PPP/PPTP/L2TP prelude-lml sensor rules

Hi everyone,

I'm writing new ruleset to monitor pppd+poptop daemons log events. Some questions need to be answered. Here they are:

1. To record the ip address assigned to remote client by ppp server we need to start context at IPCP phase. But I see no reason to do this since if remote client doesn't supply user name later then we have single 'telnet-like' connect. And there's no reason to generate an alert. Ideas?
2. There's no way (at least in my ppp/pptpd logs) to determine which PID is of forked ppp process. So the only thing to bind supplied user name and its remote ip address is to wait until connection finish. If anyone has idea about it?
3. Context PPP should live until session ended. So it has zero (unlimited?) lifetime. How to delete this context together with deleting PPTPD context when alert is fully composed?
4. Do we need (are there IDMEF fields) ip-address assigned to remote user by server?
5. Do we need (are there IDMEF fields) to provide authentication type protocol and tunnel number?

Below is the very first draft of this ruleset:

# PPP/PPTP/L2TP VPN Server rules
# Copyright (C) 2008 Alexander Afonyashin <[email protected]>

#Dec  4 23:01:24 beorc pptpd[24795]: CTRL: Client 1.2.3.4 control connection started
#Dec  4 23:01:24 beorc pptpd[24795]: CTRL: Starting call (launching pppd, opening GRE)

#Dec  4 23:01:25 beorc ppp[24796]: tun2: IPCP: Selected IP address 5.6.7.8

# Logging succeed

#Dec  4 23:01:36 beorc ppp[24796]: tun2: Phase: Chap Input: RESPONSE (49 bytes from afonyashin)
regex=ppp\[(\d+)\]: \S+: Phase: \S+ Input: RESPONSE \(\d+ bytes from (\S+)\); \
 new_context=PPP_$1,expire:0; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$2; \
 silent;

#Dec  4 23:01:36 beorc ppp[24796]: tun2: Phase: Chap Output: SUCCESS
regex=ppp\[(\d+)\]: \S+: Phase: \S+ Output: SUCCESS
 require_context=PPP_$1; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeded; \
 assessment.impact.type=user; \
 silent;

#Dec  4 23:01:49 beorc pptpd[24795]: CTRL: Reaping child PPP[24796]
regex=pptpd\[(\d+)\]: CTRL: \S+ \S+ PPP\[(\d+)\]; \
 require_context=PPP_$2; \
 new_context=PPTPD_$1,expire:5; \
 silent;

#Dec  4 23:01:49 beorc pptpd[24795]: CTRL: Client 1.2.3.4 control connection finished
regex=pptpd\[(\d+)\]: CTRL: Client (\S+) control; \
 require_context=PPTPD_$1; \
 source(0).node.address(0).address=$2;
 last;

# Logging failed

#Dec  4 23:01:36 beorc ppp[24796]: tun2: Phase: Chap Output: FAILURE
regex=ppp\[(\d+)\]: \S+: Phase: \S+ Output: FAILURE
 require_context=PPP_$1; \
 assessment.impact.severity=medium; \
 assessment.impact.completion=failed; \
 assessment.impact.type=user; \
 silent;

Best regards,
Alexander Afonyashin

-- 
Be Yourself @ mail.com!
Choose From 200+ Email Addresses
Get a Free Account at www.mail.com

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel