Wagner wrote:Autrement, je souhaiterais savoir comment faudrait-il procéder avec OSSEC afin de bannir l'émetteur d'une requête visant l'injection d'url ?

<rule id="31103" level="6">
    <if_sid>31100</if_sid>
    <url>=select%20|select+|insert%20|%20from%20|%20where%20|union%20|</url>
    <url>union+|where+|null,null|xp_cmdshell</url>
    <description>SQL injection attempt.</description>
    <group>attack,sql_injection,</group>
</rule>

<rule id="31105" level="6">
    <if_sid>31100</if_sid>
    <url>%3Cscript|%3C%2Fscript|script>|script%3E|SRC=javascript|IMG%20|</url>
    <url>%20ONLOAD=|INPUT%20|iframe%20</url>
    <description>XSS (Cross Site Scripting) attempt.</description>
    <group>attack,</group>
</rule>

/index.php?cat=articles&%20lid=-1%20UNION%20SELECT%200,username,userid,password

10.215.115.5 - hostname [06/Sep/2014:08:45:27 +0200] "GET /manager/ HTTP/1.1" 404 162 "-"

<rule id="100070" level="6">
    <if_sid>31101</if_sid>
    <url>^/manager/</url>
    <id>^400|^404</id>
    <options>alert_by_email</options>
    <description>Attention : bot détecté</description>
    <group>web_scan,recon,</group>
</rule>

service ossec restart

# /var/ossec/bin/ossec-logtest -v

ossec-testrule: Type one log per line.

10.215.115.5 - hostname [06/Sep/2014:08:45:27 +0200] "GET /manager/ HTTP/1.1" 404 162 "-"

**Phase 1: Completed pre-decoding.
       full event: '10.215.115.5 - hostname [06/Sep/2014:08:45:27 +0200] "GET /manager/ HTTP/1.1" 404 162 "-"'
       hostname: 'franklin'
       program_name: '(null)'
       log: '10.215.115.5 - hostname [06/Sep/2014:08:45:27 +0200] "GET /manager/ HTTP/1.1" 404 162 "-"'

**Phase 2: Completed decoding.
       decoder: 'web-accesslog'
       srcip: '10.215.115.5'
       url: '/manager/'
       id: '404'

**Rule debugging:
    Trying rule: 4 - Generic template for all web rules.
       *Rule 4 matched.
       *Trying child rules.
    Trying rule: 31100 - Access log messages grouped.
       *Rule 31100 matched.
       *Trying child rules.
    Trying rule: 31101 - Web server 400 error code.
       *Rule 31101 matched.
       *Trying child rules.
    Trying rule: 100070 - Attention : bot détecté
       *Rule 100070 matched.

**Phase 3: Completed filtering (rules).
       Rule id: '100070'
       Level: '6'
       Description: 'Attention : bot détecté'

**Un méchant a été détecté, I'M A' FIRIN' MAH LAZER !!

# /var/ossec/etc/ossec.conf

<command>
    <name>host-deny-for-life</name>
    <executable>host-deny.sh</executable>
    <expect>srcip</expect>
    <timeout_allowed>no</timeout_allowed>
</command>

<active-response>
    <command>host-deny-for-life</command>
    <location>local</location>
    <rules_id>100070</rules_id>
</active-response>

Tu n'a pas sélectionné correctement le bon pack de langue, il faut choisir avec [ESPACE] le pack fr_FR.UTF-8 :

Et l'activer par défaut :

# locale -a

C
C.UTF-8
en_GB
en_GB.iso88591
en_GB.iso885915
en_GB.utf8
en_US.utf8
français
french
fr_FR
fr_FR@euro
fr_FR.iso88591
fr_FR.iso885915@euro
fr_FR.utf8
POSIX

07 Sep 16:46:02 PreludeCorrelator.pluginmanager (pid:4974) ERROR: [SpamhausDropPlugin]: missing netaddr module : https://pypi.python.org/pypi/netaddr

apt-get install python-netaddr

#!/bin/bash

CSI="\033["
CEND="${CSI}0m"
CGREEN="${CSI}1;32m"
CRED="${CSI}1;31m"

PL=$(ps aux | grep prelude-lml | wc -l)
PC=$(ps aux | grep prelude-correlator | wc -l)
PREWIKKA_PID=$(netstat -tlnp | awk '/:8000 */ {split($NF,a,"/"); print a[1]}')
PRELUDE_MANAGER_PID=$(netstat -tlnp | awk '/:4690 */ {split($NF,a,"/"); print a[1]}')

# Vérification du fonctionnement de Prelude Manager
if [[ $PRELUDE_MANAGER_PID -gt 0 ]]; then
    echo -e "${CGREEN}[OK]${CEND} Prelude Manager est actuellement en service"
else
    echo -e "${CRED}[KO]${CEND} Prelude Manager n'est pas en service, démarrage imminent..."
    /etc/init.d/prelude-manager start
fi

# Vérification du fonctionnement de Prelude LML
if [[ $PL -eq 2 ]]; then
    echo -e "${CGREEN}[OK]${CEND} Prelude LML est actuellement en service"
else
    echo -e "${CRED}[KO]${CEND} Prelude LML n'est pas en service, démarrage imminent..."
    /etc/init.d/prelude-lml start
fi

# Vérification du fonctionnement de Prelude Correlator
if [[ $PC -eq 2 ]]; then
    echo -e "${CGREEN}[OK]${CEND} Prelude Correlator est actuellement en service"
else
    echo -e "${CRED}[KO]${CEND} Prelude Correlator n'est pas en service, démarrage imminent..."
    /etc/init.d/prelude-correlator start
fi

# Vérification du fonctionnement de Prewikka
if [[ $PREWIKKA_PID -gt 0 ]]; then
    echo -e "${CGREEN}[OK]${CEND} Prewikka est actuellement en service"
else
    echo "Prewikka n'est pas en service, démarrage imminent..."
    /etc/init.d/prewikka start
fi

exit 0

# crontab -e

*/30 * * * * /usr/local/bin/prelude-check-components > /dev/null 2>&1