1

#irk     = irc://syslog@irc-test/test

     2

     3

# TODO: implements meta-attrs across rule tree to classify hosts?

     4

#[tag]

     5

#    [[puppetmaster]]

     6

#        host    = guru

     7

#

     8

#    [[auth-high]]

     9

#        host    = guru

    10

    11

# auth on normal hosts

    12

[auth]

    13

    facility    = auth*

    14

    15

    [[pam]]

    16

    pattern     = (?P<pam>pam_\w+)\((?P<pam_service>.+?):(?P<pam_type>.+?)\): (?P<msg>.+)

    17

    18

    # at least debian wheezy's pam_unix syslogs session open/close at LOG_INFO

    19

    [[[pam-sudo]]]

    20

    pam_service = sudo

    21

    severity    = info

    22

    format      = # ignore

    23

    24

    [[sudo]]

    25

    program     = sudo

    26

    pattern     = (?P<login>\S+) : TTY=(?P<tty>\S+) ; PWD=(?P<pwd>.+?) ; USER=(?P<user>\S+) ; (?:ENV=(?P<env>.+?) ; )?COMMAND=(?P<command>.*)

    27

    format      = {login}:{tty} - {user}@{host}:{pwd} - {command!r}

    28

    29

    # ignore puppet readshadow on puppetmasters

    30

    [[[puppet_readshadow]]]

    31

    login       = puppet

    32

    user        = root

    33

    command     = /usr/bin/getent shadow \w+

    34

    format      = # ignore

    35

    36

    [[[env]]]

    37

    env         = .+

    38

    format      = {login}:{tty} - {user}@{host}:{pwd} - {env}{command!r}

    39

    40

    [[sudo-unknown]]

    41

    program     = sudo

    42

    format      = {host} {msg}

    43

    44

# auth on high-sec hosts

    45

[auth-high]

    46

    host        = .+

    47

    facility    = auth*

    48

    49

    # TODO: pubkey, failures?

    50

    [[ssh]]

    51

    program     = sshd

    52

    pattern     = Accepted (?P<auth>.+?) for (?P<user>\S+) from (?P<ip>\S+) port (?P<port>\S+) (?P<proto>\S+)

    53

    format      = SSH {auth} login for {user}@{host} from {ip}

    54

    55

    [[cron]]

    56

    program     = cron

    57

    format      = # ignore

    58

    59

    [[su_nobody]]

    60

    program     = su

    61

    pattern     = Successful su for nobody by root|\+ \?\?\? root:nobody

    62

    format      = # ignore

    63

    64

    [[all]]

    65

    format      = {host} {msg}

    66

    67

# user

    68

[user]

    69

    facility    = user

    70

    71

    [[puppet]]

    72

    program     = puppet

    73

    format      = {host} {msg}

    74