日志审计-graylog ssh登录超过6次告警

Aug 21 07:00:18 a sshd[20129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.108  user=root

[第一阶段]身份验证失败阶段

Aug 21 07:00:20 a sshd[20129]: Failed password for root from 192.168.0.108 port 61432 ssh2

[第二阶段]首次密码验证失败阶段

Aug 21 07:01:00 a sshd[20129]: message repeated 4 times: [ Failed password for root from 192.168.0.108 port 61432 ssh2]

[第三阶段]多次重复的密码验证失败阶段

Aug 21 07:01:25 a sshd[20129]: Failed password for root from 192.168.0.108 port 61432 ssh2

[第四阶段]最终的密码验证失败阶段

Aug 21 07:01:26 a sshd[20129]: error: maximum authentication attempts exceeded for root from 192.168.0.108 port 61432 ssh2 [preauth]

[第五阶段]超过最大尝试次数阶段。SSH 服务决定断开连接并阻止进一步的尝试

Aug 22 02:27:32 a sshd[26318]: Disconnecting authenticating user root 192.168.0.108 port 60267: Too many authentication failures [preauth]

[第六阶段]断开连接

Aug 22 02:27:32 a sshd[26318]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.108  user=root

[第七阶段]由PAM模块产生，提示认证失败一次基础上，又尝试了5次。即一共失败6次

提取服务器IP

rule "gl2_remote_ip rename"
when
  has_field("gl2_remote_ip")
then
  set_field("server_ip", to_string($message.gl2_remote_ip));
end

提取源IP

rule "ssh password for from"
when
  contains(value: to_string($message.message), search: "ssh", ignore_case: false)
then
  let m = regex("(Failed|Accepted) password for (\\S+) from (\\S+)\\s+port\\s+(\\d+)",to_string($message.message));
  set_field("command", to_string(m["0"]));
  set_field("account", to_string(m["1"]));
  set_field("remote_addr", to_string(m["2"]));
  set_field("remote_port", to_string(m["3"]));
end

message: "sshd" AND message: "PAM" AND message: "more authentication"