Re: [Prelude Hybrid IDS] #232: ssh.rules does not handle IPv6 address
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#232: ssh.rules does not handle IPv6 address ---------------------------------+------------------------------------------ Reporter: [email protected] | Owner: yoann Type: defect | Status: assigned Priority: normal | Milestone: Prelude-LML 0.9.11 Component: prelude-lml | Version: 0.9 Severity: normal | Resolution: Keywords: | ---------------------------------+------------------------------------------ Comment (by [email protected]): you are correct and there is a later rule which uses a regex already to handles ipv6 the problem is the behavior of ssh is to map all ipv4 addresses as ipv6 in this manner when the user connected using ipv4 it also maps this way if ipv6 is used even if the user who connects uses standard hex notation to connect. this can confus an operator who is not familiar with ipv6. though this is probably more of an issue to take up with open ssh maybe we change modify the rule so it reports both ipv4 and ipv6 version of the address in this case. either way rule 1909 needs to be corrected it is the existing ipv6 rule for user authentication and the fact that it reports all non root users as root is a major bug -- Ticket URL: <https://trac.prelude-ids.org/ticket/232#comment:3> Prelude Hybrid IDS <http://www.prelude-ids.org> The Prelude Hybrid Intrusion Detection System suite _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel