From bf0c98976d4997e2f8c491b9acd292e3db45f3b7 Mon Sep 17 00:00:00 2001 From: Alexandr Garaga Date: Fri, 27 Jan 2017 18:13:50 +0700 Subject: [PATCH 1/4] Add cpanel decoders and rules. --- etc/decoder.xml | 64 +++++++++++++++++++++++++++++++ etc/ossec-server.conf | 17 +++++++++ etc/rules/cpanel_rules.xml | 78 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 159 insertions(+) create mode 100644 etc/rules/cpanel_rules.xml diff --git a/etc/decoder.xml b/etc/decoder.xml index 569858346..be0a17fca 100755 --- a/etc/decoder.xml +++ b/etc/decoder.xml @@ -2896,4 +2896,68 @@ Jul 26 13:57:56 mx1.example.org outbound/smtp: 127.0.0.1 1406297159-06f4a35b4df2 srcip,url + + + + ^[\S+ \S+ \S+] info [cpsrvd] \S+ - + info [cpsrvd] (\S+) - (\S+) + srcip,user + + + + + + postgresql_log + ^info [cpsrvd] \S+ - + info [cpsrvd] (\S+) - (\S+) + srcip,user + + + + + + web-accesslog + FAILED LOGIN + ^(\S+) \S+ (\S+) + srcip,user + + + + + ^[\S+ \S+ \S+] info [cpsrvd] \S+ PURGE + info [cpsrvd] (\S+) \S+ (\w+): + srcip,user + + + + postgresql_log + ^info [cpsrvd] \S+ PURGE + info [cpsrvd] (\S+) \S+ (\w+): + srcip,user + + diff --git a/etc/ossec-server.conf b/etc/ossec-server.conf index dbee6687a..6bea92f33 100755 --- a/etc/ossec-server.conf +++ b/etc/ossec-server.conf @@ -72,6 +72,7 @@ sysmon_rules.xml opensmtpd_rules.xml local_rules.xml + cpanel_rules.xml @@ -201,4 +202,20 @@ apache /var/www/logs/error_log + + + syslog + /usr/local/cpanel/logs/login_log + + + + syslog + /usr/local/cpanel/logs/access_log + + + + syslog + /usr/local/cpanel/logs/session_log + + diff --git a/etc/rules/cpanel_rules.xml b/etc/rules/cpanel_rules.xml new file mode 100644 index 000000000..160d6176d --- /dev/null +++ b/etc/rules/cpanel_rules.xml @@ -0,0 +1,78 @@ + + + + + + + + 2501 + cpanel-login + FAILED LOGIN + Possible attack on the cpanel services + + + + 50500 + postgresql_log + FAILED LOGIN + Possible attack on the cpanel services + + + + 2501 + web-accesslog + FAILED LOGIN + Possible attack on the cpanel services + + + + + 11001 + Possible breakin attempt + + + + 11000 + Possible breakin attempt + + + + 11002 + Possible breakin attempt + + + + cpanel-login + SUCCESS LOGIN + Cpanel login success + + + + 50500 + postgresql_log + SUCCESS LOGIN + Cpanel login success + + + + cpanel-session + PURGE + Cpanel session purge + + + + 50500 + postgresql_log + PURGE + Cpanel session purge + + + From 8d6a66bb8f290baf747e0fb3a52c7809458c1044 Mon Sep 17 00:00:00 2001 From: Alexandr Garaga Date: Mon, 30 Jan 2017 16:55:50 +0700 Subject: [PATCH 2/4] Fix broken cpanel-access-failed decoder failing tests --- etc/decoder.xml | 3 +-- etc/rules/cpanel_rules.xml | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/etc/decoder.xml b/etc/decoder.xml index be0a17fca..f7e59b22b 100755 --- a/etc/decoder.xml +++ b/etc/decoder.xml @@ -2936,8 +2936,7 @@ Jul 26 13:57:56 mx1.example.org outbound/smtp: 127.0.0.1 1406297159-06f4a35b4df2 --> - web-accesslog - FAILED LOGIN + ^\S+ \S+ \S+ [\d\d/\d\d/\d\d\d\d:\d\d:\d\d:\d\d \S*\d+] "\S+" FAILED LOGIN ^(\S+) \S+ (\S+) srcip,user diff --git a/etc/rules/cpanel_rules.xml b/etc/rules/cpanel_rules.xml index 160d6176d..28ed5b1ae 100644 --- a/etc/rules/cpanel_rules.xml +++ b/etc/rules/cpanel_rules.xml @@ -28,7 +28,7 @@ 2501 - web-accesslog + cpanel-access-failed FAILED LOGIN Possible attack on the cpanel services From fc5939deee2711e8e2000f85205209283572f510 Mon Sep 17 00:00:00 2001 From: Alexandr Garaga Date: Mon, 30 Jan 2017 17:11:42 +0700 Subject: [PATCH 3/4] Add support for cpanel rules to other setup types: agent, local, hybrid. --- etc/ossec-agent.conf | 16 ++++++++++++++++ etc/ossec-local.conf | 17 +++++++++++++++++ etc/ossec.conf | 19 ++++++++++++++++++- 3 files changed, 51 insertions(+), 1 deletion(-) diff --git a/etc/ossec-agent.conf b/etc/ossec-agent.conf index 662a38229..f7bfe715b 100755 --- a/etc/ossec-agent.conf +++ b/etc/ossec-agent.conf @@ -65,4 +65,20 @@ apache /var/www/logs/error_log + + + syslog + /usr/local/cpanel/logs/login_log + + + + syslog + /usr/local/cpanel/logs/access_log + + + + syslog + /usr/local/cpanel/logs/session_log + + diff --git a/etc/ossec-local.conf b/etc/ossec-local.conf index 2864e7590..f8f2f21c0 100755 --- a/etc/ossec-local.conf +++ b/etc/ossec-local.conf @@ -74,6 +74,7 @@ sysmon_rules.xml opensmtpd_rules.xml local_rules.xml + cpanel_rules.xml @@ -197,4 +198,20 @@ apache /var/www/logs/error_log + + + syslog + /usr/local/cpanel/logs/login_log + + + + syslog + /usr/local/cpanel/logs/access_log + + + + syslog + /usr/local/cpanel/logs/session_log + + diff --git a/etc/ossec.conf b/etc/ossec.conf index e65c97d43..226da1421 100755 --- a/etc/ossec.conf +++ b/etc/ossec.conf @@ -32,7 +32,8 @@ dropbear_rules.xml sysmon_rules.xml opensmtpd_rules.xml - + cpanel_rules.xml + @@ -160,4 +161,20 @@ apache /var/www/logs/error_log + + + syslog + /usr/local/cpanel/logs/login_log + + + + syslog + /usr/local/cpanel/logs/access_log + + + + syslog + /usr/local/cpanel/logs/session_log + + From fbf75a82cbd0b01d47e19d32501b7ec302355a2c Mon Sep 17 00:00:00 2001 From: Alexandr Garaga Date: Fri, 3 Feb 2017 16:23:40 +0700 Subject: [PATCH 4/4] Fix cpanel rules and decoders. This fix should detect successful logins from cpanel session_log instead of login_log and thus work on older versions of cpanel. In addition, the logout decoders and rules are made more specific since there are other 'PURGE' events in cpanel session_log with a different format and semantics than logout events. --- etc/decoder.xml | 65 +++++++++++++++++++++++--------------- etc/rules/cpanel_rules.xml | 18 +++++------ 2 files changed, 49 insertions(+), 34 deletions(-) diff --git a/etc/decoder.xml b/etc/decoder.xml index 94591968d..366698457 100755 --- a/etc/decoder.xml +++ b/etc/decoder.xml @@ -2942,15 +2942,15 @@ Jul 26 13:57:56 mx1.example.org outbound/smtp: 127.0.0.1 1406297159-06f4a35b4df2 ^SMTP call from [(\S+)]:\d+ dropped: too many syntax or protocol errors srcip + - - ^[\S+ \S+ \S+] info [cpsrvd] \S+ - + + ^[\S+ \S+ \S+] info [cpsrvd] \.+FAILED LOGIN info [cpsrvd] (\S+) - (\S+) srcip,user @@ -2958,50 +2958,65 @@ Jul 26 13:57:56 mx1.example.org outbound/smtp: 127.0.0.1 1406297159-06f4a35b4df2 - + postgresql_log - ^info [cpsrvd] \S+ - + ^info [cpsrvd] \.+FAILED LOGIN info [cpsrvd] (\S+) - (\S+) srcip,user - ^\S+ \S+ \S+ [\d\d/\d\d/\d\d\d\d:\d\d:\d\d:\d\d \S*\d+] "\S+" FAILED LOGIN + web-accesslog + FAILED LOGIN ^(\S+) \S+ (\S+) - srcip,user + srcip,user + + + + + + ^[\S+ \S+ \S+] info [cpsrvd] \S+ NEW + info [cpsrvd] (\S+) \S+ (\w+): + srcip,user + + + + postgresql_log + ^info [cpsrvd] \S+ NEW + info [cpsrvd] (\S+) \S+ (\w+): + srcip,user - - ^[\S+ \S+ \S+] info [cpsrvd] \S+ PURGE + + ^[\S+ \S+ \S+] info [cpsrvd] \S+ PURGE \S+ logout$ info [cpsrvd] (\S+) \S+ (\w+): srcip,user - + postgresql_log - ^info [cpsrvd] \S+ PURGE + ^info [cpsrvd] \S+ PURGE \S+ logout$ info [cpsrvd] (\S+) \S+ (\w+): srcip,user diff --git a/etc/rules/cpanel_rules.xml b/etc/rules/cpanel_rules.xml index 28ed5b1ae..5dca9ee01 100644 --- a/etc/rules/cpanel_rules.xml +++ b/etc/rules/cpanel_rules.xml @@ -14,7 +14,7 @@ 2501 - cpanel-login + cpanel-login-failed FAILED LOGIN Possible attack on the cpanel services @@ -50,29 +50,29 @@ - cpanel-login - SUCCESS LOGIN + cpanel-login-success + NEW Cpanel login success 50500 postgresql_log - SUCCESS LOGIN + NEW Cpanel login success - cpanel-session - PURGE - Cpanel session purge + cpanel-session-logout + PURGE \S+ logout + Cpanel session logout 50500 postgresql_log - PURGE - Cpanel session purge + PURGE \S+ logout + Cpanel session logout