Skip to content

Commit

Permalink
Merge remote-tracking branch 'origin/topic/vlad/ssh_auth_none_fix'
Browse files Browse the repository at this point in the history 
* origin/topic/vlad/ssh_auth_none_fix:
  Update btest baselines for fix in 46f727a
  Generate ssh_auth_attempted for the 'none' authentication method.
  • Loading branch information
@jsiwek
jsiwek committed Oct 23, 2018
2 parents 2586e5a + 91a74c7 commit 30778f5
Show file tree
Hide file tree
Showing 5 changed files with 12 additions and 4 deletions.
5 changes: 5 additions & 0 deletions CHANGES
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@

2.6-beta2-46 | 2018-10-23 13:01:28 -0500

* GH-192: Generate ssh_auth_attempted for the 'none' authentication method.
(Vlad Grigorescu)

2.6-beta2-43 | 2018-10-19 11:15:44 -0500

* Improve scripts/base/utils/dir unit test (Jon Siwek, Corelight)
Expand Down
2 changes: 1 addition & 1 deletion VERSION
View file
Original file line number Diff line number Diff line change
@@ -1 +1 @@
2.6-beta2-43
2.6-beta2-46
2 changes: 2 additions & 0 deletions src/analyzer/protocol/ssh/SSH.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,8 @@ void SSH_Analyzer::ProcessEncrypted(int len, bool orig)
if ( ! userauth_failure_size && (len + 16 == service_accept_size) )
{
auth_decision_made = true;
if ( ssh_auth_attempted )
BifEvent::generate_ssh_auth_attempted(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), true);
if ( ssh_auth_successful )
BifEvent::generate_ssh_auth_successful(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), true);
return;
Expand Down
1 change: 1 addition & 0 deletions testing/btest/Baseline/scripts.base.protocols.ssh.basic/.stdout
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
auth_result, ClEkJM2Vm5giqnMf4h, T, 1
auth_result, C4J4Th3PJpwUYZZ6gc, T, 3
auth_result, CUM0KZ3MLUfNB0cl11, T, 1
auth_result, Ck51lg1bScffFj34Ri, T, 2
auth_result, C9mvWx3ezztgzcexV7, T, 5
auth_result, CNnMIj2QSd84NKf7U3, T, 1
Expand Down
6 changes: 3 additions & 3 deletions testing/btest/Baseline/scripts.base.protocols.ssh.basic/ssh.log
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,14 @@
#empty_field (empty)
#unset_field -
#path ssh
#open 2018-10-16-15-00-07
#open 2018-10-23-15-34-42
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version auth_success auth_attempts direction client server cipher_alg mac_alg compression_alg kex_alg host_key_alg host_key
#types time string addr port addr port count bool count enum string string string string string string string string
1324071333.792887 CHhAvVGS1DHFjwGM9 192.168.1.79 51880 131.159.21.1 22 2 - 0 - SSH-2.0-OpenSSH_5.9 SSH-2.0-OpenSSH_5.8 aes128-ctr hmac-md5 [email protected] ecdh-sha2-nistp256 ecdsa-sha2-nistp256 a7:26:62:3f:75:1f:33:8a:f3:32:90:8b:73:fd:2c:83
1409516196.413240 ClEkJM2Vm5giqnMf4h 10.0.0.18 40184 128.2.6.88 41644 2 T 1 - SSH-2.0-OpenSSH_6.6 SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.1 aes128-ctr hmac-md5 none ecdh-sha2-nistp256 ssh-rsa 8a:8d:55:28:1e:71:04:99:94:43:22:89:e5:ff:e9:03
1419870189.489202 C4J4Th3PJpwUYZZ6gc 192.168.2.1 57189 192.168.2.158 22 2 T 3 - SSH-2.0-OpenSSH_6.2 SSH-1.99-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 aes128-ctr [email protected] none diffie-hellman-group-exchange-sha256 ssh-rsa 28:78:65:c1:c3:26:f7:1b:65:6a:44:14:d0:04:8f:b3
1419870206.111841 CtPZjS20MLrsMUOJi2 192.168.2.1 57191 192.168.2.158 22 1 - 0 - SSH-1.5-OpenSSH_6.2 SSH-1.99-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 - - - - - a1:73:d1:e1:25:72:79:71:56:56:65:ed:81:bf:67:98
1419996264.344957 CUM0KZ3MLUfNB0cl11 192.168.2.1 55179 192.168.2.158 2200 2 - 0 - SSH-2.0-OpenSSH_6.2 SSH-2.0-paramiko_1.15.2 aes128-ctr hmac-md5 none diffie-hellman-group-exchange-sha1 ssh-rsa 60:73:38:44:cb:51:86:65:7f:de:da:a2:2b:5a:57:d5
1419996264.344957 CUM0KZ3MLUfNB0cl11 192.168.2.1 55179 192.168.2.158 2200 2 T 1 - SSH-2.0-OpenSSH_6.2 SSH-2.0-paramiko_1.15.2 aes128-ctr hmac-md5 none diffie-hellman-group-exchange-sha1 ssh-rsa 60:73:38:44:cb:51:86:65:7f:de:da:a2:2b:5a:57:d5
1420588548.729561 CmES5u32sYpV7JYN 192.168.2.1 56594 192.168.2.158 22 1 - 0 - SSH-1.5-OpenSSH_5.3 SSH-1.99-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 - - - - - a1:73:d1:e1:25:72:79:71:56:56:65:ed:81:bf:67:98
1420590124.885826 CP5puj4I8PtEU4qzYg 192.168.2.1 56821 192.168.2.158 22 1 - 0 - SSH-1.5-OpenSSH_6.2 SSH-1.99-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 - - - - - a1:73:d1:e1:25:72:79:71:56:56:65:ed:81:bf:67:98
1420590308.781231 C37jN32gN3y3AZzyf6 192.168.2.1 56837 192.168.2.158 22 1 - 0 - SSH-1.5-OpenSSH_6.2 SSH-1.99-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 - - - - - a1:73:d1:e1:25:72:79:71:56:56:65:ed:81:bf:67:98
Expand All @@ -28,4 +28,4 @@
1421041177.031508 CLNN1k2QMum1aexUK7 192.168.1.32 58641 131.103.20.168 22 2 F 1 - SSH-2.0-OpenSSH_6.7 SSH-2.0-OpenSSH_5.3 aes128-ctr [email protected] none diffie-hellman-group-exchange-sha256 ssh-rsa 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40
1421041299.777962 CBA8792iHmnhPLksKa 192.168.1.32 58646 131.103.20.168 22 2 T 1 - SSH-2.0-OpenSSH_6.7 SSH-2.0-OpenSSH_5.3 aes128-ctr [email protected] none diffie-hellman-group-exchange-sha256 ssh-rsa 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40
1421041526.353524 CGLPPc35OzDQij1XX8 192.168.1.32 58649 131.103.20.168 22 2 T 1 - SSH-2.0-OpenSSH_6.7 SSH-2.0-OpenSSH_5.3 aes128-ctr [email protected] none diffie-hellman-group-exchange-sha256 ssh-rsa 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40
#close 2018-10-16-15-00-07
#close 2018-10-23-15-34-42

0 comments on commit 30778f5

Please sign in to comment.