New rules for su root attempts

Hello everyone.

I've found that performing 'su - root' task generates no events from prelude-lml sensor on FreeBSD systems. So I added two rules for successfull and non-successfull attempts. I'm not sure what *.rules should be updated (pam.rules or other), so I placed them into su.rules file.

###################
# Logging succeed #
###################

#Jul 18 17:12:49 hids su: afonyashin to root on /dev/ttyp0
regex=su: (\S+) to root on (\S+); \
 classification.text=Admin login; \
 id=10000; \
 revision=1; \
 analyzer(0).name=su; \
 analyzer(0).class=Authentication; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.severity=medium; \
 assessment.impact.description=User $1 authenticated to root successfuly; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1;  \
 source(0).user.user_id(0).tty=$2;  \
 target(0).user.category=os-device; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=root; \
 target(0).user.user_id(0).number=0;
 last;

################
# Login failed #
################

Jul 18 17:12:44 hids su: BAD SU afonyashin to root on /dev/ttyp0
regex=su: BAD SU (\S+) to root on (\S+); \
 classification.text=Admin login; \
 id=10001; \
 revision=1; \
 analyzer(0).name=su; \
 analyzer(0).class=Authentication; \
 assessment.impact.completion=failed; \
 assessment.impact.type=admin; \
 assessment.impact.severity=medium; \
 assessment.impact.description=User $1 tried to authenticate as root and failed; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1;  \
 source(0).user.user_id(0).tty=$2;  \
 target(0).user.category=os-device; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=root; \
 target(0).user.user_id(0).number=0;
 last;

Best regards,
Alexander Afonyashin

-- 
Be Yourself @ mail.com!
Choose From 200+ Email Addresses
Get a Free Account at www.mail.com

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel