CyberMind-FR
22b344225c
- Add CGI hook to capture client IP during failed auth attempts - Add JavaScript hook to intercept ubus session.login failures - Add rpcd plugin for ubus-based auth logging - Update CrowdSec parser for case-insensitive matching - Inject JS hook into LuCI theme headers on install This enables CrowdSec to detect and block brute-force attacks on the LuCI web interface, which previously only logged successful authentications. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
24 lines
829 B
YAML
24 lines
829 B
YAML
# CrowdSec Parser for SecuBox Auth Logger
|
|
# Parses authentication failures from LuCI/uhttpd and SSH (OpenSSH/Dropbear)
|
|
# Format: secubox-auth[pid]: authentication failure for <user> from <ip> via <service>
|
|
|
|
name: secubox/openwrt-luci-auth
|
|
description: "Parse SecuBox auth failure logs for LuCI and SSH"
|
|
filter: "evt.Parsed.program == 'secubox-auth'"
|
|
onsuccess: next_stage
|
|
|
|
nodes:
|
|
- grok:
|
|
# Case-insensitive match for "authentication failure"
|
|
pattern: "(?i)authentication failure for %{USERNAME:user} from %{IP:source_ip} via %{WORD:service}"
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: auth_failure
|
|
- meta: service
|
|
expression: evt.Parsed.service
|
|
- meta: source_ip
|
|
expression: evt.Parsed.source_ip
|
|
- meta: username
|
|
expression: evt.Parsed.user
|