new upstream release (3.3.0); modify package compatibility for Stretch

[ossec-hids.git] / etc / rules / sshd_rules.xml

diff --git a/etc/rules/sshd_rules.xml b/etc/rules/sshd_rules.xml
old mode 100755 (executable)
new mode 100644 (file)
index 6f21d98..06d7dc9
--- a/etc/rules/sshd_rules.xml
+++ b/etc/rules/sshd_rules.xml
@@ -270,6 +270,136 @@
     <group>authentication_failed,</group>
   </rule>
 
+  <rule id="5739" level="4">
+    <if_sid>5700</if_sid>
+    <match>^error: Could not stat AuthorizedKeysCommand</match>
+    <description>SSHD configuration error (AuthorizedKeysCommand)</description>
+  </rule>
+
+  <rule id="5740" level="4">
+    <if_sid>5700</if_sid>
+    <match>Connection reset by peer$</match>
+    <description>ssh connection reset by peer</description>
+  </rule>
+
+  <rule id="5741" level="4">
+    <if_sid>5700</if_sid>
+    <match>Connection refused$</match>
+    <description>ssh connection refused</description>
+  </rule>
+
+  <rule id="5742" level="4">
+    <if_sid>5700</if_sid>
+    <match>Connection timed out$</match>
+    <description>ssh connection timed out</description>
+  </rule>
+
+  <rule id="5743" level="4">
+    <if_sid>5700</if_sid>
+    <match>No route to host$</match>
+    <description>ssh no route to host</description>
+  </rule>
+
+  <rule id="5744" level="4">
+    <if_sid>5700</if_sid>
+    <match>failure direct-tcpip$</match>
+    <description>ssh port forwarding issue</description>
+  </rule>
+
+  <rule id="5745" level="4">
+    <if_sid>5700</if_sid>
+    <match>Transport endpoint is not connected$</match>
+    <description>ssh transport endpoint is not connected</description>
+  </rule>
+
+  <rule id="5746" level="4">
+    <if_sid>5700</if_sid>
+    <match>get_remote_port failed$</match>
+    <description>ssh get_remote_port failed</description>
+  </rule>
+  
+  <!-- http://www.gossamer-threads.com/lists/openssh/users/47438 -->
+  <rule id="5747" level="6">
+    <if_sid>5700</if_sid>
+    <match>bad client public DH value</match>
+    <description>ssh bad client public DH value</description>
+  </rule>
+
+  <!-- log sample with context:
+       Nov 22 19:24:52 server sshd[4045]: Connection from 117.117.198.5 port 60304
+       Nov 22 19:24:55 server sshd[4046]: Corrupted MAC on input.
+       Nov 22 19:25:15 server sshd[4046]: Connection closed by 117.117.198.5
+  -->
+  <rule id="5748" level="6">
+    <if_sid>5700</if_sid>
+    <match>Corrupted MAC on input.</match>
+    <description>ssh corrupted MAC on input</description>
+  </rule>
+
+  <rule id="5749" level="4">
+    <if_sid>5700</if_sid>
+    <match>^Bad packet length</match>
+    <description>ssh bad packet length</description>
+  </rule>
+
+  <rule id="5750" level="0">
+    <decoded_as>sshd</decoded_as>
+    <if_sid>5700</if_sid>
+    <match>Unable to negotiate with |Unable to negotiate a key</match>
+    <description>sshd could not negotiate with client.</description>
+  </rule>
+
+  <rule id="5751" level="1">
+    <decoded_as>sshd</decoded_as>
+    <if_sid>5700</if_sid>
+    <match>no hostkey alg [preauth]</match>
+    <description>No hostkey alg.</description>
+  </rule>
+
+  <rule id="5752" level="2">
+    <if_sid>5750</if_sid>
+    <match>no matching key exchange method found.|Unable to negotiate a key exchange method</match>
+    <description>Client did not offer an acceptable key exchange method.</description>
+  </rule>
+
+  <rule id="5753" level="2">
+    <if_sid>5750</if_sid>
+    <match>no matching cipher found.</match>
+    <description>sshd could not negotiate with client, no matching cipher.</description>
+  </rule>
+
+  <rule id="5754" level="1">
+    <if_sid>5700</if_sid>
+    <match>Failed to create session: </match>
+    <description>sshd failed to create a session.</description>
+  </rule>
+
+  <rule id="5755" level="2">
+    <if_sid>5700</if_sid>
+    <match>bad ownership or modes for file</match>
+    <description>Authentication refused due to owner/permissions of authorized_keys.</description>
+    <group>authentication_failed,</group>
+  </rule>
+
+  <rule id="5756" level="0">
+    <if_sid>5700</if_sid>
+    <match> failed, subsystem not found$</match>
+    <description>sshd subsystem request failed.</description>
+  </rule>
+
+  <rule id="5757" level="0">
+    <decoded_as>sshd</decoded_as>
+    <match>but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!$</match>
+    <description>Bad DNS mapping.</description>
+  </rule>
+
+  <rule id="5758" level="8">
+    <decoded_as>sshd</decoded_as>
+    <match>^error: maximum authentication attempts exceeded </match>
+    <description>Maximum authentication attempts exceeded.</description>
+    <group>authentication_failed,</group>
+  </rule>
+
 </group> <!-- SYSLOG, SSHD -->
 
 <!-- EOF -->