4 -action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# Failed Admin SSH session -# Works for PIX 6.x -# -# Monitor for failed SSH attempts to the PIX firewalls -# $1 is the user acct -# -type=Single -continue=takenext -ptype=RegExp -pattern=Authentication failed.*\'(\S+)\'.*SSH -desc=Admin Auth FAILED -> $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# Failed Admin SSH session -# Works for PIX 7.x -# -# Monitor for failed SSH attempts to the PIX firewalls -# $1 is the user acct -# -type=Single -continue=takenext -ptype=RegExp -pattern=Authentication failed.*\'(\S+)\'.*/22.*$ -desc=Admin Auth FAILED -> $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# Normal SSH termination -# Works for both PIX 6.x and 7.x -# -# $1 is the IP of the firewall and $2 is the user acct -# -type=Single -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*\"(\S+)\".*terminated normally -desc=ADMIN END $1 -> $2 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# SSH session timeout or abnormal termination -# Works for PIX 6.x -# May work for PIX 7.x - not tested but PIX-6-315011 is the same for 6 and 7. -# -# $1 is the IP of the firewall -# -type=Single -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*disconnected by SSH server -desc=Firewall session END - timeout $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# ------------------------------------------------------------------ -# Watch for firewall commands -# ------------------------------------------------------------------ - -# Admin executed "write mem" -# Works for both PIX 6.x and 7.x -# -# $1 is the IP of the firewall -type=Single -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*write\sm.* -desc=User wrote config to memory -> $1 -action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1 - -# Watch for HIGH CPU Utilization -# Works for PIX 6.x -# -type=Single -ptype=RegExp -pattern=PIX-.-211003 -desc=HIGH CPU Utilization -action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1 - diff --git a/pix-url.sec b/pix-url.sec deleted file mode 100644 index a6e9879..0000000 --- a/pix-url.sec +++ /dev/null @@ -1,80 +0,0 @@ -#################################################################### -# SEC ruleset for Monitoring Keywords -# -# Copyright (C) 2003-2009 Chris Sawall -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -#################################################################### - -# This particular ruleset was designed to monitor PIX syslog traffic -# and watch for keywords in URL traffic. Starting SEC must include -# the -intevents option. -# -# Currently tested for PIX 6.x -# -# Submitted by Chris Sawall -# email: sawall -[at]- gmail -[dot]- com -# Last Updated: 5/20/05 - -# Wait for SEC to start up or be restarted and then read in two lists -# of words. The first being a list of words to watch for and alert on, -# the second list being a list of exclusions for a suppression rule. -# -type=Single -ptype=PerlFunc -pattern=sub { if(($_[0] eq "SEC_STARTUP") || ($_[0] eq "SEC_RESTART")) { @words=`cat /root/watch4badwords`; chomp(@words); $list=join('|', @words); @ewords=`cat /root/watch4excludes`; chomp(@ewords); $excludes=join('|', @ewords);} } -desc=$0 -context=SEC_INTERNAL_EVENT -action=write - Set word list variable; - -# ------------------------------------------------------------------ -# Scan for certain URLs -# ------------------------------------------------------------------ - -# Monitor and match on keywords from the exclusions file and -# suppress reporting on them. -# -type=Suppress -continue=dontcont -ptype=PerlFunc -pattern=sub {($_[0] =~ /($excludes)/) } - -# Monitor for keywords and send an email alert -# -type=Single -ptype=PerlFunc -pattern=sub {($_[0] =~ /($list)/) } -desc=Inappropriate word in URL -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# -# Examples of "watch4badwords" and "watch4excludes" -# -# File should be a return delimited file. The -# script read the file in literally and creates -# an OR statement by putting a pipe (|) between -# all of the keywords. -# -# Be careful on what words are being monitored. -# The word virgin also finds virginia and alerts -# on it. -# -# The following are examples of things that work: -# -# ----> watch4badwords -# -# \bvirgin\b -# \byoung girl\b -# \b[Pp]layboy\b -# pr0n -# hardcore -# -# ----> watch4excludes -# -# \b10\.10\.2\.4\b -# \bcherry tree\b -# cnn.com -# - - diff --git a/portscan.sec b/portscan.sec deleted file mode 100644 index 1f2f5e5..0000000 --- a/portscan.sec +++ /dev/null @@ -1,45 +0,0 @@ -################################################################ -# Sample SEC ruleset for "PORTSCAN FROM ip1 TO ip2:port" events -# -# Copyright (C) 2003-2009 Risto Vaarandi -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -################################################################ - -# process "PORTSCAN FROM ip1 TO ip2:port" events, and if a certain -# source host has scanned the same destination port on more than -# 10 distinct destination hosts during 60 seconds, raise an alarm - -type=Single -ptype=RegExp -pattern=PORTSCAN FROM ([\d.]+) TO [\d.]+:(\d+) -context=!HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2 -continue=TakeNext -desc=Horizontal port sweep started from source $1 to target port $2 -action=eval %o ( $portscans{"$1:$2"} = {} ); \ - create HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2 60 \ - eval %o ( delete $portscans{"$1:$2"} ) - -type=Single -ptype=RegExp -pattern=PORTSCAN FROM ([\d.]+) TO ([\d.]+):(\d+) -context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 -continue=TakeNext -desc=Scanned destination IP: $2 -action=eval %o ( $portscans{"$1:$3"}->{$2} = 1 ); \ - add HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 %t: %s;\ - set HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 60 \ - eval %o ( delete $portscans{"$1:$3"} ) - -type=Single -ptype=RegExp -pattern=PORTSCAN FROM ([\d.]+) TO ([\d.]+):(\d+) -context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ - && =( scalar(keys(%{$portscans{"$1:$3"}})) > 10 ) -continue=DontCont -desc=$1 has scanned more than 10 destinations -action=report HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ - mail -s 'Horizontal port sweep from $1 target port $3' root@example.com; \ - delete HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3; \ - eval %o ( delete $portscans{"$1:$3"} ) diff --git a/sec.service b/sec.service index a8e3136..7b05795 100644 --- a/sec.service +++ b/sec.service @@ -5,7 +5,8 @@ After=syslog.target [Service] Type=forking PIDFile=/run/sec.pid -ExecStart=/usr/bin/sec -detach -pid=/run/sec.pid -conf=/etc/sec/*.sec -input=/var/log/messages -log=/var/log/sec -intevents +ExecStart=/usr/bin/sec --detach --pid=/run/sec.pid $OPTIONS +EnvironmentFile=/etc/sysconfig/sec [Install] WantedBy=multi-user.target diff --git a/sec.spec b/sec.spec index f5af46a..16b0ec5 100644 --- a/sec.spec +++ b/sec.spec @@ -1,38 +1,15 @@ Name: sec -Version: 2.8.1 +Version: 2.8.2 Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ -URL: http://simple-evcorr.github.io/ -Source0: http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz +URL: https://simple-evcorr.github.io/ +Source0: https://github.com/simple-evcorr/sec/releases/download/%{version}/sec-%{version}.tar.gz Source1: sec.service Source2: sec@.service Source3: sec.logrotate -# Example files and configuration info -Source4: conf.README -Source5: http://simple-evcorr.sourceforge.net/rulesets/amavisd.sec -Source6: http://simple-evcorr.sourceforge.net/rulesets/bsd-MONITOR.sec -Source7: http://simple-evcorr.sourceforge.net/rulesets/bsd-PHYSMOD.sec -Source8: http://simple-evcorr.sourceforge.net/rulesets/bsd-USERACT.sec -Source9: http://simple-evcorr.sourceforge.net/rulesets/bsd-general.sec -Source10: http://simple-evcorr.sourceforge.net/rulesets/bsd-mpd.sec -Source11: http://simple-evcorr.sourceforge.net/rulesets/cisco-syslog.sec -Source12: http://simple-evcorr.sourceforge.net/rulesets/cvs.sec -Source13: http://simple-evcorr.sourceforge.net/rulesets/dameware.sec -Source14: http://simple-evcorr.sourceforge.net/rulesets/hp-openview.sec -Source15: http://simple-evcorr.sourceforge.net/rulesets/labrea.sec -Source16: http://simple-evcorr.sourceforge.net/rulesets/pix-general.sec -Source17: http://simple-evcorr.sourceforge.net/rulesets/pix-security.sec -Source18: http://simple-evcorr.sourceforge.net/rulesets/pix-url.sec -Source19: http://simple-evcorr.sourceforge.net/rulesets/portscan.sec -Source20: http://simple-evcorr.sourceforge.net/rulesets/snort.sec -Source21: http://simple-evcorr.sourceforge.net/rulesets/snortsam.sec -Source22: http://simple-evcorr.sourceforge.net/rulesets/ssh-brute.sec -Source23: http://simple-evcorr.sourceforge.net/rulesets/ssh.sec -Source24: http://simple-evcorr.sourceforge.net/rulesets/vtund.sec -Source25: http://simple-evcorr.sourceforge.net/rulesets/windows.sec -# -Source26: sec.sysconfig +Source4: sec.sysconfig +Source5: conf.README BuildArch: noarch BuildRequires: perl-generators @@ -62,19 +39,10 @@ writing messages to pipes or files, etc. install -D -m 0755 -p sec %{buildroot}%{_bindir}/sec install -D -m 0644 -p sec.man %{buildroot}%{_mandir}/man1/sec.1 install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_unitdir}/sec.service +install -D -m 0644 -p %{SOURCE2} %{buildroot}%{_unitdir}/sec@.service install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec - -# Install the example config files and readme -install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/README -install -d -m 0755 examples -install -m 0644 -p %{SOURCE5} %{SOURCE6} %{SOURCE7} %{SOURCE8} \ - %{SOURCE9} %{SOURCE10} %{SOURCE11} %{SOURCE12} \ - %{SOURCE13} %{SOURCE14} %{SOURCE15} %{SOURCE16} \ - %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} \ - %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} \ - %{SOURCE25} examples/ -install -m 0644 -p %{SOURCE2} sec@.service -install -m 0644 -p %{SOURCE26} sec.sysconfig +install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/sec +install -D -m 0644 -p %{SOURCE5} %{buildroot}%{_sysconfdir}/%{name}/README # Remove executable bits because these files get packed as docs chmod 0644 contrib/convert.pl contrib/swatch2sec.pl @@ -89,14 +57,21 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %systemd_postun_with_restart sec.service %files -%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples sec@.service sec.sysconfig +%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl %config(noreplace) %{_sysconfdir}/%{name} %config(noreplace) %{_sysconfdir}/logrotate.d/sec +%config(noreplace) %{_sysconfdir}/sysconfig/sec %{_bindir}/sec %{_mandir}/man1/sec.1* %{_unitdir}/sec.service +%{_unitdir}/sec@.service %changelog +* Mon Jun 3 2019 Stefan Schulze Frielinghaus - 2.8.2-1 +- New upstream release +- Clean up spec file +- Added an environment file /etc/sysconfig/sec in order to specify command line options + * Sat Feb 02 2019 Fedora Release Engineering - 2.8.1-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild diff --git a/sec.sysconfig b/sec.sysconfig index 1db90e2..a240503 100644 --- a/sec.sysconfig +++ b/sec.sysconfig @@ -1,7 +1,9 @@ -# This is an example config file if multiple instances of SEC should be started. -# This file should be located in -# /etc/sysconfig/sec -# and used together with the systemd service file +# Command line options for SEC + +OPTIONS="--conf=/etc/sec/*.sec --input=/var/log/messages --log=/var/log/sec --intevents" + +# This is an example config if multiple instances of SEC should be started. +# These settings should be used together with the systemd service file # sec@.service # which allows to run multiple sec instances. # @@ -12,6 +14,6 @@ # For further configuration options, consult the systemd file: # /lib/systemd/system/sec@.service -OPTIONS_FOO="-input=/var/log/messages" +#OPTIONS_FOO="--conf=/etc/sec/FOO/*.sec --input=/var/log/secure --log=/var/log/sec-FOO --intevents" -OPTIONS_BAR="-input=/var/log/syslog" +#OPTIONS_BAR="--conf=/etc/sec/BAR/*.sec --input=/var/log/maillog --log=/var/log/sec-BAR --intevents" diff --git a/sec@.service b/sec@.service index f89b139..dbf83af 100644 --- a/sec@.service +++ b/sec@.service @@ -5,7 +5,7 @@ After=syslog.target [Service] Type=forking PIDFile=/run/sec-%I.pid -ExecStart=/usr/bin/sec -detach -pid=/run/sec-%I.pid -conf=/etc/sec/%I/*.sec -input=/var/log/messages -log=/var/log/sec-%I -intevents $OPTIONS_%I +ExecStart=/usr/bin/sec --detach --pid=/run/sec-%I.pid $OPTIONS_%I EnvironmentFile=/etc/sysconfig/sec [Install] diff --git a/snort.sec b/snort.sec deleted file mode 100644 index 9b65a71..0000000 --- a/snort.sec +++ /dev/null @@ -1,163 +0,0 @@ -#################################################################### -# Sample SEC ruleset for Snort IDS -# -# Copyright (C) 2003-2009 Risto Vaarandi -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -#################################################################### - -# ------------------------------------------------------------------ -# Handle portscans -# ------------------------------------------------------------------ - -# For every completed portscan, add an entry to the PORTSCAN_REPORT; -# also generate a meta-event ACTIVITY_FROM for the IP - -type=Single -ptype=RegExp -pattern=End of portscan from (([\d.]+).*) -desc=Portscan from $1 -action=add PORTSCAN_REPORT %t: %s; event ACTIVITY_FROM_$2: %s - - -# ------------------------------------------------------------------ -# Recognize snort alert message and generate corresponding SEC event -# ------------------------------------------------------------------ - -# recognize snort alert message; also generate -# a meta-event ACTIVITY_FROM for the IP - -type=Single -ptype=RegExp -pattern=snort(?:\[\d+\])?: \[[0-9:]+\] (.+|!Malware|!MALWARE) \[(.+)\] \[.*Priority: (\d+)\]: \S+ ([\d.]+):?\d* -> ([\d.]+):?\d* -desc=PRIORITY $3 INCIDENT FROM $4 TO $5: $1 [$2] -action=event %s; event ACTIVITY_FROM_$4: $1 - - -## Detect if it's an unwanted event in snort -#type=Single -#ptype=RegExp -#pattern=(MALWARE|Malware) -#desc=$0 -#action=create UNWANTED_EVENT - - -# ------------------------------------------------------------------ -# Handle priority 1 incidents -# ------------------------------------------------------------------ - -# Detect the beginning of priority 1 attack from a certain source IP, -# and send a warning e-mail message that a new attack has begun; -# also create a context for storing a detailed information about the attack - -type=Single -ptype=RegExp -pattern=PRIORITY 1 INCIDENT FROM ([\d.]+) TO [\d.]+: -context=ATTACK_FROM_$1 -continue=TakeNext -desc=Priority 1 attack started from $1 -action=create ATTACK_FROM_$1; add ALERT_REPORT %t: %s; pipe '%t: %s' \ - /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1' alerts@example.com - - -# For every priority 1 incident, add an entry to the context by its IP; -# if the IP has been quiet for 5 minutes, report the whole attack - -type=Single -ptype=RegExp -pattern=PRIORITY 1 INCIDENT FROM ([\d.]+) TO ([\d.]+): (.+) -context=ATTACK_FROM_$1 -continue=TakeNext -desc=Priority 1 incident from $1 to $2: $3 -action=add ATTACK_FROM_$1 %t: %s; \ - set ATTACK_FROM_$1 300 ( report ATTACK_FROM_$1 \ - /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1 (report)' alerts@example.com ) - - -# ------------------------------------------------------------------ -# Handle incidents by thresholding -# ------------------------------------------------------------------ - -# Count how many _certain type_ of incidents are coming from one source -# if the threshold has been crossed, reset the counting operation started -# by the next rule, in order to avoid duplicate alerts for the same IP - -type=SingleWithThreshold -ptype=RegExp -pattern=PRIORITY (\d+) INCIDENT FROM ([\d.]+) TO [\d.]+: (.+) -continue=TakeNext -desc=Snort has seen >= 30 priority $1 incidents from $2: $3 -action=add ALERT_REPORT %t: %s; \ - reset +1 Snort has seen >= 150 incidents from $2; \ - create TURNOFF_$2 3600 -thresh=30 -window=3600 - - -# Count how many incidents come from one source - -type=SingleWithThreshold -ptype=RegExp -pattern=PRIORITY \d+ INCIDENT FROM ([\d.]+) TO [\d.]+: -context=!TURNOFF_$1 -desc=Snort has seen >= 150 incidents from $1 -action=add ALERT_REPORT %t: %s -thresh=150 -window=7200 - - -# ------------------------------------------------------------------ -# Report IPs that have been active for some time -# ------------------------------------------------------------------ - -# Set up activity contexts for the IP; if the IP has been active for 2 hours, -# and there have been no gaps longer than 30 minutes, report its activities - -type=Single -ptype=RegExp -pattern=ACTIVITY_FROM_([\d.]+): -context=!ACTIVITY_LIST_FOR_$1 -continue=TakeNext -desc=Create activity contexts for $1 -action=create ACTIVITY_LIST_FOR_$1_LIFETIME; \ - create ACTIVITY_LIST_FOR_$1 7200 ( report ACTIVITY_LIST_FOR_$1 \ - /usr/bin/mail -s 'SNORT: $1 has been active for 2 hours' alerts@example.com; \ - delete ACTIVITY_LIST_FOR_$1_LIFETIME ) - - -# Add the activity event to the context of a given IP, and extend -# the lifetime of activity contexts for 30 minutes for the IP - -type=Single -ptype=RegExp -pattern=ACTIVITY_FROM_([\d.]+): (.*) -context=ACTIVITY_LIST_FOR_$1 -desc=Activity from $1: $2 -action=add ACTIVITY_LIST_FOR_$1 %t: %s; \ - set ACTIVITY_LIST_FOR_$1_LIFETIME 1800 ( delete ACTIVITY_LIST_FOR_$1 ) - - -# ------------------------------------------------------------------ -# Send reports every day at 9:00 am -# ------------------------------------------------------------------ - -# send daily report about regular alerts - -type=Calendar -time=0 12 * * * -desc=Sending alert report... -action=report ALERT_REPORT \ - /usr/bin/mail -s 'SNORT: Hourly alert report' alerts@example.com; \ - delete ALERT_REPORT - - -# send daily report about portscans - -type=Calendar -time=0 9 * * * -desc=Sending portscan report... -action=report PORTSCAN_REPORT \ - /usr/bin/mail -s 'SNORT: daily portscan report' alerts@example.com; \ - delete PORTSCAN_REPORT - diff --git a/snortsam.sec b/snortsam.sec deleted file mode 100644 index 05aa074..0000000 --- a/snortsam.sec +++ /dev/null @@ -1,77 +0,0 @@ -############################################################################# -# Snort SAM events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Error: Could not bind socket. -desc = $0 -action=pipe '$1 Snortsam Bind Failed -- NEEDS ATTENTION!: %s' /usr/bin/mail -s "Snortsam Bind Failure: NEEDS ATTENTION on $1" alerts@example.com - - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) root: (.*), email, Error: \[email\] Did not receive a response waiting for banner on mail server at (.*) -desc = $0 -action=add SNORTSAM_REPORT $1 Couldn't email through $3 : %s - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) snortsam, Extending block for host ([A-z._0-9-]*) completely for (.*) -desc = $0 -action=add SNORTSAM_REPORT $1 Extending Block for $3 for $4 - - -#type=single -#ptype=regexp -#pattern=([A-Za-z0-9._-]+)snortsam\[([0-9]+)\]: [*], [:0-9]+, -, ipf, (.*) Failed -#desc = Snortsam ipf error -#action=pipe '$1 Snortsam IPF Command Failed' /usr/bin/mail -s "%s" alerts@example.com -##action=add SNORTSAM_REPORT ERROR $1 IPF Command Failure: $2 - - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Starting to listen for Snort alerts. -desc = $0 -action=add SNORTSAM_REPORT $1 Snortsam Startup: %s - - -#type=single -#ptype=regexp -#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Removing (.*) complete block for host (.*). -#desc = $0 -#action=add SNORTSAM_REPORT $1 Snortsam Removing Block: %s - -#type=single -#ptype=regexp -#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Blocking host (.*) completely for (.*) \((Sig_ID: \d+\))\. -#desc = $0 -#action=add SNORTSAM_REPORT $1 Snortsam Block: %s - - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) root: (.*) ipf, Error: Command (.*) Failed -desc = $0 -action=pipe '$1 Snortsam IPF Command Failed: $1 $2 $3' /usr/bin/mail -s "Snortsam IPF Command Failed on $1" alerts@example.com - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Snortsam Station .* using wrong password, trying to resync. -desc = $0 -action=pipe '$1 Snortsam Password Failure: $1' /usr/bin/mail -s "Snortsam Password Failure on $1" alerts@example.com - -#Send hourly snortsam report - -type=Calendar -time=0 * * * * -desc=Sending snortsam report... -action=report SNORTSAM_REPORT \ - /usr/bin/mail -s 'SNORTSAM report' alerts@example.com; \ - delete SNORTSAM_REPORT diff --git a/sources b/sources index d3e3552..2347df8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.8.1.tar.gz) = 03c7acd1e1cfd6dc11143e0ff35758925ddc75e460987a91d5606564f0caa45afade497b8653ec2d8865cfcfab4d87743777eb104e1a16f79069cf61e17d0661 +SHA512 (sec-2.8.2.tar.gz) = 846a0671d5d774f74645e5e4f6d7a01c04079be19ea9b2ec9cb862fb48173dac0e1131981bb6e1fae525c74610dfdabc1535ff5818ae893bec35daab46e05c07 diff --git a/ssh-brute.sec b/ssh-brute.sec deleted file mode 100644 index 484bcb3..0000000 --- a/ssh-brute.sec +++ /dev/null @@ -1,69 +0,0 @@ -################## ssh brute force attack blocker -# Copyright (C) 2003-2009 Mark Bergman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -################## -# -# This sec ruleset monitors syslog messages for indications that an ssh brute-force -# login attack is underway. The trigger is an ssh login failure. -# -# If 4 additional syslog messages about ssh login failures from the same -# source address are received within next 1 minute, an iptables firewall -# rule is added to block access from the source IP. -# -# After that, the correlation operation waits until no ssh login failure -# syslog messages from the source IP have been received from the router -# during the last 2 hours, and then the iptables rule is removed. By -# definition, once the IP is blocked, there will be no more connection -# attempt failures logged by ssh (ie., packets will be dropped by the kernel -# before they reach the syslog daemon), so the rule will be flushed after -# 2 hours. -# -# Vulnerabilities of this ruleset are: -# -# persistent firewall rules: -# if the sec daemon crashes or is restarted, any existing rules -# will not be removed after 2hours -# -# window=60 # sliding window (1 minute) for initial event match -# thresh=4 # number of events (ssh login failures from a given IP) that must -# # occur within the window period in order to trigger the action -# -# window2=7200 # sliding window (2 hours) for the second event match -# thresh2=0 -############### -# RCSversion="$Header: /home/bergman/RCS/ssh_block.sec,v 1.3 2006/05/02 04:18:44 bergman Exp bergman $" -# -# Representative log file entries: -# Aug 28 04:43:03 10.1.1.18 sshd(pam_unix)[22344]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=www.ace.ne.jp -# Aug 28 04:43:03 host sshd[22568]: Failed password for illegal user library from 210.230.187.218 port 55019 ssh2 -# Aug 28 04:42:28 www.somehost.net sshd[9395]: Failed password for illegal user mysql from 210.230.187.218 port 52857 ssh2 -# Aug 28 04:42:28 host sshd[22509]: Failed password for root from 210.230.187.218 port 52960 ssh2 -# Aug 28 04:42:32 www.somehost.net sshd[9397]: Failed password for illegal user oracle from 210.230.187.218 port 53212 ssh2 -# Aug 28 04:42:32 host sshd[22510]: Failed password for illegal user admin from 2 10.230.187.218 port 53243 ssh2 - -# -type=SingleWith2Thresholds -ptype=RegExp -pattern=sshd.*: authentication failure[ ;].* rhost=(\S+) -desc=Multiple failed ssh authentication attempts from $1 -action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP ) -window=60 -thresh=4 -desc2=Pruning iptables firewall rule blocking ssh from $1 -action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP ) -window2=7200 -thresh2=0 - -type=SingleWith2Thresholds -ptype=RegExp -pattern=sshd.*: Failed password for.* user .* from (\S+) -desc=Multiple ssh password failures from $1 -action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP ) -window=60 -thresh=4 -desc2=Pruning iptables firewall rule blocking ssh from $1 -action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; sleep 2; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP ; sleep 2) -window2=7200 -thresh2=0 diff --git a/ssh.sec b/ssh.sec deleted file mode 100644 index d9704e9..0000000 --- a/ssh.sec +++ /dev/null @@ -1,260 +0,0 @@ -########################################################################### -# SEC ruleset to accumulate errors from a parent and child sshd process -# into a single context. This allows reporting of the authenticated -# user information with the error's generated by the child sshd process. -# -# Copyright (C) 2003-2009 John P. Rouillard -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -########################################################################### - -# note handling of deferred reporting until after tie events received -# is still in flux. My old rules hanlded it by resubmitting all the -# events, but it didn't handle the parent defered reporting -# events. This way is cleaner, but not tested very well. - -type=single -continue=dontcont -ptype=Nregexp -pattern=sshd|SSHD -desc=filter out non-sshd events -action=none - -type=single -continue=dontcont -ptype=TValue -pattern=TRUE -desc=guard for already handled -action=logonly -context = [EVENT_PROCESSED] - -type=single -continue=takenext -ptype=TValue -pattern=TRUE -desc=We will handle. -action=create EVENT_PROCESSED - -## Recognize the start of an ssh session -# link parent and child event contexts. -# -#type=PairWithWindow -#continue=takenext -#desc=Recognize ssh session start for $1[$2] -#ptype=regexp -#pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Connection from ([0-9.]+) port [0-9]+ -#action=pipe session_log_$1_$2 \ -# /usr/bin/mail -s "ssh failed to generate tie event for $1" alerts@example.com -#desc2=Link parent and child contexts -#ptype2=regexp -#pattern2=$1 [A-z0-9]+\[[0-9]+\]: \[[^]]+\] SSHD child process +([0-9]+) spawned by $2 -#action2=copy session_log_%1_$1 %b; \ -# delete session_log_%1_$1; \ -# alias session_log_%1_%2 session_log_%1_$1; \ -# add session_log_%1_$1 $0; \ -# event 0 "sshd: Report %1_$1 if needed"; \ -# alias session_log_owner_%1_%2 session_log_owner_%1_$1 ;\ -# create tie_event_received_%1_%2 ;\ -# alias tie_event_received_%1_%2 tie_event_received_%1_$1 ;\ -# delete ssh_tie_event_needed_%1 -#window=60 - -## recognize login event and save username for later use -type=single -desc=Start login timer -ptype=regexp -pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Accepted (publickey|password) for ([A-z0-9_-]+) from [0-9.]+ port [0-9]+ (.*) -action=add session_log_$1_$2 $0; add session_log_owner_$1_$2 $4 - -# handle logout -type=single -desc=Recognize ssh session end -ptype=regexp -pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Closing connection to ([0-9.]+) -action= delete session_log_$1_$2; delete session_log_owner_$1_$2; \ - delete tie_event_received_$1_$2 - -## ignore ssh IPV6 errors. -# -# Example input: -# Nov 3 06:34:25 corphost sshd[5961]: [ID 800047 auth.error] error: \ -# connect_to ::1 port 5910: Network is unreachable -# -type=suppress -desc = ignore IPV6 errors from ssh -ptype=regexp -pattern=sshd\[[0-9]+\]: \[ID 800047 auth.error\] error: connect_to ::1 port [0-9]+: Network is unreachable - -# because the tie command can come after critical errors are reported, -# we provide a way to generate a report on demand. -type=single -desc=Report immediate on request. -ptype=regexp -pattern=^sshd: Report (.*) if needed$ -context = session_log_report_$1 -action= report session_log_$1 /usr/bin/mailx -s "sshd error on $1" alerts@example.com ;\ - delete session_log_report_$1 - -type=suppress -desc=Discard report immediate event on request. -ptype=regexp -pattern=^sshd: Report (.*) if needed$ - -# INSERT IMMEDIATE REPORT RULES HERE -# rules that should report problems immediately should go here. -# e.g. channel_setup_fwd_listener: cannot listen to port: 1521 -# where port is < 1024, or is some other well known port indicating -# possible hacking. -# -# We have five possible cases: -# Event is from parent process and no info from child process is needed. -# Report normally. -# Event is from parent process and info from child process is needed, -# and tie event received (context tie_event_received__ -# exists). Report normally. -# Event is from parent process and info from child process is needed, -# but tie event not received (context tie_event_received__ -# does not exist). -# Report using child event as trigger. -# Event that has to be reported is from the child process and -# we have received the tie event (context -# tie_event_received__ exists). Just report normally. -# Event that has to be reported is from the child process and -# we haven't received the tie event (context -# tie_event_received__ does not exist). Defer reporting -# until after tie event by setting context -# session_log_report__. -# -# We may need two rules for each event if the event can come before the tie -# event. One rule checks to see if the context ssh_tie_event_needed_$1 -# where $1 is the reporting host. If so then it needs to set the context -# session_log_report__ if generated by the child process. - -# Note we get a less specific report this way. It should be retooled -# to generate a context that the report rule can simply obsolete. -# These events are generated by the child. -type=single -continue=takenext -desc = record ssh channel_setup_fwd_listener error for $1 port < 1025 -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*) -context = $3 < 1025 && ! tie_event_received_$1_$2 -action = add session_log_$1_$2 $0 ; \ - create session_log_report_$1_$2 - -type=single -continue=takenext -desc = record ssh channel_setup_fwd_listener error for $1 port < 1025 -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*) -context = $3 < 1025 && tie_event_received_$1_$2 -action = add session_log_$1_$2 $0 ; \ - report session_log_report_$1_$2 \ - /usr/bin/mailx -s "sshd bind < 1025 on $1" alerts@example.com - -# end immediate rules here - -## report/record ssh bind errors. -# Record ssh bind errors in the session log. Don't report unless -# we have more than 5 of them in a 10 minute period. Then go and -# find out why they are occurring. Probably a frustrated user -# getting the -L options wrong. -# -# We record all events until a 10 minute period has passed with no -# events. If the threshold is exceeded, then we report all events -# recorded during the 10 minute rolling window. -# -# We also group channel_setup_fwd_listener with this. -# -# Example input: -# Nov 4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: bind: \ -# Address already in use -# -type=single -continue=takenext -desc = record ssh bind error for $1 -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use -action = add session_log_$1_$2 $0 ; \ - set ssh_port_forward_errors_$1_$2 600 - -type=singlewiththreshold -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use -context = ssh_port_forward_errors_$1_$2 -desc = send report on ssh forward errors if pass threshold (bind) -action = report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com; \ - delete ssh_port_forward_errors_$1_$2 -thresh=5 -window=600 - -# Similar idea to ssh bind errors except on -# channel_setup_fwd_listener errors. If we have more than 5 -# of them in a 10 minute period, go and find out why they are occurring. -# Probably a frustrated user getting the -L options wrong. -# -# We record all events until a 10 minute period has passed with no -# events. If the threshold is exceeded, then we report all events -# recorded during the 10 minute rolling window. -# -# Example input: -# Nov 4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: \ -# channel_setup_fwd_listener: cannot listen to port: 1521 -# - -type=single -continue=takenext -desc = record ssh channel_setup_fwd_listener error for $1 -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: -action = add session_log_$1_$2 $0 ; \ - set ssh_channel_setup_errors_$1_$2 600 - -type=singlewiththreshold -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: -context = ssh_channel_setup_errors_$1_$2 -desc = send report on ssh channel setup errors -action = report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com ; \ - delete ssh_channel_setup_errors_$1_$2 -thresh=5 -window=600 - -# Gather random sshd errors and report after 5 minutes -# -# This could have been set up a number of different ways, but I have one -# rule to create the context only when it doesn't exist, and another rule -# that adds to the context. The create rule also sets the 5 minute timeout -# that will cause the event store to be delivered when it is deleted. -# -# Example input: -# Nov 3 09:48:56 example sshd[7871]: [ID 800047 auth.crit] fatal: \ -# Timeout before authentication for 37.117.12.201 -# -type=single -continue = takenext -ptype=regexp -pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: -desc = create context to report ssh errors for host $1 pid $2 in 5 minutes -context = ! session_log_5min_timer_$1_$2 -action = create session_log_5min_timer_$1_$2 300 report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh errors for host $1 pid $2" alerts@example.com - -type=single -continue = dontcont -ptype=regexp -pattern=([A-Za-z0-9._-]*) sshd\[([0-9]+)\]: -desc = gather ssh errors for host $1 -action = add session_log_$1_$2 $0 - -# Remove the handled context if we reach this point. -type=single -continue=dontcont -ptype=TValue -pattern=TRUE -desc=delete EVENT_PROCESSED -action=delete EVENT_PROCESSED - diff --git a/vtund.sec b/vtund.sec deleted file mode 100644 index 1bc167f..0000000 --- a/vtund.sec +++ /dev/null @@ -1,67 +0,0 @@ -############################################################################# -# VTUN events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (\S+)\[\S\] opened -desc=$0 -action=add GENERAL_REPORT %t: %s; - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: BlowFish encryption initialized -desc=$0 -action=add GENERAL_REPORT %t: VTUN Tunnel Opened on $1 - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: VTun client ver\s+(.*) -desc=$0 -action=add GENERAL_REPORT %t: VTUN Server Started on $1 version $2 - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connecting to (.*) -desc=$0 -action=add GENERAL_REPORT VTUN %s - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Denied connection from (\d+\.\d+\.\d+\.\d+):\d+ -desc=$0 -action=add GENERAL_REPORT %t: VTUN Connection DENIED by $1 from $2 - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connection denied by (.*) -desc=$0 -action=add GENERAL_REPORT %t: VTUN Connection DENIED by $2 for $1 - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Exit -desc=$0 -action=add GENERAL_REPORT %t: VTUN Exit on $1 - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Can't resolv server address: (.*) -desc=$0 -action=add GENERAL_REPORT %t: VTUN Cannot Resolve Target $2 on $1 - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (/S+) closed -desc=$0 -action=add GENERAL_REPORT %t: VTUN Session $2 Closed on $1 - diff --git a/windows.sec b/windows.sec deleted file mode 100644 index 9e63e3c..0000000 --- a/windows.sec +++ /dev/null @@ -1,44 +0,0 @@ -############################################################################# -# Windows events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+ESE: N/A: Information Store \(\d+\) Online defragmentation (.*) -desc=$0 -action=add GENERAL_REPORT EXCHANGE DEFRAG%t: %s; - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Userenv: NT AUTHORITY\\SYSTEM: Windows cannot determine the user or computer name\. Return value \(1326\). -desc=$0 -action=add GENERAL_REPORT %t: %s - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Locked Out: Target Account Name: (\S+) .* -desc=$0 -action=pipe '$1 Windows Account Lockout: %s' /usr/bin/mail -s "Windows Account Locked on $1" alerts@example.com - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Changed: (/S+)\. .* -desc=$0 -action=pipe '$1 Windows Account Change: %s' /usr/bin/mail -s "Windows Account Changed on $1: $2" alerts@example.com - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+NetBT: N\/A: A duplicate name has been detected on the TCP network\. .* -desc=$0 -action=pipe '$1 Duplicate Netbios Name Detected: %s' /usr/bin/mail -s "Duplicate Netbios Name on $1" alerts@example.com - - - From b944d41cb9f2b8f0679a691c9a70c17bfd57b742 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jul 2019 23:02:09 +0000 Subject: [PATCH 58/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 16b0ec5..6e420b7 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.8.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Fri Jul 26 2019 Fedora Release Engineering - 2.8.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Mon Jun 3 2019 Stefan Schulze Frielinghaus - 2.8.2-1 - New upstream release - Clean up spec file From b559d72f8eacef2a11bbc9050fd75d9b82cf562e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 30 Jan 2020 23:10:32 +0000 Subject: [PATCH 59/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 6e420b7..31636c7 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.8.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Thu Jan 30 2020 Fedora Release Engineering - 2.8.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Fri Jul 26 2019 Fedora Release Engineering - 2.8.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From ab73b195be609ad545cd81cbb7e68f72e9cd2713 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 2 May 2020 17:01:15 +0200 Subject: [PATCH 60/85] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index ab8805b..54e87fb 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,4 @@ sec-2.5.3.tar.gz /sec-2.8.0.tar.gz /sec-2.8.1.tar.gz /sec-2.8.2.tar.gz +/sec-2.8.3.tar.gz diff --git a/sec.spec b/sec.spec index 31636c7..a7ff1ab 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.8.2 -Release: 3%{?dist} +Version: 2.8.3 +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sat May 2 2020 Stefan Schulze Frielinghaus - 2.8.3-1 +- New upstream release + * Thu Jan 30 2020 Fedora Release Engineering - 2.8.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild diff --git a/sources b/sources index 2347df8..e30ca73 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.8.2.tar.gz) = 846a0671d5d774f74645e5e4f6d7a01c04079be19ea9b2ec9cb862fb48173dac0e1131981bb6e1fae525c74610dfdabc1535ff5818ae893bec35daab46e05c07 +SHA512 (sec-2.8.3.tar.gz) = 9eba7db0dfa3661a3ef4e8aad3eeef1db710784f7a71131991a06918cc4f5634577b8bff3f00fcc1c5d998bf0c1e80efe88e1c1df3f5530b6ab4905ff00f2269 From 3035affb4011a0f5852ae40fb409481b5f6f7a92 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jul 2020 10:30:06 +0000 Subject: [PATCH 61/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index a7ff1ab..739f026 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.8.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Wed Jul 29 2020 Fedora Release Engineering - 2.8.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Sat May 2 2020 Stefan Schulze Frielinghaus - 2.8.3-1 - New upstream release From e07ca8952e554bdf4d31cda93147a4bcfb242377 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 20:10:36 +0000 Subject: [PATCH 62/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 739f026..bf003db 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.8.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 2.8.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Wed Jul 29 2020 Fedora Release Engineering - 2.8.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From b455c3dca0a5c2eaaffe3e7aef4387ece68c421c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:12:20 +0100 Subject: [PATCH 63/85] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- sec.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index bf003db..8a725e6 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.8.3 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,10 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.8.3-4 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Wed Jan 27 2021 Fedora Release Engineering - 2.8.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From c6313ef3eeaa3a77636df32aa53890dd47c2522f Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Thu, 13 May 2021 11:28:32 +0200 Subject: [PATCH 64/85] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 54e87fb..759e031 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,4 @@ sec-2.5.3.tar.gz /sec-2.8.1.tar.gz /sec-2.8.2.tar.gz /sec-2.8.3.tar.gz +/sec-2.9.0.tar.gz diff --git a/sec.spec b/sec.spec index 8a725e6..1d66163 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.8.3 -Release: 4%{?dist} +Version: 2.9.0 +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Thu May 13 2021 Stefan Schulze Frielinghaus - 2.9.0-1 +- New upstream release + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.8.3-4 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. diff --git a/sources b/sources index e30ca73..b8d3f32 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.8.3.tar.gz) = 9eba7db0dfa3661a3ef4e8aad3eeef1db710784f7a71131991a06918cc4f5634577b8bff3f00fcc1c5d998bf0c1e80efe88e1c1df3f5530b6ab4905ff00f2269 +SHA512 (sec-2.9.0.tar.gz) = 7316b5e01695920800d2caba1cff8f91e47c6c42a9c871481e7059892fcfa649161f19decdbf9c42d8c0cd7eb204b4be26d56babfceabf4b3188304edc2836f8 From c516a59378a8991f21a6859fa09441b07367542b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 17:19:26 +0000 Subject: [PATCH 65/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 1d66163..65a9950 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.9.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 2.9.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Thu May 13 2021 Stefan Schulze Frielinghaus - 2.9.0-1 - New upstream release From 02d5ec1c0d88577a611bd3bb06e8bce254e84928 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jan 2022 00:38:15 +0000 Subject: [PATCH 66/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 65a9950..8b9a895 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.9.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sat Jan 22 2022 Fedora Release Engineering - 2.9.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Fri Jul 23 2021 Fedora Release Engineering - 2.9.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From b4216e8e86ac6d9c989cc82be5791476113ad641 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Wed, 4 May 2022 19:26:38 +0200 Subject: [PATCH 67/85] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 759e031..8253532 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,4 @@ sec-2.5.3.tar.gz /sec-2.8.2.tar.gz /sec-2.8.3.tar.gz /sec-2.9.0.tar.gz +/sec-2.9.1.tar.gz diff --git a/sec.spec b/sec.spec index 8b9a895..8fdd9c1 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.9.0 -Release: 3%{?dist} +Version: 2.9.1 +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Wed May 04 2022 Stefan Schulze Frielinghaus - 2.9.1-1 +- New upstream release + * Sat Jan 22 2022 Fedora Release Engineering - 2.9.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild diff --git a/sources b/sources index b8d3f32..4ae1cca 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.9.0.tar.gz) = 7316b5e01695920800d2caba1cff8f91e47c6c42a9c871481e7059892fcfa649161f19decdbf9c42d8c0cd7eb204b4be26d56babfceabf4b3188304edc2836f8 +SHA512 (sec-2.9.1.tar.gz) = c6764cf660ad969d260e4993c38809580e448a9d941d1a763c1b70630c5d55a7f215feb6b0fa50cbf23d68fb442e34f0d270d03e1172850d63d64042a689ac90 From 6706d1292806b0abc405849e56c0e4a371eb5ea3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 08:19:43 +0000 Subject: [PATCH 68/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 8fdd9c1..5dc25ed 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.9.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 2.9.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Wed May 04 2022 Stefan Schulze Frielinghaus - 2.9.1-1 - New upstream release From 297b87d741fe51a43c1346b29ba0fca2739c47b8 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Thu, 20 Oct 2022 20:23:14 +0200 Subject: [PATCH 69/85] Initial EPEL 9 build --- Makefile | 21 --------------- conf.README | 12 +++++++++ sec.logrotate | 8 ++++++ sec.service | 12 +++++++++ sec.spec | 71 +++++++++++++++++++++++++++++++++++++++++++++++++++ sec.sysconfig | 19 ++++++++++++++ sec@.service | 12 +++++++++ sources | 1 + 8 files changed, 135 insertions(+), 21 deletions(-) delete mode 100644 Makefile create mode 100644 conf.README create mode 100644 sec.logrotate create mode 100644 sec.service create mode 100644 sec.spec create mode 100644 sec.sysconfig create mode 100644 sec@.service diff --git a/Makefile b/Makefile deleted file mode 100644 index a45a953..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: sec -# $Id$ -NAME := sec -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/conf.README b/conf.README new file mode 100644 index 0000000..252ae6f --- /dev/null +++ b/conf.README @@ -0,0 +1,12 @@ +This is the SEC configuration directory. Because SEC usage varies so widely +from user to user, this package is configured by default to not run. + +The commented-out default settings in /etc/sysconfig/sec will load any file in +this directory with a .sec suffix. You can find several example rules at + + https://github.com/simple-evcorr/rulesets + +and install the ones you want here (taking into account that the examples are +generic and some of them may need to be tweaked to work with your setup). You +should also read the SEC man page so you have at least a basic understanding of +the SEC configuration commands. diff --git a/sec.logrotate b/sec.logrotate new file mode 100644 index 0000000..917a7bc --- /dev/null +++ b/sec.logrotate @@ -0,0 +1,8 @@ +/var/log/sec { + missingok + notifempty + sharedscripts + postrotate + [ ! -f /run/sec.pid ] || kill -USR2 `cat /run/sec.pid` + endscript +} diff --git a/sec.service b/sec.service new file mode 100644 index 0000000..7b05795 --- /dev/null +++ b/sec.service @@ -0,0 +1,12 @@ +[Unit] +Description=Simple Event Correlator script to filter log file entries +After=syslog.target + +[Service] +Type=forking +PIDFile=/run/sec.pid +ExecStart=/usr/bin/sec --detach --pid=/run/sec.pid $OPTIONS +EnvironmentFile=/etc/sysconfig/sec + +[Install] +WantedBy=multi-user.target diff --git a/sec.spec b/sec.spec new file mode 100644 index 0000000..fa1a372 --- /dev/null +++ b/sec.spec @@ -0,0 +1,71 @@ +Name: sec +Version: 2.9.1 +Release: 1%{?dist} +Summary: Simple Event Correlator script to filter log file entries +License: GPLv2+ +URL: https://simple-evcorr.github.io/ +Source0: https://github.com/simple-evcorr/sec/releases/download/%{version}/sec-%{version}.tar.gz +Source1: sec.service +Source2: sec@.service +Source3: sec.logrotate +Source4: sec.sysconfig +Source5: conf.README +BuildArch: noarch + +BuildRequires: perl-generators +BuildRequires: systemd + +Requires: logrotate + +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd + +%description +SEC is a simple event correlation tool that reads lines from files, named +pipes, or standard input, and matches the lines with regular expressions, +Perl subroutines, and other patterns for recognizing input events. +Events are then correlated according to the rules in configuration files, +producing output events by executing user-specified shell commands, by +writing messages to pipes or files, etc. + +%prep +%setup -q + +%build + +%install +# Install SEC and its associated files +install -D -m 0755 -p sec %{buildroot}%{_bindir}/sec +install -D -m 0644 -p sec.man %{buildroot}%{_mandir}/man1/sec.1 +install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_unitdir}/sec.service +install -D -m 0644 -p %{SOURCE2} %{buildroot}%{_unitdir}/sec@.service +install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec +install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/sec +install -D -m 0644 -p %{SOURCE5} %{buildroot}%{_sysconfdir}/%{name}/README + +# Remove executable bits because these files get packed as docs +chmod 0644 contrib/convert.pl contrib/swatch2sec.pl + +%post +%systemd_post sec.service + +%preun +%systemd_preun sec.service + +%postun +%systemd_postun_with_restart sec.service + +%files +%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl +%config(noreplace) %{_sysconfdir}/%{name} +%config(noreplace) %{_sysconfdir}/logrotate.d/sec +%config(noreplace) %{_sysconfdir}/sysconfig/sec +%{_bindir}/sec +%{_mandir}/man1/sec.1* +%{_unitdir}/sec.service +%{_unitdir}/sec@.service + +%changelog +* Thu Oct 20 2022 Stefan Schulze Frielinghaus - 2.9.1-1 +- Initial EPEL 9 build diff --git a/sec.sysconfig b/sec.sysconfig new file mode 100644 index 0000000..a240503 --- /dev/null +++ b/sec.sysconfig @@ -0,0 +1,19 @@ +# Command line options for SEC + +OPTIONS="--conf=/etc/sec/*.sec --input=/var/log/messages --log=/var/log/sec --intevents" + +# This is an example config if multiple instances of SEC should be started. +# These settings should be used together with the systemd service file +# sec@.service +# which allows to run multiple sec instances. +# +# +# Below you find an example configuration of two instances named FOO and BAR. +# The instances can be started via the commands +# systemctl start sec@FOO and systemctl start sec@BAR +# For further configuration options, consult the systemd file: +# /lib/systemd/system/sec@.service + +#OPTIONS_FOO="--conf=/etc/sec/FOO/*.sec --input=/var/log/secure --log=/var/log/sec-FOO --intevents" + +#OPTIONS_BAR="--conf=/etc/sec/BAR/*.sec --input=/var/log/maillog --log=/var/log/sec-BAR --intevents" diff --git a/sec@.service b/sec@.service new file mode 100644 index 0000000..dbf83af --- /dev/null +++ b/sec@.service @@ -0,0 +1,12 @@ +[Unit] +Description=Simple Event Correlator (instance %I) +After=syslog.target + +[Service] +Type=forking +PIDFile=/run/sec-%I.pid +ExecStart=/usr/bin/sec --detach --pid=/run/sec-%I.pid $OPTIONS_%I +EnvironmentFile=/etc/sysconfig/sec + +[Install] +WantedBy=multi-user.target diff --git a/sources b/sources index e69de29..4ae1cca 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +SHA512 (sec-2.9.1.tar.gz) = c6764cf660ad969d260e4993c38809580e448a9d941d1a763c1b70630c5d55a7f215feb6b0fa50cbf23d68fb442e34f0d270d03e1172850d63d64042a689ac90 From 6f5e02cee4b7db87bce33ab8fa5d017adb311287 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 02:57:20 +0000 Subject: [PATCH 70/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 5dc25ed..2a97137 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.9.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 2.9.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Sat Jul 23 2022 Fedora Release Engineering - 2.9.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 68141661df7482709a46c9e996e673a31f1a0a18 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Mon, 5 Jun 2023 21:14:35 +0200 Subject: [PATCH 71/85] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 8253532..92c05c1 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ sec-2.5.3.tar.gz /sec-2.8.3.tar.gz /sec-2.9.0.tar.gz /sec-2.9.1.tar.gz +/sec-2.9.2.tar.gz diff --git a/sec.spec b/sec.spec index 2a97137..814c1fa 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.9.1 -Release: 3%{?dist} +Version: 2.9.2 +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Mon Jun 05 2023 Stefan Schulze Frielinghaus - 2.9.2-1 +- New upstream release + * Sat Jan 21 2023 Fedora Release Engineering - 2.9.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index 4ae1cca..89ce004 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.9.1.tar.gz) = c6764cf660ad969d260e4993c38809580e448a9d941d1a763c1b70630c5d55a7f215feb6b0fa50cbf23d68fb442e34f0d270d03e1172850d63d64042a689ac90 +SHA512 (sec-2.9.2.tar.gz) = 441c543f9abcfff46c5cd86c9be8fd5c57fef988519f2c9f431b715717e0500ce1b89365e16c0d3b6e76369cf5ee5f6d5318b32e4374c614ec0083833021f17c From e79c718ebb48855b208872aafc4487f4eb54feae Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Tue, 6 Jun 2023 07:10:58 +0200 Subject: [PATCH 72/85] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..7272147 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/sec-2.9.2.tar.gz diff --git a/sec.spec b/sec.spec index fa1a372..9ae65ca 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.9.1 +Version: 2.9.2 Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ @@ -67,5 +67,8 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Mon Jun 05 2023 Stefan Schulze Frielinghaus - 2.9.2-1 +- New upstream release + * Thu Oct 20 2022 Stefan Schulze Frielinghaus - 2.9.1-1 - Initial EPEL 9 build diff --git a/sources b/sources index 4ae1cca..89ce004 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.9.1.tar.gz) = c6764cf660ad969d260e4993c38809580e448a9d941d1a763c1b70630c5d55a7f215feb6b0fa50cbf23d68fb442e34f0d270d03e1172850d63d64042a689ac90 +SHA512 (sec-2.9.2.tar.gz) = 441c543f9abcfff46c5cd86c9be8fd5c57fef988519f2c9f431b715717e0500ce1b89365e16c0d3b6e76369cf5ee5f6d5318b32e4374c614ec0083833021f17c From 859c94ecc91421a698248b7d24feb29e6b785de7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 01:21:36 +0000 Subject: [PATCH 73/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 814c1fa..67c7bcd 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.9.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 2.9.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Mon Jun 05 2023 Stefan Schulze Frielinghaus - 2.9.2-1 - New upstream release From 71f285502b9271482541be7231320a2b759580c4 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 02:30:13 +0000 Subject: [PATCH 74/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 67c7bcd..cd2228e 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.9.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 2.9.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jul 22 2023 Fedora Release Engineering - 2.9.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From f6f4654bb3b6028830a3d85260ccc43bb678b9b8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 05:12:08 +0000 Subject: [PATCH 75/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index cd2228e..84acade 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.9.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ URL: https://simple-evcorr.github.io/ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 2.9.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Sat Jan 27 2024 Fedora Release Engineering - 2.9.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From aeb001a308a1fdd7d07c63533d407acbf8be4bcb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Fri, 26 Jul 2024 02:53:48 +0200 Subject: [PATCH 76/85] convert GPLv2+ license to SPDX This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 --- sec.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sec.spec b/sec.spec index 84acade..335f897 100644 --- a/sec.spec +++ b/sec.spec @@ -1,8 +1,9 @@ Name: sec Version: 2.9.2 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Simple Event Correlator script to filter log file entries -License: GPLv2+ +# Automatically converted from old format: GPLv2+ - review is highly recommended. +License: GPL-2.0-or-later URL: https://simple-evcorr.github.io/ Source0: https://github.com/simple-evcorr/sec/releases/download/%{version}/sec-%{version}.tar.gz Source1: sec.service @@ -67,6 +68,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Fri Jul 26 2024 Miroslav Suchý - 2.9.2-5 +- convert license to SPDX + * Sat Jul 20 2024 Fedora Release Engineering - 2.9.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From e70079df1cae42d2230581fb1c97825acc811b45 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 2 Nov 2024 14:00:58 +0100 Subject: [PATCH 77/85] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 92c05c1..ec32271 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ sec-2.5.3.tar.gz /sec-2.9.0.tar.gz /sec-2.9.1.tar.gz /sec-2.9.2.tar.gz +/sec-2.9.3.tar.gz diff --git a/sec.spec b/sec.spec index 335f897..9b47911 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.9.2 -Release: 5%{?dist} +Version: 2.9.3 +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries # Automatically converted from old format: GPLv2+ - review is highly recommended. License: GPL-2.0-or-later @@ -68,6 +68,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sat Nov 02 2024 Stefan Schulze Frielinghaus - 2.9.3-1 +- New upstream release + * Fri Jul 26 2024 Miroslav Suchý - 2.9.2-5 - convert license to SPDX diff --git a/sources b/sources index 89ce004..ae04780 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.9.2.tar.gz) = 441c543f9abcfff46c5cd86c9be8fd5c57fef988519f2c9f431b715717e0500ce1b89365e16c0d3b6e76369cf5ee5f6d5318b32e4374c614ec0083833021f17c +SHA512 (sec-2.9.3.tar.gz) = 7facf3f5d80ec5466e1e35cc1ab186bbac092bb011816a72e8be6c60eadffca75c5765a914e8700eacf90d7f8c46088bdb17213a7c670c4ca5b852ce30fbdf26 From b2eef436dd1aca3619614bc8908498dcd9a29bcd Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 2 Nov 2024 14:12:46 +0100 Subject: [PATCH 78/85] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 7272147..52544cb 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /sec-2.9.2.tar.gz +/sec-2.9.3.tar.gz diff --git a/sec.spec b/sec.spec index 9ae65ca..161dc1e 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.9.2 +Version: 2.9.3 Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sat Nov 02 2024 Stefan Schulze Frielinghaus - 2.9.3-1 +- New upstream release + * Mon Jun 05 2023 Stefan Schulze Frielinghaus - 2.9.2-1 - New upstream release diff --git a/sources b/sources index 89ce004..ae04780 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.9.2.tar.gz) = 441c543f9abcfff46c5cd86c9be8fd5c57fef988519f2c9f431b715717e0500ce1b89365e16c0d3b6e76369cf5ee5f6d5318b32e4374c614ec0083833021f17c +SHA512 (sec-2.9.3.tar.gz) = 7facf3f5d80ec5466e1e35cc1ab186bbac092bb011816a72e8be6c60eadffca75c5765a914e8700eacf90d7f8c46088bdb17213a7c670c4ca5b852ce30fbdf26 From 84cb4232c1952893ab0ded96255398705f7571b5 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 10:21:48 +0000 Subject: [PATCH 79/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 9b47911..fdb8bf1 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.9.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries # Automatically converted from old format: GPLv2+ - review is highly recommended. License: GPL-2.0-or-later @@ -68,6 +68,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 2.9.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sat Nov 02 2024 Stefan Schulze Frielinghaus - 2.9.3-1 - New upstream release From d3c773862af94b92136492aceecfbcf6309cab50 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 18:07:19 +0000 Subject: [PATCH 80/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index fdb8bf1..57fa658 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.9.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Simple Event Correlator script to filter log file entries # Automatically converted from old format: GPLv2+ - review is highly recommended. License: GPL-2.0-or-later @@ -68,6 +68,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 2.9.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Sun Jan 19 2025 Fedora Release Engineering - 2.9.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 6fcadc7767d226dd5ad77228fe160e223844a601 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 17:51:48 +0000 Subject: [PATCH 81/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 57fa658..ab099f4 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.9.3 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Simple Event Correlator script to filter log file entries # Automatically converted from old format: GPLv2+ - review is highly recommended. License: GPL-2.0-or-later @@ -68,6 +68,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Sat Jan 17 2026 Fedora Release Engineering - 2.9.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Fri Jul 25 2025 Fedora Release Engineering - 2.9.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From f98d7584f253b29a6d23635c47c4ce1177b6624e Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Thu, 12 Feb 2026 19:59:48 +0100 Subject: [PATCH 82/85] Use systemctl kill --- sec.logrotate | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sec.logrotate b/sec.logrotate index 917a7bc..6ddef14 100644 --- a/sec.logrotate +++ b/sec.logrotate @@ -3,6 +3,6 @@ notifempty sharedscripts postrotate - [ ! -f /run/sec.pid ] || kill -USR2 `cat /run/sec.pid` + /usr/bin/systemctl kill --signal=USR2 --kill-whom=main sec.service 2>/dev/null || true endscript } From a8be23457713c9dfa950f9ea1d53db7328721e66 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Thu, 12 Feb 2026 20:17:04 +0100 Subject: [PATCH 83/85] New upstream release --- .gitignore | 1 + sec.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index ec32271..9c8a2a1 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,4 @@ sec-2.5.3.tar.gz /sec-2.9.1.tar.gz /sec-2.9.2.tar.gz /sec-2.9.3.tar.gz +/sec-2.9.4.tar.gz diff --git a/sec.spec b/sec.spec index ab099f4..975c6c5 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.9.3 -Release: 4%{?dist} +Version: 2.9.4 +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries # Automatically converted from old format: GPLv2+ - review is highly recommended. License: GPL-2.0-or-later @@ -68,6 +68,10 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Thu Feb 12 2026 Stefan Schulze Frielinghaus - 2.9.4-1 +- New upstream release +- Use systemctl kill + * Sat Jan 17 2026 Fedora Release Engineering - 2.9.3-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild diff --git a/sources b/sources index ae04780..30a16bf 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.9.3.tar.gz) = 7facf3f5d80ec5466e1e35cc1ab186bbac092bb011816a72e8be6c60eadffca75c5765a914e8700eacf90d7f8c46088bdb17213a7c670c4ca5b852ce30fbdf26 +SHA512 (sec-2.9.4.tar.gz) = e049ea61e52420faddc2ad3373d9ec65cc6187d59e89537d919eb0342688e494c3d9db334347dbaf9a42260930c99756d46ed3f9f015a38bd95f6959ded047d9 From eef0bcb41b75e71670b4bdec89c9527cc459ba83 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Thu, 12 Feb 2026 20:49:05 +0100 Subject: [PATCH 84/85] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 52544cb..2db1664 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /sec-2.9.2.tar.gz /sec-2.9.3.tar.gz +/sec-2.9.4.tar.gz diff --git a/sec.spec b/sec.spec index 161dc1e..54db3fc 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.9.3 +Version: 2.9.4 Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries License: GPLv2+ @@ -67,6 +67,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Thu Feb 12 2026 Stefan Schulze Frielinghaus - 2.9.4-1 +- New upstream release + * Sat Nov 02 2024 Stefan Schulze Frielinghaus - 2.9.3-1 - New upstream release diff --git a/sources b/sources index ae04780..30a16bf 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.9.3.tar.gz) = 7facf3f5d80ec5466e1e35cc1ab186bbac092bb011816a72e8be6c60eadffca75c5765a914e8700eacf90d7f8c46088bdb17213a7c670c4ca5b852ce30fbdf26 +SHA512 (sec-2.9.4.tar.gz) = e049ea61e52420faddc2ad3373d9ec65cc6187d59e89537d919eb0342688e494c3d9db334347dbaf9a42260930c99756d46ed3f9f015a38bd95f6959ded047d9 From 673d78a7ee52496aff322dfd469379c9f787fedb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 06:22:15 +0000 Subject: [PATCH 85/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 975c6c5..1d6d6bb 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.9.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries # Automatically converted from old format: GPLv2+ - review is highly recommended. License: GPL-2.0-or-later @@ -68,6 +68,9 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %{_unitdir}/sec@.service %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 2.9.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + * Thu Feb 12 2026 Stefan Schulze Frielinghaus - 2.9.4-1 - New upstream release - Use systemctl kill