Giter VIP home page Giter VIP logo

ssh's Introduction

SSH

Publisher: Splunk
Connector Version: 2.4.0
Product Vendor: Generic
Product Name: SSH
Product Version Supported (regex): ".*"
Minimum Product Version: 5.3.5

This app supports executing various endpoint-based investigative and containment actions on an SSH endpoint

Note: This app will only support Linux distributions and Mac OS X. The app internally uses the Paramiko module to establish an SSH connection with the server, and per the official Paramiko documentation, it does not support non-standard SSH implementations or host systems. See this link for more details.

Root access permissions

If you are logging in as the root user (or a user otherwise configured to not need to use sudo), then be sure to check the "User is root" box in the asset configuration. Otherwise, you will have to provide a password if you want to run commands that require root access even if the RSA key is specified, as required by your sudoers configuration. If you incorrectly specify that the account is root, or if you incorrectly enter a password in conjunction with the RSA key, then the action may indefinitely hang.

Pseudo-terminal

In certain scenarios, it may be necessary to enable the pseudo-terminal for sudo commands where requiretty is enabled in the sudoers config. In that case, you can:

  • disable the requiretty requirement on the server-side or
  • enable pseudo-terminal in your asset config.

However, if it is not required, it should be disabled. Otherwise, the app may hang indefinitely when used with servers where pseudo-terminals are not supported.

Key-based authentication

Refer to the following steps to install the authentication keys in on-prem instance. Note that the key pair must be unencrypted and generated using ssh-keygen .

Note: The screenshots attached below are for Non-NRI instances having /home/phantom-worker as the home directory. For NRI instances, consider /home/phanru as the home directory and phanru as the user. If you are using different user, then consider /home/{your_user_name} as the home directory and {your_user_name} as the user. The steps would remain the same with only a minor change that the user would be phanru or {your_user_name} instead of phantom-worker .

  1. Connect to your Phantom instance and sudo to root. Change the current directory to phantom-worker's home directory using cd /home/phantom-worker/

  2. Create a directory for the SSH keys (NOTE: You must give it the name .ssh). If you already have a key pair, move the private key files into this directory. In this case, the file id_rsa has been added to the user's home directory using scp.

    It is entirely possible to generate a new key pair from the Phantom VM. To generate the key using ssh-keygen , refer to the following steps:

    • Generate a new key pair using the command ssh-keygen -f .ssh/id_rsa
    • Once an SSH key pair has been generated, the ssh-copy-id command can be used to install it as an authorized key on the server. Use the command ssh-copy-id -i .ssh/id_rsa <user>@<host> . Here, the <user> and <host> refer to the SSH server where you want to execute the SSH commands/Phantom actions. The command may request a password or other authentication for the server.

    The RSA public key is successfully added to the server.

  3. Once the files are in the correct place, the ownership of the .ssh directory needs to be set using chown -R phantom-worker:phantom-worker .ssh . To verify whether the owner of the .ssh folder is successfully updated or not use the ls -lAR command.

    Using the chown command:

The RSA key should be ready to use in the SSH asset. Based on the above example, configure this by specifying 'id_rsa' as the RSA key file. In the case of a different user, the absolute path to the key must be specified. For example, if keys are added using username testuser having the home directory /home/testuser then /home/testuser/.ssh/id_rsa should be specified as the RSA key file.

Disable SHA2 Algorithms Parameter

The 'disable_sha2' parameter in the asset can be checked when the SSH instance is old one which does not have the support of either RSA2 or the "server-sig-algs" protocol extension.

Verify Last Reboot Time

After successfully logging into your SSH server, run the command last reboot which will display all the previous reboot dates and times for the system.

Configuration Variables

The below configuration variables are required for this Connector to operate. These variables are specified when configuring a SSH asset in SOAR.

VARIABLE REQUIRED TYPE DESCRIPTION
username required string Username
root optional boolean User is root
password optional password Password
rsa_key_file optional string RSA Key file
ip_hostname optional string Device IP/Hostname (for test connectivity only)
timeout optional numeric Seconds before timeout (will be applicable for all actions)
pseudo_terminal optional boolean Enable pseudo-terminal when running sudo commands
disable_sha2 optional boolean Disable SHA2 Algorithms (For Older SSH instances)

Supported Actions

test connectivity - Validates endpoint connection
execute program - Executes a program on the remote machine
list connections - Lists all the network connections. Requires root privileges. Requires netstat to be installed
block ip - Add an iptables rule to the Linux server. Requires root privileges. Not supported on OS X
list firewall rules - Lists the rules in iptables. Requires root privileges. Not supported on OS X
delete firewall rule - Delete a firewall rule. Requires root privileges. Not supported on OS X
reboot system - Reboot the endpoint (Requires root privileges)
shutdown system - Shutdown the endpoint(Requires root privileges)
terminate process - Terminate a process (Requires root privileges)
logoff user - Logout a user on endpoint (Requires root privileges)
list processes - List processes on endpoint
get disk usage - Retrieve disk usage from endpoint
get memory usage - Retrieve memory usage from endpoint
get file - Retrieve a file from the endpoint and save it to the vault
put file - Put a file from the vault to another location

action: 'test connectivity'

Validates endpoint connection

Type: test
Read only: False

Action Parameters

No parameters are required for this action

Action Output

No Output

action: 'execute program'

Executes a program on the remote machine

Type: generic
Read only: False

Please provide a value for the 'timeout' parameter when executing continuous commands such as 'ping' so that the action does not keep running indefinitely.

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP to execute command on string ip host name
command optional Command to be executed on endpoint string
script_file optional Local path to shell script string
timeout optional Seconds before timeout. If an invalid value or 0 is entered, the timeout specified in the asset configuration will be used (default: 0) numeric

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.command string
action_result.parameter.ip_hostname string ip host name
action_result.parameter.script_file string
action_result.parameter.timeout numeric
action_result.data.*.output string
action_result.summary.exit_status numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'list connections'

Lists all the network connections. Requires root privileges. Requires netstat to be installed

Type: investigate
Read only: True

Executes the following command
sudo -S netstat -etnp
On OS X the following command is executed instead
sudo -S lsof -nP -i
Note that the name of the command in the output is limited to 9 characters.

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP to list network connections on string ip host name
local_addr optional Local IP to filter on string ip
local_port optional Local port to match numeric port
remote_addr optional Remote IP to filter on string ip
remote_port optional Remote port to match numeric port

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.ip_hostname string ip host name
action_result.parameter.local_addr string ip
action_result.parameter.local_port numeric port
action_result.parameter.remote_addr string ip
action_result.parameter.remote_port numeric port
action_result.data.*.connections.*.cmd string
action_result.data.*.connections.*.inode string
action_result.data.*.connections.*.local_ip string ip
action_result.data.*.connections.*.local_port string port
action_result.data.*.connections.*.pid string pid
action_result.data.*.connections.*.protocol string
action_result.data.*.connections.*.rec_q string
action_result.data.*.connections.*.remote_ip string ip
action_result.data.*.connections.*.remote_port string port
action_result.data.*.connections.*.send_q string
action_result.data.*.connections.*.state string
action_result.data.*.connections.*.uid string
action_result.summary.exit_status numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'block ip'

Add an iptables rule to the Linux server. Requires root privileges. Not supported on OS X

Type: contain
Read only: False

Need to specify either an IP or a port to block.
Executes the following command
sudo -S iptables -I <DIRECTION> -p <PROTOCOL> <IP> <PORT> -j DROP -m <COMMENT>
where the IP and PORT fields will block either source or destination based on the DIRECTION.
Only iptables is supported.

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP to add firewall rule to string ip host name
remote_ip optional Remote IP to block string ip host name
remote_port optional Remote port to block numeric port
protocol required Protocol to block string
direction required Inbound or outbound string
comment optional Leave a comment string

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.comment string
action_result.parameter.direction string
action_result.parameter.ip_hostname string ip host name
action_result.parameter.protocol string
action_result.parameter.remote_ip string ip host name
action_result.parameter.remote_port numeric port
action_result.data.*.output string
action_result.summary.exit_status numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'list firewall rules'

Lists the rules in iptables. Requires root privileges. Not supported on OS X

Type: investigate
Read only: True

Executes the following command
sudo -S iptables -L <CHAIN> --line-numbers -n
Only iptables is supported.

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP to list firewall rules on string ip host name
protocol optional Protocol to match string
port optional Port to match numeric port
chain optional Chain to match (INPUT, OUTPUT, etc.) string

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.chain string
action_result.parameter.ip_hostname string ip host name
action_result.parameter.port numeric port
action_result.parameter.protocol string
action_result.data.*.rules.*.chain string
action_result.data.*.rules.*.destination string
action_result.data.*.rules.*.num string
action_result.data.*.rules.*.options string
action_result.data.*.rules.*.protocol string
action_result.data.*.rules.*.source string
action_result.data.*.rules.*.target string
action_result.summary.exit_status numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'delete firewall rule'

Delete a firewall rule. Requires root privileges. Not supported on OS X

Type: correct
Read only: False

Executes the following command
sudo -S iptables -D <CHAIN> <NUMBER>
Only iptables is supported.

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP of endpoint string ip host name
chain required Name of chain (INPUT, OUTPUT, etc.) string
number required Number of rule to delete numeric

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.chain string
action_result.parameter.ip_hostname string ip host name
action_result.parameter.number numeric
action_result.data.*.output string
action_result.summary.exit_status numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'reboot system'

Reboot the endpoint (Requires root privileges)

Type: contain
Read only: False

Executes the following command
sudo -S shutdown -r now

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP of server to reboot string ip host name

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.ip_hostname string ip host name
action_result.data.*.output string
action_result.summary.exit_status numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'shutdown system'

Shutdown the endpoint(Requires root privileges)

Type: contain
Read only: False

Executes the following command
sudo -S shutdown -h now

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP of server to shutdown string ip host name

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.ip_hostname string ip host name
action_result.data.*.output string
action_result.summary.exit_status numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'terminate process'

Terminate a process (Requires root privileges)

Type: contain
Read only: False

Executes the following command
sudo -S kill -SIGKILL <PID>

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP of endpoint string ip host name
pid required PID of process to terminate numeric pid

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.ip_hostname string ip host name
action_result.parameter.pid numeric pid
action_result.data.*.output string
action_result.summary.exit_status numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'logoff user'

Logout a user on endpoint (Requires root privileges)

Type: contain
Read only: False

Executes the following command
sudo -S pkill -SIGKILL <USER_NAME>
This will terminate any sessions with this user as well as any other processes which they are running. Be careful when running this with certain users (i.e. root).

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP of endpoint string ip host name
user_name required Name of user to logout string user name

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.ip_hostname string ip host name
action_result.parameter.user_name string user name
action_result.data.*.output string
action_result.summary.exit_status numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'list processes'

List processes on endpoint

Type: investigate
Read only: True

Executes the following command
ps c -Ao user,uid,pid,ppid,stime,command

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP of endpoint string ip host name

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.ip_hostname string ip host name
action_result.data.*.processes.*.command string
action_result.data.*.processes.*.pid string pid
action_result.data.*.processes.*.ppid string pid
action_result.data.*.processes.*.stime string
action_result.data.*.processes.*.uid string
action_result.data.*.processes.*.user string user name
action_result.summary.exit_status numeric
action_result.summary.total_processes numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'get disk usage'

Retrieve disk usage from endpoint

Type: investigate
Read only: True

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP to execute command on string ip host name

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.ip_hostname string ip host name
action_result.data.*.*.Avail string
action_result.data.*.*.Filesystem string
action_result.data.*.*.Mounted on string
action_result.data.*.*.Size string
action_result.data.*.*.Use% string
action_result.data.*.*.Used string
action_result.data.*.*.raw string
action_result.summary.exit_status numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'get memory usage'

Retrieve memory usage from endpoint

Type: investigate
Read only: True

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP to execute command on string ip host name

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.ip_hostname string ip host name
action_result.data.*.*.Available string
action_result.data.*.*.Buff/Cache string
action_result.data.*.*.Free string
action_result.data.*.*.Shared string
action_result.data.*.*.Total string
action_result.data.*.*.Type string
action_result.data.*.*.Used string
action_result.data.*.*.raw string
action_result.summary.exit_status numeric
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'get file'

Retrieve a file from the endpoint and save it to the vault

Type: investigate
Read only: True

The file path needs to be an absolute path. For example, /home/USER/file.tgz instead of ~/file.tgz.

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP to execute command on string ip host name
file_path required Full path of the file to download (include filename) string file path

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.file_path string file path
action_result.parameter.ip_hostname string ip host name
action_result.data string
action_result.summary.exit_status numeric
action_result.summary.name string
action_result.summary.size numeric
action_result.summary.vault_id string vault id
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

action: 'put file'

Put a file from the vault to another location

Type: generic
Read only: False

The file path needs to be an absolute path. For example, /home/USER/ instead of ~/USER.

Action Parameters

PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS
ip_hostname required Hostname/IP to execute command on string ip host name
vault_id required Vault ID of file string vault id
file_destination required File destination path (exclude filename) string file path

Action Output

DATA PATH TYPE CONTAINS
action_result.status string
action_result.parameter.file_destination string file path
action_result.parameter.ip_hostname string ip host name
action_result.parameter.vault_id string vault id
action_result.data string
action_result.summary.file_sent string file path
action_result.message string
summary.total_objects numeric
summary.total_objects_successful numeric

ssh's People

Contributors

ricardo-phantom avatar phantom-jacob avatar phantom-michelle avatar dgopani-crest avatar rgil-splunk avatar atif-phantom avatar arathore-crest avatar pratikp-crest avatar gary-phantom avatar brian-phantom avatar ryanmeans-phantom avatar phantom-chetan avatar spopat-crest avatar cpangam avatar alexa-phantom avatar achandya-crest avatar devals-crest avatar pdesai-crest avatar phantom-dkhorasani avatar tonyc-phantom avatar pzhou-splunk avatar jpatel-splunk avatar dvora-crest avatar cwadhwani-splunk avatar ebhoir-crest avatar govind-phantom avatar splunk-heena avatar ishans-crest avatar jdemelo avatar chunmanjimmyf avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.