Implements base functionality for SSH analysis. Generates the ssh.log file.
Namespaces: | GLOBAL, SSH |
---|---|
Imports: | base/utils/directions-and-hosts.bro |
Source File: | /scripts/base/protocols/ssh/main.bro |
SSH::compression_algorithms: set &redef | The set of compression algorithms. |
SSH::disable_analyzer_after_detection: bool &redef | If true, after detection detach the SSH analyzer from the connection to prevent continuing to process encrypted traffic. |
Log::ID: enum | The SSH protocol logging stream identifier. |
SSH::Info: record | |
connection: record | |
likely_server_ports: set &redef |
SSH::log_ssh: event | Event that can be handled to access the SSH record as it is sent on to the logging framework. |
ssh_auth_failed: event | This event is generated when an SSH connection was determined to have had a failed authentication. |
ssh_auth_result: event | This event is generated when a determination has been made about the final authentication result of an SSH connection. |
ssh_server_host_key: event | Event that can be handled when the analyzer sees an SSH server host key. |
Type : |
logged: bool &default = F &optional capabilities: SSH::Capabilities &optional
|
---|
The record type which contains the fields of the SSH log.
Type : | event (rec: SSH::Info) |
---|
Event that can be handled to access the SSH record as it is sent on to the logging framework.
Type : | event (c: connection) |
---|
This event is generated when an SSH connection was determined to have had a failed authentication. This determination is based on packet size analysis, and errs on the side of caution - that is, if there’s any doubt about the authentication failure, this event is not raised.
This event is only raised once per connection.
C : | The connection over which the SSH connection took place. |
---|
See also: ssh_server_version, ssh_client_version, ssh_auth_successful, ssh_auth_result, ssh_auth_attempted, ssh_capabilities, ssh2_server_host_key, ssh1_server_host_key, ssh_server_host_key, ssh_encrypted_packet, ssh2_dh_server_params, ssh2_gss_error, ssh2_ecc_key
Type : | event (c: connection, result: bool, auth_attempts: count) |
---|
This event is generated when a determination has been made about the final authentication result of an SSH connection. This determination is based on packet size analysis, and errs on the side of caution - that is, if there’s any doubt about the result of the authentication, this event is not raised.
This event is only raised once per connection.
C : | The connection over which the SSH connection took place. |
---|---|
Result : | True if the authentication was successful, false if not. |
Auth_attempts : | The number of authentication attempts that were observed. |
See also: ssh_server_version, ssh_client_version, ssh_auth_successful, ssh_auth_failed, ssh_auth_attempted, ssh_capabilities, ssh2_server_host_key, ssh1_server_host_key, ssh_server_host_key, ssh_encrypted_packet, ssh2_dh_server_params, ssh2_gss_error, ssh2_ecc_key
Type : | event (c: connection, hash: string) |
---|
Event that can be handled when the analyzer sees an SSH server host key. This abstracts ssh1_server_host_key and ssh2_server_host_key.
See also: ssh_server_version, ssh_client_version, ssh_auth_successful, ssh_auth_failed, ssh_auth_result, ssh_auth_attempted, ssh_capabilities, ssh2_server_host_key, ssh1_server_host_key, ssh_encrypted_packet, ssh2_dh_server_params, ssh2_gss_error, ssh2_ecc_key