readme.ssh

This is the snapshot of Snot Latest Rules

SSH
---
Chris Sherwin
Adam Keeton <[e-mail]>
Marc Norton <[e-mail]>

Documentation last update 2006-08-15

== Overview ==

The SSH preprocessor detects the following exploits: Gobbles, CRC 32, Secure 
CRT, and the Protocol Mismatch exploit.  

Both Gobbles and CRC 32 attacks occur after the key exchange, and are therefore
encrypted.  Both attacks involve sending a large payload (20kb+) to the server
immediately after the authentication challenge.  To detect the attacks, the SSH
preprocessor counts the number of bytes transmitted to the server.  If those 
bytes exceed a pre-defined limit within a pre-define number of packets, an 
alert is generated.  Since Gobbles only effects SSHv2 and CRC 32 only effects 
SSHv1, the SSH version string exchange is used to distinguish the attacks.

The Secure CRT and protocol mismatch exploits are observable before the key
exchange.

== Configuration ==

By default, all alerts are enabled and the preprocessor checks traffic on port
22.  

The available configuration options are described below:

* server_ports { port[, port] .. }*

This option specifies which ports the SSH preprocessor should inspect traffic
to.

* max_encrypted_packets *

Specifies the number of unanswered packets to allow before alerting on Gobbles
or CRC 32.  In Gobbles or CRC 32, several large packets will be transmitted 
immediately after the authentication challenge.  max_encrypted_packets should 
be used in combination with max_client_bytes.

* max_client_bytes *

The maximum number of bytes allowed to be transferred across 
max_encrypted_packets packets before alerting on Gobbles or CRC 32.

* autodetect *

Attempt to automatically detect SSH.

* disable_gobbles *

Disables checking for the Gobbles exploit.

* disable_ssh1crc32 *

Disables checking for the CRC 32 exploit.

* disable_srvoverflow *

Disables checking for the Secure CRT exploit.

* disable_protomismatch *

Disables checking for the Protocol Mismatch exploit.

* disable_badmsgdir *

Disable alerts for traffic flowing the wrong direction. For instance, if the 
presumed server generates client traffic, or if a client generates server
traffic.

* disable_paysize *

Disables alerts for invalid payload sizes.

* disable_recognition *

Disable alerts for non-SSH traffic on SSH ports.

== Example/Default Configuration ==

Looks for attacks on SSH server port 22.  Alerts at 19600 bytes
within 20 encrypted packets for the Gobbles/CRC32 exploits.

preprocessor ssh: server_ports { 22 } \
                  max_client_bytes 19600 \
                  max_encrypted_packets 20

== Conclusion ==

The SSH preprocessor should work by default.  After max_client_packets is 
reached, the preprocessor will stop processing traffic for a given session.
If Gobbles or CRC 32 false positive, try increasing the number of required
client bytes with max_client_bytes.