Re: [Prelude Hybrid IDS] #232: ssh.rules does not handle IPv6 address
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#232: ssh.rules does not handle IPv6 address ---------------------------------+------------------------------------------ Reporter: [email protected] | Owner: yoann Type: defect | Status: assigned Priority: normal | Milestone: Prelude-LML 0.9.11 Component: prelude-lml | Version: 0.9 Severity: normal | Resolution: Keywords: | ---------------------------------+------------------------------------------ Comment (by yoann): Replying to [comment:3 [email protected]]: > > you are correct and there is a later rule which uses a regex already to handles ipv6 the problem is the behavior of ssh is to map all ipv4 addresses as ipv6 in this manner when the user connected using ipv4 it also maps this way if ipv6 is used even if the user who connects uses standard hex notation to connect. this can confus an operator who is not familiar with ipv6. I agree, although another solution would be to use the Prelude-Manager normalization plugin to fix the problem, since other products could exhibit the same behavior as OpenSSH. Then maybe we should fix Normalize so that it always remap IPv6 mapped IPv4 address to IPv4. > though this is probably more of an issue to take up with open ssh > maybe we change modify the rule so it reports both ipv4 and ipv6 version of the address in this case. In the attached patch, all the rule now use (\S+), allowing to merge IPv4 and IPv6 rules together, and let the Normalization plugin set the ''address.category'' member. > either way rule 1909 needs to be corrected > it is the existing ipv6 rule for user authentication and the fact that it reports all non root users as root is a major bug This is also ported in the attached file. -- Ticket URL: <https://trac.prelude-ids.org/ticket/232#comment:4> Prelude Hybrid IDS <http://www.prelude-ids.org> The Prelude Hybrid Intrusion Detection System suite _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel