prelude-correlator/master: [OpenSSHAuth]: fix potential issue on exit

commit 1f4c6bb0cac0876cc9b19dc12d703fc8e53e7151
Author: Yoann Vandoorselaere <[email protected]>
Date:   Fri Jan 15 17:31:29 2010 +0100

    [OpenSSHAuth]: fix potential issue on exit
    
    Move the alert() function out of the OpenSSHAuth class, making it a
    constant, so that it can be successfuly pickled by Python when saving
    related context. Avoid possible exception on exit.


========================================

 PreludeCorrelator/plugins/opensshauth.py |   18 +++++++++---------
 1 files changed, 9 insertions(+), 9 deletions(-)

========================================

diff --git a/PreludeCorrelator/plugins/opensshauth.py b/PreludeCorrelator/plugins/opensshauth.py
index 9a89481..c6faad4 100644
--- a/PreludeCorrelator/plugins/opensshauth.py
+++ b/PreludeCorrelator/plugins/opensshauth.py
@@ -21,16 +21,16 @@
 from PreludeCorrelator.pluginmanager import Plugin
 from PreludeCorrelator.context import Context
 
+def alert(ctx):
+    if len(ctx.authtype) > 1:
+        ctx.Set("alert.classification.text", "Multiple authentication methods")
+        ctx.Set("alert.correlation_alert.name", "Multiple authentication methods")
+        ctx.Set("alert.assessment.impact.severity", "medium")
+        ctx.Set("alert.assessment.impact.description", "Multiple ways of authenticating a single user have been found over SSH. If passphrase is the only allowed method, make sure you disable passwords.")
+        ctx.alert()
+    ctx.destroy()
 
 class OpenSSHAuthPlugin(Plugin):
-    def alert(self, ctx):
-        if len(ctx.authtype) > 1:
-            ctx.Set("alert.classification.text", "Multiple authentication methods")
-            ctx.Set("alert.correlation_alert.name", "Multiple authentication methods")
-            ctx.Set("alert.assessment.impact.severity", "medium")
-            ctx.Set("alert.assessment.impact.description", "Multiple ways of authenticating a single user have been found over SSH. If passphrase is the only allowed method, make sure you disable passwords.")
-            ctx.alert()
-
     def run(self, idmef):
         if idmef.Get("alert.analyzer(-1).manufacturer") != "OpenSSH":
                 return
@@ -47,7 +47,7 @@ class OpenSSHAuthPlugin(Plugin):
 
         for username in idmef.Get("alert.target(*).user.user_id(*).name"):
             for target in idmef.Get("alert.target(*).node.address(*).address"):
-                ctx = Context("SSH_MAT_" + target + username, { "expire": 30, "alert_on_expire": self.alert }, update=True)
+                ctx = Context("SSH_MAT_" + target + username, { "expire": 30, "alert_on_expire": alert }, update=True)
                 if ctx.getUpdateCount() == 0:
                     ctx.authtype = { data: True }
                     ctx.addAlertReference(idmef)
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog