1# 2# sshd.py 3# 4# Find number of ssh logins and authorised users (uses /var/log/auth.log) 5# 6# NOTE: This file is now deprecated in favour of the newer journald mechanism 7# used in sshd-journald.py. This parser is still functional but is slower and 8# has less features. Please switch over if possible. 9# 10 11import re 12 13from logparse.formatting import* 14from logparse.util import readlog, resolve 15from logparse import config 16from logparse.load_parsers import Parser 17 18classSshd(Parser): 19 20def__init__(self): 21super().__init__() 22 self.name ="sshd" 23 self.info ="Find number of ssh logins and authorised users (uses /var/log/auth.log)" 24 25defparse_log(self): 26 27 logger.warning("NOTE: This sshd parser is now deprecated. Please use sshd-journald if possible.") 28 29 logger.debug("Starting sshd section") 30 section =Section("ssh") 31 logger.debug("Searching for matches in{0}".format(config.prefs.get("logs","auth"))) 32 matches = re.findall('.*sshd.*Accepted publickey for .* from .*',readlog(config.prefs.get("logs","auth")))# get all logins 33 logger.debug("Finished searching for logins") 34 35 logger.debug("Searching for matches in{0}".format(config.prefs.get("logs","auth"))) 36 authlog =readlog(config.prefs.get("logs","auth")) 37 38 matches = re.findall('.*sshd.*Accepted publickey for .* from .*', authlog)# get all logins 39 invalid_matches = re.findall(".*sshd.*Invalid user .* from .*", authlog) 40 root_matches = re.findall("Disconnected from authenticating user root", authlog) 41 logger.debug("Finished searching for logins") 42 43 users = []# list of users with format [username, number of logins] for each item 44 data = [] 45 num =len(matches)# total number of logins 46for match in matches: 47 entry = re.search('^.*publickey\sfor\s(\w*)\sfrom\s(\S*)', match)# [('user', 'ip')] 48 49 user = entry.group(1) 50 ip = entry.group(2) 51 52 userhost = user +'@'+resolve(ip, fqdn=config.prefs.get("sshd","sshd-resolve-domains")) 53 users.append(userhost) 54 logger.debug("Parsed list of authorised users") 55 56 auth_data =Data(subtitle=plural('login', num) +' from', items=users) 57 58if(len(auth_data.items) ==1):# if only one user, do not display no of logins for this user 59 logger.debug("found "+str(len(matches)) +" ssh logins for user "+ users[0]) 60 auth_data.subtitle +=' '+ auth_data.items[0] 61 auth_data.orderbyfreq() 62 auth_data.truncl(config.prefs.getint("logparse","maxlist")) 63 logger.debug("Found "+str(len(matches)) +" ssh logins for users "+str(data)) 64 section.append_data(auth_data) 65 66 invalid_users = [] 67for match in invalid_matches: 68 entry = re.search('^.*Invalid user (\S+) from (\S+).*', match)# [('user', 'ip')] 69 70try: 71 user = entry.group(1) 72 ip = entry.group(2) 73except:# blank user field 74continue 75 76 userhost = user +'@'+ ip 77 invalid_users.append(userhost) 78 logger.debug("Parsed list of invalid users") 79 invalid_data =Data(subtitle=plural("attempted login",len(invalid_matches)) +" from "+plural("invalid user",len(invalid_users), print_quantity=False), items=invalid_users) 80if(len(invalid_data.items) ==1):# if only one user, do not display no of logins for this user 81 logger.debug("Found "+str(len(invalid_matches)) +" SSH login attempts for invalid user "+ invalid_users[0]) 82 invalid_data.subtitle +=' '+ invalid_data.items[0] 83 invalid_data.orderbyfreq() 84 invalid_data.truncl(config.prefs.get("logparse","maxlist")) 85 logger.debug("Found "+str(len(invalid_matches)) +" SSH login attempts for invalid users "+str(data)) 86 section.append_data(invalid_data) 87 88 logger.debug("Found{0}attempted logins for root".format(str(len(root_matches)))) 89 90 section.append_data(Data(subtitle=plural("attempted login",str(len(root_matches))) +" for root")) 91 92 logger.info("Finished sshd section") 93return section