download issue 24 here - Help Net Security

The first tag of interest is the - this
refers to the earlier decoder rules. Any message
that is decoded as PAM is picked up this
rule.
The tag looks for a string that
starts with the word “session”, followed by one
or more other words. If these prerequisites
are met, weʼre ready to grab some information
(in this case the username). We do that by
using a regular expression, hence the
tag that we tell to start after the prematch.
Any information we need from the pattern
we put between round brackets. With the
tag, we tell OSSEC in which order we
find our information. That will become clearer
in a message from which we extract - more
information.
pam
rhost=\S+\s+user=\S+
rhost=(\S+)\s+user=(\S+)
srcip, user
This is where things become interesting. Notice
that the tag doesnʼt contain the
prematch parameter because we want to extract
information from the same string that we
use to match on. From this message we want
to extract the source IP address and the user-
name and we tell OSSEC that the first string
we captured in round brackets is that IP address
and the second one is the username.
Hereafter, everything builds upon the decoders.
Letʼs have a look at the PAM rules.
pam
Grouping of the pam_unix rules.
Every rule gets a unique id, a number between
100 and 99999. The level can be any
number between 0 and 14 - it allows you to
granularly rank alerts by severity. Level 0
means that this event is of no significance as
we use it only to group the pam_unix alerts.
With noalert we specify that no alerts are re-
quired. In the tag we tell OS-
SEC that this rule applies to all messaged decoded
as PAM by our decoder rules and with
we tell everyone who has never
seen an OSSEC rule before what this is
about.
5500
session opened for user
Login session opened.
authentication_success,
Now it gets really exciting! Rule 5501 is a
level 3 event and builds on rule 5500. We look
for the string “session opened for user” to register
a successful login event. OSSEC allows
us to build so-called rule trees - chains of
alerts that allow us exact control about what
gets logged and with which alert level. A good
example would be the following: We want to
be alerted when Chris logs on to the alpha
server at any time, but not if any other users
log on. It would look a little like this:
www.insecuremag.com 60