openssh-normalize.rulebase

# Sagan openssh-normalize.rulebase
# Copyright (c) 2009-2012, Quadrant Information Security <www.quadrantsec.com>
# All rights reserved.
#
# This file is used in conjunction with liblognorm.
#
# Please submit any custom rules or ideas to sagan-submit@quadrantsec.com or the sagan-sigs mailing list
#
#*************************************************************
#  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
#  following conditions are met:
#
#  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following
#    disclaimer.
#  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
#    following disclaimer in the documentation and/or other materials provided with the distribution.
#  * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
#    from this software without specific prior written permission.
#
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
#  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
#  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
#  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
#  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#*************************************************************

prefix=
rule=: Invalid user %username:word% from %src-ip:ipv4%
rule=: Failed %-:word% for invalid user %username:word% from %src-ip:ipv4% port %src-port:number% ssh2
rule=: Accepted keyboard-interactive/pam for %username:word% from %src-ip:ipv4% port %src-port:number% ssh2
rule=: Accepted password for %username:word% from %src-ip:ipv4% port %src-port:number% ssh2
rule=: error: PAM: Authentication failure for %username:word% from %src-ip:ipv4%
rule=: error: PAM: Authentication failure for %username:word% from %src-host:word%
rule=: pam_unix(sshd:auth): authentication failure; logname= uid=%uid:number% euid=%euid:number% tty=ssh ruser= rhost=%src-ip:ipv4%  user=%username:word%
rule=: pam_unix(sshd:auth): authentication failure; logname= uid=%uid:number% euid=%euid:number% tty=ssh ruser= rhost=%src-ip:ipv4%
rule=: PAM %anumber:number% more authentication failure; logname= uid=%uid:number% euid=%euid:number% tty=ssh ruser= rhost=%src-ip:ipv4%
rule=: PAM %anumber:number% more authentication failure; logname= uid=%uid:number% euid=%euid:number% tty=ssh ruser= rhost=%src-ip:ipv4% user=%username:word%
rule=:PAM %anumber:number% more authentication failures; logname= uid=%uid:number% euid=%euid:number% tty=ssh ruser= rhost=%src-ip:ipv4%
rule=:PAM %anumber:number% more authentication failures; logname= uid=%uid:number% euid=%euid:number% tty=ssh ruser= rhost=%src-ip:ipv4% user=%username:word%
rule=: Accepted publickey for %username:word% from %src-ip:ipv4% port %src-port:number% ssh2
rule=: error: PAM: Authentication failure for illegal user %username:word% from %src-ip:ipv4%
rule=: Failed password for %username:word% from %src-ip:ipv4% port %src-port:number% ssh2
rule=: Accepted gssapi-with-mic for %username:word% from %src-ip:ipv4% port %src-port:number% ssh2
rule=: Accepted password for %username:word% from %src-ip:ipv6% port %src-port:number% ssh2
rule=: error: PAM: Authentication failure for %username:word% from %src-ip:ipv6%
rule=: error: PAM: Authentication failure for %username:word% from %src-host:word%
rule=: pam_unix(sshd:auth): authentication failure; logname= uid=%uid:number% euid=%euid:number% tty=ssh ruser= rhost=%src-ip:ipv6%  user=%username:word%
rule=: pam_unix(sshd:auth): authentication failure; logname= uid=%uid:number% euid=%euid:number% tty=ssh ruser= rhost=%src-ip:ipv6%