#audit log

ISO 27001 Annex : A.12.6  Technical Vulnerability Management Its objective is to avoid technological vulnerabilities from being exploited.

A.12.6.1  Management of Technical Vulnerabilities

ISO 27001 Annex : A.12.5 Control of Operational Software Its objective is to ensure operating system integrity.

A.12.5.1  Installation of Software on Operational Systems

Control- To control the installation of software on operating systems, procedures should be implemented.

Had an intersting start to the day, when trying to debug an unexpected slowness in performance, tried to use tcpdump, and got some ssh connections to an unexpected ip address.

Existing security measures

Let me add my sshd is configured in the following security enhancing ways:

Disable password login. i.e. login only through authorized public key. This makes it irrelevant if someone knows my password. Logging in remotely requires you know the private key, like this in sshd_config:

PasswordAuthentication no

Disable root login. regardless of the above, do not permit root login from sshd, i.e.:

PermitRootLogin no

Additionally send a banner on ssh login. Not quite sure why this is recommended, but my guess is that this may prevent automatic detection of login success. But then if this true, the login banner should be same as a failed login response :-)

What is the connection in tcpdump doing?

Now going back to the tcpdump. The log had a few lines like this:

05:32:35.950912 IP 213.80.224.38.52649 > chakra.ssh: Flags [P.], seq 1:24, ack 1, win 2720, options [nop,nop,TS val 34981273 ecr 65564289], length 23 05:32:35.953602 IP chakra.ssh > 213.80.224.38.52649: Flags [.], seq 24:1372, ack 24, win 227, options [nop,nop,TS val 65564877 ecr 34981273], length 1348

The problem was why IP 213.80.224.38 was connected to my box? Geo IP shows it is from Russia http://www.geoipview.com/?q=213.80.224.38&x=0&y=0

The next steps were quite obvious 1. Stop sshd ( service sshd stop ) 2. Analyze the audit log (/var/log/audit/audit.log)

The audit log had an apparently troublesome entry like:

type=CRYPTO_KEY_USER msg=audit(1434101555.951:10101): pid=11213 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=c4:80:ba:39:6d:f1:be:fc:c0:39:f6:9d:fa:97:4a:23 direction=? spid=11213 suid=0 exe="/usr/sbin/sshd" hostname=? addr=213.80.224.38 terminal=? res=success'

Are my ssh keys compromised

It turns out to be a false alarm. See the fp="" pattern, which shows the fingerprint of the key attempting the login.

Is this a key I authorized? Simple to tell. Just cat all the authorized keys on the system onto a file in /tmp. And do the following:

split -l 1 keys ls x?? | while read name; do ssh-keygen -lf $name; done

Fortunately none of the fingerprints matched the one found in the audit log line.

So what happened?

It turns out the line to search for successful login is not the CRYPTO_KEY_USER line, but a line with type=USER_LOGIN . The following command had only a few valid entries which I could verify:

cat audit.log* | grep USER_LOGIN | grep -v 'res=failed'

But what about the failed logins? There were several, including from the IP address in 213.80.224.38 faithfully trying to connect from Russia at regular intervals.

And the tcpdump line? Well a failed ssh login attempt does include a successful tcp connection to sshd. I believe thats what was observed. More so because one can set up a failed login attempt and observe these exact entries in the auudit log and the tcpdump output.

Puzzle

Which brings us to the puzzle. Why would anyone spend network bandwidth trying to ssh login with a ssh key ? (The chances I generated the same key as they have are too close to 0 to even imagine.)

Place your opening curation after this and then delete this text:

New security plugins for WordPress continue to be released at a steady clip. The plugin featured here is a new addition to the array of available WordPress security plugins. Below you…