Re: Assistance with login rule

[Joel Esler <jesler () sourcefire com>]

On Sun, Jul 5, 2009 at 10:18 PM, Eoin Miller <
eoin.miller () trojanedbinaries com> wrote:

> Paul Melson wrote:
> > On Sun, Jul 5, 2009 at 7:37 PM, r s<wera711 () gmail com> wrote:
> >
> > > Hi,
> > >
> > > I'm trying to write a snort rule that can examine users trying to login
> to
> > > our cisco equipment with the following user names: "peake" and
> "emergency"
> > > The subnet of the devices is 172.16.1.0/24. Am I close with this rule:
> > >
> > > alert tcp any -> 172.16.1.0/24 22 (content:"peake | emergency";
> > > msg: "CISCO LOGIN DETECTED !":)
> >
> > You're not going to be able to sniff username out of SSH (port 22).
> >
> > PaulM
> What he said. Better to have your devices log to a syslog server and
> then monitor those logs with something else, like swatch.

Aside from that, you can't do "Or" statements ( peake | emergency ) in a
content match.  You can only do that operation in a regular expression, or
"pcre" operator.

But Paul is right, you can't get a username out of an encrypted session

J
-- 
joel esler | Sourcefire | AIM: eslerjoel | 302-223-5974

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users