CyberMind-FR
3b84c8a047
- Create secubox-auth-logger package to monitor SSH/LuCI auth failures - auth-monitor.sh watches logread for failed password attempts - Supports OpenSSH, Dropbear, and uhttpd/LuCI authentication - Logs failures to syslog with secubox-auth tag for CrowdSec parsing - Fix wizard.js syntax error with computed property names - Remove broken Dropbear verbose config (2024.86 doesn't support -v) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
21 lines
687 B
YAML
21 lines
687 B
YAML
# CrowdSec Parser for SecuBox Auth Logger
|
|
# Parses authentication failures from LuCI/uhttpd and Dropbear
|
|
# Format: secubox-auth: Authentication failure for <user> from <ip> via <service>
|
|
|
|
name: secubox/openwrt-luci-auth
|
|
description: "Parse SecuBox auth failure logs for LuCI and SSH"
|
|
filter: "evt.Parsed.program == 'secubox-auth'"
|
|
onsuccess: next_stage
|
|
|
|
nodes:
|
|
- grok:
|
|
pattern: "Authentication failure for %{USERNAME:user} from %{IP:source_ip} via %{WORD:service}"
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: auth_failure
|
|
- meta: service
|
|
expression: evt.Parsed.service
|
|
- meta: source_ip
|
|
expression: evt.Parsed.source_ip
|