Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature/sudo and su #21

Merged
merged 3 commits into from
Nov 16, 2024
+27 −5
Merged

Feature/sudo and su #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e6f64dc
add regex pattern of sudo and su
mumrik58 Nov 15, 2024
fd6b5fd
documentation of collecting events of sudo and su
mumrik58 Nov 15, 2024
82f2522
Add events to auth.log for tests.
woblerr Nov 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,11 @@ authlog_events_total{cityName="Beijing",countryName="China",countyISOCode="CN",e
|invalidUser|`Invalid user (?P<user>.*) from (?P<ipAddress>.*) port`|
|notAllowedUser|`User (?P<user>.*) from (?P<ipAddress>.*) not allowed because`|
|connectionClosed|`Connection closed by authenticating user (?P<user>.*) (?P<ipAddress>.*) port`|
|sudoIncorrectPasswordAttempts|`[ ]+(?P<user>.*) : (?P<attempts>\\d+) incorrect password attempts ; TTY=(?P<tty>[^ ]+) ; PWD=(?P<pwd>.+) ; USER=(?P<user_as>.*) ; COMMAND=(?P<command>.*)`|
|sudoNotInSudoers|`[ ]+(?P<user>.*) : user NOT in sudoers ; TTY=(?P<tty>[^ ]+) ; PWD=(?P<pwd>.+) ; USER=(?P<user_as>.*) ; COMMAND=(?P<command>.*)`|
|sudoSucceeded|`[ ]+(?P<user>.*) : TTY=(?P<tty>[^ ]+) ; PWD=(?P<pwd>.+) ; USER=(?P<user_as>.*) ; COMMAND=(?P<command>.*)`|
|suSucceeded|`\\(to (?P<user_as>.*)\\) (?P<user>.*) on (?P<tty>[^ ]+)`|
|suFailed|`FAILED SU \\(to (?P<user_as>.*)\\) (?P<user>.*) on (?P<tty>[^ ]+)`|

## Getting Started

Expand Down
15 changes: 10 additions & 5 deletions promexporter/parser.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,16 @@ import (
var (
authLinePrefix = "^(?P<date>[A-Z][a-z]{2}\\s+\\d{1,2}) (?P<time>(\\d{2}:?){3}) (?P<host>[a-zA-Z0-9_\\-\\.]+) (?P<ident>[a-zA-Z0-9_\\-]+)(\\[(?P<pid>\\d+)\\])?: "
authLineRegexps = map[string]*regexp.Regexp{
"authAccepted": regexp.MustCompile(authLinePrefix + "Accepted (password|publickey) for (?P<user>.*) from (?P<ipAddress>.*) port"),
"authFailed": regexp.MustCompile(authLinePrefix + "Failed (password|publickey) for (invalid user )?(?P<user>.*) from (?P<ipAddress>.*) port"),
"invalidUser": regexp.MustCompile(authLinePrefix + "Invalid user (?P<user>.*) from (?P<ipAddress>.*) port"),
"notAllowedUser": regexp.MustCompile(authLinePrefix + "User (?P<user>.*) from (?P<ipAddress>.*) not allowed because"),
"connectionClosed": regexp.MustCompile(authLinePrefix + "Connection closed by authenticating user (?P<user>.*) (?P<ipAddress>.*) port"),
"authAccepted": regexp.MustCompile(authLinePrefix + "Accepted (password|publickey) for (?P<user>.*) from (?P<ipAddress>.*) port"),
"authFailed": regexp.MustCompile(authLinePrefix + "Failed (password|publickey) for (invalid user )?(?P<user>.*) from (?P<ipAddress>.*) port"),
"invalidUser": regexp.MustCompile(authLinePrefix + "Invalid user (?P<user>.*) from (?P<ipAddress>.*) port"),
"notAllowedUser": regexp.MustCompile(authLinePrefix + "User (?P<user>.*) from (?P<ipAddress>.*) not allowed because"),
"connectionClosed": regexp.MustCompile(authLinePrefix + "Connection closed by authenticating user (?P<user>.*) (?P<ipAddress>.*) port"),
"sudoIncorrectPasswordAttempts": regexp.MustCompile(authLinePrefix + "[ ]+(?P<user>.*) : (?P<attempts>\\d+) incorrect password attempts ; TTY=(?P<tty>[^ ]+) ; PWD=(?P<pwd>.+) ; USER=(?P<user_as>.*) ; COMMAND=(?P<command>.*)"),
"sudoNotInSudoers": regexp.MustCompile(authLinePrefix + "[ ]+(?P<user>.*) : user NOT in sudoers ; TTY=(?P<tty>[^ ]+) ; PWD=(?P<pwd>.+) ; USER=(?P<user_as>.*) ; COMMAND=(?P<command>.*)"),
"sudoSucceeded": regexp.MustCompile(authLinePrefix + "[ ]+(?P<user>.*) : TTY=(?P<tty>[^ ]+) ; PWD=(?P<pwd>.+) ; USER=(?P<user_as>.*) ; COMMAND=(?P<command>.*)"),
"suSucceeded": regexp.MustCompile(authLinePrefix + "\\(to (?P<user_as>.*)\\) (?P<user>.*) on (?P<tty>[^ ]+)"),
"suFailed": regexp.MustCompile(authLinePrefix + "FAILED SU \\(to (?P<user_as>.*)\\) (?P<user>.*) on (?P<tty>[^ ]+)"),
}
authVentsMetric = promauto.NewCounterVec(prometheus.CounterOpts{
Name: "authlog_events_total",
Expand Down
12 changes: 12 additions & 0 deletions test_data/auth.log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,3 +63,15 @@ Aug 30 15:11:35 hostname sshd[11944]: pam_unix(sshd:auth): authentication failur
Aug 30 15:11:36 hostname sshd[11944]: Failed password for invalid user root from 123.123.12.12 port 46680 ssh2
Apr 30 15:25:05 hostname sshd[11947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.123.12.123 user=root
Apr 30 15:25:06 hostname sshd[11947]: Failed password for root from 123.123.12.123 port 35449 ssh2
Apr 30 15:35:06 hostname sudo: pam_unix(sudo:auth): authentication failure; logname=testuser uid=1000 euid=0 tty=/dev/pts/0 ruser=testuser rhost= user=testuser
Apr 30 15:35:33 hostname sudo: testuser : 3 incorrect password attempts ; TTY=pts/0 ; PWD=/home/testuser ; USER=root ; COMMAND=/bin/ls
Apr 30 15:40:33 hostname sudo: testuser : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/testuser ; USER=root ; COMMAND=/bin/ls
Apr 30 16:47:24 hostname sudo: root : TTY=pts/0 ; PWD=/home/testuser ; USER=root ; COMMAND=/bin/su
Apr 30 16:47:24 hostname sudo: pam_unix(sudo:session): session opened for user root by testuser(uid=0)
Apr 30 16:47:24 hostname su: (to root) testuser on pts/0
Apr 30 16:47:24 hostname su: pam_unix(su:session): session opened for user root by testuser(uid=0)
Apr 30 16:52:59 hostname su: pam_unix(su:auth): authentication failure; logname=testuser uid=1000 euid=0 tty=pts/0 ruser=testuser rhost= user=root
Apr 30 16:53:02 hostname su: FAILED SU (to root) testuser on pts/0
Apr 30 17:52:46 hostname sudo: root : TTY=pts/0 ; PWD=/home/testuser ; USER=root ; COMMAND=/bin/ls
Apr 30 17:52:46 hostname sudo: pam_unix(sudo:session): session opened for user root by testuser(uid=0)
Apr 30 17:52:46 hostname sudo: pam_unix(sudo:session): session closed for user root
Loading