Hello,
I'm sure this is a very simple problem, but I'm having trouble thinking of an efficient way to do the following:
given a large centralized ssh-log, one file on a syslog server, not separated by machines (I wish it were), that looks something like this:
Sep 27 16:20:56 machine-name sshd[3106]: Failed password for invalid user admin from 212.55.255.219 port 16808 ssh2
... etc...
Sep 27 16:22:31 machine-name sshd[31049]: Accepted password for vivianu from 207.180.183.178 port 55902 ssh2
....etc....
Sep 27 16:22:41 machine-name sshd[19032]: Failed password for root from 212.55.255.219 port 11368 ssh2
I want to parse through and report on any "root" ssh login attempts, and also report on multiple failed attempts for invalid accounts that exceed "x" times e.g. detect brute force attempts (I want to use denyhosts to do the 2 things above, but I'm still being asked for a script to parse the centralized log).
I'd also want to detect successful logins by the same user to multiple machines, as in someone probing the network.
I know I'll need to open the file, split the fields and store in some type of hash, just not sure if the machine name should be the hash, and things like month,day,time,password failed|accepted,incoming IP, etc. should each be keys w/ the split fields from the log being the values, etc.
any help appreciated.
---------- Post updated at 12:09 PM ---------- Previous update was at 10:57 AM ----------
I'll answer my own question and start looking at Log::Statistics