1

#irk     = irc://irc-test/test

     2

     3

# TODO: implements meta-attrs across rule tree to classify hosts?

     4

#[tag]

     5

#    [[puppetmaster]]

     6

#        host    = guru

     7

#

     8

#    [[auth-high]]

     9

#        host    = guru

    10

    11

# auth on normal hosts

    12

[auth]

    13

    facility    = auth

    14

    15

    [[sudo]]

    16

    program     = sudo

    17

    pattern     = (?P<login>\S+) : TTY=(?P<tty>\S+) ; PWD=(?P<pwd>.+?) ; USER=(?P<user>\S+) ; (?:ENV=(?P<env>.+?) ; )?COMMAND=(?P<command>.*)

    18

    format      = {login}:{tty} - {user}@{host}:{pwd} - {command!r}

    19

    20

    # ignore puppet readshadow on puppetmasters

    21

    [[[puppet_readshadow]]]

    22

    login       = puppet

    23

    user        = root

    24

    command     = /usr/bin/getent shadow \w+

    25

    format      = # ignore

    26

    27

    [[[env]]]

    28

    env         = .+

    29

    format      = {login}:{tty} - {user}@{host}:{pwd} - {env}{command!r}

    30

    31

    [[sudo-unknown]]

    32

    program     = sudo

    33

    format      = {host} {msg}

    34

    35

# auth on high-sec hosts

    36

[auth-high]

    37

    host        = .+

    38

    facility    = auth

    39

    40

    # TODO: pubkey, failures?

    41

    [[ssh]]

    42

    program     = sshd

    43

    pattern     = Accepted password for (?P<user>\S+) from (?P<ip>\S+) port (?P<port>\S+) (?P<proto>\S+)

    44

    format      = SSH login for {user}@{host} from {ip}

    45

    46

    [[cron]]

    47

    program     = cron

    48

    format      = # ignore

    49

    50

    [[su_nobody]]

    51

    program     = su

    52

    pattern     = Successful su for nobody by root|\+ \?\?\? root:nobody

    53

    format      = # ignore

    54

    55

    [[all]]

    56

    format      = {host} {msg}

    57

    58

# user

    59

[user]

    60

    facility    = user

    61

    62

    [[puppet]]

    63

    program     = puppet

    64

    format      = {host} {msg}

    65