Skip to content

OpenSSH

Overview

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Authentication logs Several SSH authentication methods are supported

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind event
Category authentication, network, session
Type end, protocol, start

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

{
    "message": " Accepted gssapi-with-mic for ubuntu from 1.2.3.4 port 51826 ssh2",
    "event": {
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "session",
        "outcome": "success",
        "outcome_reason": "Accepted gssapi-with-mic for ubuntu from 1.2.3.4 port 51826 ssh2",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "openssh": {
        "auth": {
            "method": "gssapi-with-mic"
        }
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51826,
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}
{
    "message": " Accepted password for ubuntu from 1.2.3.4 port 51826 ssh2",
    "event": {
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "session",
        "outcome": "success",
        "outcome_reason": "Accepted password for ubuntu from 1.2.3.4 port 51826 ssh2",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "openssh": {
        "auth": {
            "method": "password"
        }
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51826,
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}
{
    "message": " Accepted publickey for ubuntu from 1.2.3.4 port 51826 ssh2: RSA SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
    "event": {
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "session",
        "outcome": "success",
        "outcome_reason": "Accepted publickey for ubuntu from 1.2.3.4 port 51826 ssh2: RSA SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
        "target": "user",
        "type": "open"
    },
    "file": {
        "hash": {
            "sha256": "AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
        }
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "openssh": {
        "auth": {
            "method": "publickey"
        }
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "hash": [
            "AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
        ],
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51826,
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}
{
    "message": " error: maximum authentication attempts exceeded for invalid user support from ssh.example.org port 51219 ssh2 [preauth]",
    "event": {
        "category": [
            "session"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "maximum authentication attempts exceeded",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "hosts": [
            "ssh.example.org"
        ],
        "user": [
            "support"
        ]
    },
    "source": {
        "address": "ssh.example.org",
        "domain": "ssh.example.org",
        "port": 51219,
        "registered_domain": "example.org",
        "subdomain": "ssh",
        "top_level_domain": "org",
        "user": {
            "name": "support"
        }
    },
    "user": {
        "name": "support"
    }
}
{
    "message": " Disconnecting invalid user support 1.2.3.4 port 51219: Too many authentication failures [preauth]",
    "event": {
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Disconnecting",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "support"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51219,
        "user": {
            "name": "support"
        }
    },
    "user": {
        "name": "support"
    }
}
{
    "message": " Bad protocol version identification '\\003' from 1.2.3.4 port 407",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "protocol"
        ]
    },
    "action": {
        "name": "negotiate",
        "outcome": "failure",
        "outcome_reason": "Bad protocol version",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 407
    }
}
{
    "message": " Connection closed by 1.2.3.4 port 51488 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Connection closed by 1.2.3.4 port 51488 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51488
    }
}
{
    "message": " Connection closed by authenticating user backup 1.2.3.4 port 49424 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Connection closed by authenticating user backup 1.2.3.4 port 49424 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "backup"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 49424,
        "user": {
            "name": "backup"
        }
    },
    "user": {
        "name": "backup"
    }
}
{
    "message": " Connection closed by illegal user default 1.2.3.4 port 49424 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Connection closed by illegal user default 1.2.3.4 port 49424 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "default"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 49424,
        "user": {
            "name": "default"
        }
    },
    "user": {
        "name": "default"
    }
}
{
    "message": " Connection closed by invalid user pi 1.2.3.4 port 42608 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Connection closed by invalid user pi 1.2.3.4 port 42608 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "pi"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 42608,
        "user": {
            "name": "pi"
        }
    },
    "user": {
        "name": "pi"
    }
}
{
    "message": " Connection reset by 1.2.3.4 port 45611 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "reset",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 45611
    }
}
{
    "message": "Mar 11 11:26:54 foobar sshd[3296336]: Received disconnect from 1.1.1.1 port 33980:11: Bye Bye",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Bye Bye",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.1.1.1"
        ]
    },
    "source": {
        "address": "1.1.1.1",
        "ip": "1.1.1.1",
        "port": 33980
    }
}
{
    "message": " Disconnected from 1.2.3.4 port 39906 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Disconnected from 1.2.3.4 port 39906 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 39906
    }
}
{
    "message": " Disconnected from authenticating user backup 1.2.3.4 port 49424 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Disconnected from authenticating user backup 1.2.3.4 port 49424 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "backup"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 49424,
        "user": {
            "name": "backup"
        }
    },
    "user": {
        "name": "backup"
    }
}
{
    "message": " Disconnected from illegal user default 1.2.3.4 port 48792 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Disconnected from illegal user default 1.2.3.4 port 48792 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "default"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 48792,
        "user": {
            "name": "default"
        }
    },
    "user": {
        "name": "default"
    }
}
{
    "message": " Disconnected from user ubuntu 1.2.3.4 port 44708",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Disconnected from user ubuntu 1.2.3.4 port 44708",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 44708,
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}
{
    "message": " Failed password for backup from 1.2.3.4 port 60150 ssh2",
    "event": {
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Failed password",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "backup"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 60150,
        "user": {
            "name": "backup"
        }
    },
    "user": {
        "name": "backup"
    }
}
{
    "message": " Invalid user jdoe from ssh.example.org port 48792",
    "event": {
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Invalid user jdoe from ssh.example.org port 48792",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "hosts": [
            "ssh.example.org"
        ],
        "user": [
            "jdoe"
        ]
    },
    "source": {
        "address": "ssh.example.org",
        "domain": "ssh.example.org",
        "port": 48792,
        "registered_domain": "example.org",
        "subdomain": "ssh",
        "top_level_domain": "org",
        "user": {
            "name": "jdoe"
        }
    },
    "user": {
        "name": "jdoe"
    }
}
{
    "message": " input_userauth_request: invalid user jdoe [preauth]",
    "event": {
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "invalid user",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "user": [
            "jdoe"
        ]
    },
    "source": {
        "user": {
            "name": "jdoe"
        }
    },
    "user": {
        "name": "jdoe"
    }
}
{
    "message": " error: kex_exchange_identification: Connection closed by remote host",
    "event": {
        "category": [
            "session"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Connection closed by remote host",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    }
}
{
    "message": " Did not receive identification string from 1.2.3.4 port 50622",
    "event": {
        "category": [
            "session"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Did not receive identification string",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 50622
    }
}
{
    "message": " pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4",
    "event": {
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "sshd:auth",
        "outcome": "failure",
        "outcome_reason": "pam_unix(sshd:auth): authentication failure;",
        "target": "user",
        "type": "authentication"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    }
}
{
    "message": " pam_unix(sshd:auth): check pass; user unknown",
    "event": {
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "sshd:auth",
        "outcome": "success",
        "outcome_reason": "pam_unix(sshd:auth): check pass; user unknown",
        "target": "user",
        "type": "check"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "user": [
            "unknown"
        ]
    },
    "source": {
        "user": {
            "name": "unknown"
        }
    },
    "user": {
        "name": "unknown"
    }
}
{
    "message": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root",
    "event": {
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "sshd:auth",
        "outcome": "failure",
        "outcome_reason": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root",
        "target": "user",
        "type": "authentication"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "root"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "user": {
            "name": "root"
        }
    },
    "user": {
        "euid": "0",
        "id": "0",
        "name": "root"
    }
}
{
    "message": " pam_unix(sshd:session): session closed for user ubuntu",
    "event": {
        "category": [
            "session"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "sshd:session",
        "outcome": "success",
        "outcome_reason": "pam_unix(sshd:session): session closed for user ubuntu",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}
{
    "message": " pam_unix(sshd:session): session opened for user ubuntu by (uid=0)",
    "event": {
        "category": [
            "session"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "sshd:session",
        "outcome": "success",
        "outcome_reason": "pam_unix(sshd:session): session opened for user ubuntu by (uid=0)",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}
{
    "message": " Received disconnect from 1.2.3.4 port 39906:11: Bye Bye [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Bye Bye",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 39906
    }
}
{
    "message": " Received disconnect from 1.2.3.4 port 16899:11:  [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Received disconnect from 1.2.3.4 port 16899:11:  [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 16899
    }
}
{
    "message": " Received disconnect from 1.2.3.4 port 36958:11: Normal Shutdown, Thank you for playing [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Normal Shutdown, Thank you for playing",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 36958
    }
}
{
    "message": " Received disconnect from 1.2.3.4 port 44708:11: disconnected by user",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "disconnected by user",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 44708
    }
}
{
    "message": " Unable to negotiate with 1.2.3.4 port 27824: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]",
    "event": {
        "category": [
            "session"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "negotiate",
        "outcome": "failure",
        "outcome_reason": "Unable to negotiate with 1.2.3.4 port 27824: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 27824
    }
}
{
    "message": " User root from 1.2.3.4 not allowed because not listed in AllowUsers",
    "event": {
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "not allowed because not listed in AllowUsers",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "root"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "user": {
            "name": "root"
        }
    },
    "user": {
        "name": "root"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
action.target keyword
event.category keyword Event category. The second categorization field in the hierarchy.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.outcome keyword The outcome of the event. The lowest level categorization field in the hierarchy.
event.type keyword Event type. The third categorization field in the hierarchy.
file.hash.sha256 keyword SHA256 hash.
observer.product keyword The product name of the observer.
observer.type keyword The type of the observer the data is coming from.
observer.vendor keyword Vendor name of the observer.
openssh.auth.method keyword
process.name keyword Process name.
source.domain keyword The domain name of the source.
source.ip ip IP address of the source.
source.port long Port of the source.
source.user.name keyword Short name or login of the user.
user.euid keyword
user.id keyword Unique identifier of the user.
user.name keyword Short name or login of the user.

Configure

As of now, the main solution to collect OpenSSH logs leverages the Rsyslog recipe. Please share your experiences with other recipes by editing this documentation.

Rsyslog

Please refer to the documentation of OpenSSH to forward events to your rsyslog server. The reader can consult the Rsyslog Transport documentation to forward these logs to Sekoia.io.

Further Readings