[Prelude Hybrid IDS] #232: sshrules update
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#232: sshrules update ---------------------------------+------------------------------------------ Reporter: [email protected] | Owner: yoann Type: defect | Status: new Priority: normal | Milestone: Prelude-LML 0.9.11 Component: prelude-lml | Version: 0.9 Severity: normal | Keywords: ---------------------------------+------------------------------------------ attached to this ticket is a diff of the ssh.rules I added a workaround for buggy output I'v seen on Redhat AS4 where ::ffff: is prepended to ipv4 addresses {{{ Jun 5 15:50:35 somehost sshd[17740]: Accepted publickey for someuser from ::ffff:192.168.0.22 port 59610 ssh2 }}} also I altered rule number 1909 due to the fact it always reported targer user root even though the regex only matches non root users {{{ - target(0).user.user_id(0).name=root; \ + target(0).user.user_id(0).name=$2; \ }}} -- Ticket URL: <https://trac.prelude-ids.org/ticket/232> Prelude Hybrid IDS <http://www.prelude-ids.org> The Prelude Hybrid Intrusion Detection System suite _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel