mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
161 lines
3.0 KiB
ReStructuredText
161 lines
3.0 KiB
ReStructuredText
SSH
|
|
---
|
|
|
|
SSH transaction details are exposes to Lua scripts with the
|
|
``suricata.ssh`` library, For example::
|
|
|
|
local ssh = require("suricata.ssh")
|
|
|
|
If you want to use hassh, you can either set suricata.yaml option
|
|
``app-layer.protocols.ssh.hassh`` to true,
|
|
or specify it in the ``init`` function of your lua script
|
|
by calling ``ssh.enable_hassh()``::
|
|
|
|
function init (args)
|
|
ssh.enable_hassh()
|
|
return {}
|
|
end
|
|
|
|
For use in rule matching, the rule must **hook** into a SSH
|
|
transaction state. Available states are listed in :ref:`ssh-hooks`.
|
|
For example:
|
|
|
|
.. container:: example-rule
|
|
|
|
alert ssh::example-rule-emphasis:`response_banner_done` any any -> any any (...
|
|
|
|
Setup
|
|
^^^^^
|
|
|
|
If your purpose is to create a logging script, initialize the buffer as:
|
|
|
|
::
|
|
|
|
function init (args)
|
|
local needs = {}
|
|
return needs
|
|
end
|
|
|
|
If you are going to use the script for rule matching, choose one of
|
|
the available SSH buffers listed in :ref:`lua-detection` and follow
|
|
the pattern:
|
|
|
|
::
|
|
|
|
function init (args)
|
|
local needs = {}
|
|
return needs
|
|
end
|
|
|
|
Transaction
|
|
~~~~~~~~~~~
|
|
|
|
SSH is transaction based, and the current transaction must be obtained before use::
|
|
|
|
local tx, err = ssh.get_tx()
|
|
if tx == err then
|
|
print(err)
|
|
end
|
|
|
|
All other functions are methods on the transaction table.
|
|
|
|
Transaction Methods
|
|
~~~~~~~~~~~~~~~~~~~
|
|
|
|
``server_proto()``
|
|
^^^^^^^^^^^^^^^^^^
|
|
|
|
Get the ``server_proto`` value as a string.
|
|
|
|
Example::
|
|
|
|
local tx = ssh.get_tx()
|
|
local proto = tx:server_proto();
|
|
print (proto)
|
|
|
|
``client_proto()``
|
|
^^^^^^^^^^^^^^^^^^
|
|
|
|
Get the ``client_proto`` value as a string.
|
|
|
|
Example::
|
|
|
|
local tx = ssh.get_tx()
|
|
local proto = tx:client_proto();
|
|
print (proto)
|
|
|
|
``server_software()``
|
|
^^^^^^^^^^^^^^^^^^^^^
|
|
|
|
Get the ``server_software`` value as a string.
|
|
|
|
Example::
|
|
|
|
local tx = ssh.get_tx()
|
|
local software = tx:server_software();
|
|
print (software)
|
|
|
|
``client_software()``
|
|
^^^^^^^^^^^^^^^^^^^^^
|
|
|
|
Get the ``client_software`` value as a string.
|
|
|
|
Example::
|
|
|
|
local tx = ssh.get_tx()
|
|
local software = tx:client_software();
|
|
print (software)
|
|
|
|
``client_hassh()``
|
|
^^^^^^^^^^^^^^^^^^
|
|
|
|
Should be used with ``ssh.enable_hassh()``.
|
|
|
|
Get MD5 of hassh algorithms used by the client through client_hassh.
|
|
|
|
Example::
|
|
|
|
local tx = ssh.get_tx()
|
|
local h = tx:client_hassh();
|
|
print (h)
|
|
|
|
|
|
``client_hassh_string()``
|
|
^^^^^^^^^^^^^^^^^^^^^^^^^
|
|
|
|
Should be used with ``ssh.enable_hassh()``.
|
|
|
|
Get hassh algorithms used by the client through client_hassh_string.
|
|
|
|
Example::
|
|
|
|
local tx = ssh.get_tx()
|
|
local h = tx:client_hassh_string();
|
|
print (h)
|
|
|
|
``server_hassh()``
|
|
^^^^^^^^^^^^^^^^^^
|
|
|
|
Should be used with ``ssh.enable_hassh()``.
|
|
|
|
Get MD5 of hassh algorithms used by the server through server_hassh.
|
|
|
|
Example::
|
|
|
|
local tx = ssh.get_tx()
|
|
local h = tx:server_hassh();
|
|
print (h)
|
|
|
|
``server_hassh_string()``
|
|
^^^^^^^^^^^^^^^^^^^^^^^^^
|
|
|
|
Should be used with ``ssh.enable_hassh()``.
|
|
|
|
Get hassh algorithms used by the server through server_hassh_string.
|
|
|
|
Example::
|
|
|
|
local tx = ssh.get_tx()
|
|
local h = tx:server_hassh_string();
|
|
print (h)
|