Hi Pablo,<div><br></div><div>Before anything, thank you very much for this very clear and prompt answer.</div><div>You are absolutely right. I've updated my rules to trigger an alert after 2 bad logins and have done the tests again within the same session:</div>
<div><br></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div><b>$ ftp 192.168.100.35</b></div></div><div><div><b>Connected to 192.168.100.35.</b></div></div>
<div><div><b>220 (vsFTPd 2.0.7)</b></div></div><div><div><b>Name (192.168.100.35:sdamaye): root</b></div></div><div><div><b>331 Please specify the password.</b></div></div><div><div><b>Password:</b></div></div><div><div><b>530 Login incorrect.</b></div>
</div><div><div><b>Login failed.</b></div></div><div><div><b>ftp> user root</b></div></div><div><div><b>331 Please specify the password.</b></div></div><div><div><b>Password: </b></div></div><div><div><b>530 Login incorrect.</b></div>
</div><div><div><b>Login failed.</b></div></div></blockquote><div><div><br></div><div>And.... It has triggered the alert:</div><div><br></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;">
<div><div><b>03/16/2011-17:35:31.560382 [**] [1:2:0] More than two Failed Logins! [**] [Classification: (null)] [Priority: 3] {TCP} <a href="http://192.168.100.35:21">192.168.100.35:21</a> -> <a href="http://192.168.100.37:3656">192.168.100.37:3656</a></b></div>
</div></blockquote><div><br></div><div>Thanks very much for your help.</div><div>BTW, the online documentation seems outdated (e.g. the syntax of flowint as specified on the wiki doesn't work and doesn't either correspond to the one used in the working rules).</div>
<div><br></div><div><br><div class="gmail_quote">2011/3/16 Pablo <span dir="ltr"><<a href="mailto:pablo.rincon.crespo@gmail.com">pablo.rincon.crespo@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hi Sebastien. The rules look fine. The problem is that looking at the<br>
pcap, there are different flows per login, as follows:<br>
220 (vsFTPd 2.0.7)<br>
USER root<br>
331 Please specify the password.<br>
PASS a<br>
530 Login incorrect.<br>
SYST<br>
530 Please login with USER and PASS.<br>
QUIT<br>
221 Goodbye.<br>
<br>
After the QUIT command, the connection is closed, so the flow instance<br>
is destroyed after that, and the flowint vars will be released too.<br>
Then a new connection is set for another login retry, and Suricata<br>
create a new flow instance, but flowint vars live in the context of a<br>
flow. To accomplish this, we need Global Vars (another feature in the<br>
roadmap of the project), that's the ability to create variables that<br>
exists in the context of 2 ip addresses, regardless of ports and IP<br>
sessions id's/streams, flow instances...<br>
<br>
That will make suricata able to use a simple logical correlation,<br>
something like "an exploit has been detected on the fly" on one flow,<br>
and after that, the flow is destroyed. Ok, but we have set a<br>
var/int/bit between those hosts indicating that intention, so we don't<br>
mind if the flow was destroyed because we will keep that<br>
information/vars on the context of that pair of hosts. So after that,<br>
if we get "a cmd.exe banner has been matched", between those hosts,<br>
then we will be able to cross it with the previous attack, alerting<br>
that the host might be compromised on a more reliable way, tracking<br>
the intent and response even on different connections.<br>
<br>
<br>
2011/3/16 Sebastien Damaye <<a href="mailto:sebastien.damaye@gmail.com">sebastien.damaye@gmail.com</a>>:<br>
<div><div></div><div class="h5">> Hi team,<br>
> I'm currently testing Suricata in the shape of a comparative analysis with<br>
> Snort. I've been in contact with Anoop Saldanha who advised me to post my<br>
> question to the dev team mailing list.<br>
> Here is my issue:<br>
> I'm not sure how to use flowint to trigger an alert after 3 bad logins on an<br>
> FTP account.<br>
> Here are my rules:<br>
><br>
> alert tcp any any -> any any (msg:"Counting Failed Logins";<br>
> content:"incorrect"; flowint: username, notset; flowint:username, =, 1;<br>
> noalert; sid:1;)<br>
> alert tcp any any -> any any (msg:"More than three Failed Logins!";<br>
> content:"incorrect"; flowint: username, isset; flowint:username, +, 1;<br>
> flowint:username, >, 3; sid:2;)<br>
><br>
> I have tested to track the string "incorrect" to ensure it was correct:<br>
><br>
> alert tcp any any -> any any (msg:"test_incorrect"; content:"incorrect";<br>
> sid:1;)<br>
><br>
> And it works fine. Here is the output in /var/log/suricata/fast.log:<br>
><br>
> 03/16/2011-14:25:23.146103 [**] [1:1:0] test_incorrect [**]<br>
> [Classification: (null)] [Priority: 3] {TCP} <a href="http://192.168.100.35:21" target="_blank">192.168.100.35:21</a> -><br>
> <a href="http://192.168.100.37:37082" target="_blank">192.168.100.37:37082</a><br>
><br>
> You will find attached to this mail a pcap capture realized with tcpdump<br>
> (tcpdump -lnx -s 1500 -i eth0 -w badlogins.cap 'port 21') to track the<br>
> failed authentication attempts.<br>
> I'm also joining my suricata.yaml configuration in case you would need it...<br>
> I have the feeling that the counter is not auto-incrementing...<br>
> Many thanks in advance for your help.<br>
> --<br>
> Cordialement/Regards,<br>
> Sébastien Damaye<br>
> <a href="http://www.aldeid.com" target="_blank">http://www.aldeid.com</a><br>
><br>
><br>
</div></div>> _______________________________________________<br>
> Oisf-devel mailing list<br>
> <a href="mailto:Oisf-devel@openinfosecfoundation.org">Oisf-devel@openinfosecfoundation.org</a><br>
> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
><br>
><br>
<br>
<br>
<br>
--<br>
<br>
Best regards,<br>
<font color="#888888"><br>
--<br>
Pablo Rincón Crespo<br>
Security researcher and developer<br>
Open Information Security Foundation - <a href="http://www.openinfosecfoundation.org" target="_blank">http://www.openinfosecfoundation.org</a><br>
Emerging Threats Pro, INC - <a href="http://www.emergingthreatspro.com" target="_blank">http://www.emergingthreatspro.com</a><br>
------------------------------------<br>
</font></blockquote></div><br><br clear="all"><br>-- <br>Cordialement/Regards,<div><br></div><div>Sébastien Damaye</div><div><a href="http://www.aldeid.com" target="_blank">http://www.aldeid.com</a><br></div><br>
</div>