GLOBAL
SSH
Implements base functionality for SSH analysis. Generates the ssh.log file.
Namespaces: | GLOBAL, SSH |
---|---|
Imports: | base/utils/directions-and-hosts.bro |
Source File: | /scripts/base/protocols/ssh/main.bro |
SSH::compression_algorithms : set &redef |
The set of compression algorithms. |
SSH::disable_analyzer_after_detection : bool &redef |
If true, after detection detach the SSH analyzer from the connection to prevent continuing to process encrypted traffic. |
Log::ID : enum |
The SSH protocol logging stream identifier. |
SSH::Info : record |
|
connection : record |
|
likely_server_ports : set &redef |
SSH::log_ssh : event |
Event that can be handled to access the SSH record as it is sent on to the logging framework. |
ssh_auth_failed : event |
This event is generated when an SSH connection was determined to have had a failed authentication. |
ssh_auth_result : event |
This event is generated when a determination has been made about the final authentication result of an SSH connection. |
ssh_server_host_key : event |
Event that can be handled when the analyzer sees an SSH server host key. |
SSH::Info
Type: |
logged: capabilities:
|
---|
The record type which contains the fields of the SSH log.
SSH::log_ssh
Type: | event (rec: SSH::Info ) |
---|
Event that can be handled to access the SSH record as it is sent on to the logging framework.
ssh_auth_failed
Type: | event (c: connection ) |
---|
This event is generated when an SSH connection was determined to have had a failed authentication. This determination is based on packet size analysis, and errs on the side of caution - that is, if there’s any doubt about the authentication failure, this event is not raised.
This event is only raised once per connection.
C: | The connection over which the SSH connection took place. |
---|
See also: ssh_server_version
, ssh_client_version
, ssh_auth_successful
, ssh_auth_result
, ssh_auth_attempted
, ssh_capabilities
, ssh2_server_host_key
, ssh1_server_host_key
, ssh_server_host_key
, ssh_encrypted_packet
, ssh2_dh_server_params
, ssh2_gss_error
, ssh2_ecc_key
ssh_auth_result
Type: | event (c: connection , result: bool , auth_attempts: count ) |
---|
This event is generated when a determination has been made about the final authentication result of an SSH connection. This determination is based on packet size analysis, and errs on the side of caution - that is, if there’s any doubt about the result of the authentication, this event is not raised.
This event is only raised once per connection.
C: | The connection over which the SSH connection took place. |
---|---|
Result: | True if the authentication was successful, false if not. |
Auth_attempts: | The number of authentication attempts that were observed. |
See also: ssh_server_version
, ssh_client_version
, ssh_auth_successful
, ssh_auth_failed
, ssh_auth_attempted
, ssh_capabilities
, ssh2_server_host_key
, ssh1_server_host_key
, ssh_server_host_key
, ssh_encrypted_packet
, ssh2_dh_server_params
, ssh2_gss_error
, ssh2_ecc_key
ssh_server_host_key
Type: | event (c: connection , hash: string ) |
---|
Event that can be handled when the analyzer sees an SSH server host
key. This abstracts ssh1_server_host_key
and
ssh2_server_host_key
.
See also: ssh_server_version
, ssh_client_version
, ssh_auth_successful
, ssh_auth_failed
, ssh_auth_result
, ssh_auth_attempted
, ssh_capabilities
, ssh2_server_host_key
, ssh1_server_host_key
, ssh_encrypted_packet
, ssh2_dh_server_params
, ssh2_gss_error
, ssh2_ecc_key