Dev/new pattern sshd logs for synology by lachapette · Pull Request #1798 · crowdsecurity/hub

lachapette · 2026-05-13T21:58:56Z

Description

Add Synology-specific patterns and tests for invalid user authentication (SSH and DSM logs API)

Impact: Enhances detection of brute force attacks on Synology devices (SSH and DSM API) with patterns specific to Synology DSM 7.x log formats.

1. SSH Parser (sshd-logs.yaml)

New pattern for Synology DSM 7.x:

Added Pattern: SSHD_INVALID_USER_SYNO: 'pam_%{DATA:pam_type}(sshd:auth): Can.t get user uid (%{USERNAME: sshd_invalid_user})'
- Associated grok node with metadata:
  - log_type: ssh_failed-auth
  - target_user: evt.Parsed.sshd_invalid_user
- Example log covered:
  - pam_syno_log_fail(sshd:auth): Can't get user uid (zm)

2. DSM Parser (synology-dsm-logs.yaml)

Updated Pattern:

Old: AUTH_LOG_FAIL: 'pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=%{IP_WORKAROUND:src_ip}'
New: Added (\s+user=%{USERNAME:sshd_invalid_user})? to capture the username
Example log covered:
- pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116 user=admin

3. New Scenario

synology-dsm-bf-slow-1h.yaml:

Type: leaky
Filter: evt.Meta.log_type == 'synology-dsm_failed_auth'
Strategy: Slow detection over 1 hour (leakspeed: "1h", capacity: 10)
Group by: source_ip
Blackhole: 10h
Added to the crowdsecurity/synology-dsm collection

4. Tests Added

Component	Files created	Lines
SSH BF Tests	`config.yaml`, `parser.assert` (760 lines), `scenario.assert`, `synology-dsm-ssh-bf.log` (21 lines)	802+
DSM Slow Tests	`config.yaml`, `parser.assert` (829 lines), `scenario.assert` (49 lines), `synology-dsm-logs-bf-slow.log` (61 lines)	952+
Existing DSM Tests	Updated `parser.assert` (+65 lines) and `synology-dsm-logs.log` (+5 lines)	71+

Checklist

I have read the contributing guide
I have tested my changes locally
For new parsers or scenarios, tests have been added
I have run the hub linter and no issues were reported (see contributing guide)
Automated tests are passing
AI was used to generate any/all content of this PR

lachapette · 2026-05-13T22:04:48Z

@crowdsecurity/team-hub , @dimatha , @maximelouet , @buixor , @sabban Could you please review this PR ?

…ynology machines - Add a pattern log detection into sshd parser and scenario SSH BF specific to invalid users Synology DSM 7.x logs formats

- Updated a pattern log detection into synology-dsm-logs parser specific to invalid users Synology DSM 7.x logs formats

…SM logs API

…gy DSM logs API

blotus · 2026-05-19T09:58:33Z

          state: open
      - name: Comment PR if errors
-        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') }}
+        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') && (steps.findPr.outputs.pr != 'false') }}


Unrelated change ?

blotus · 2026-05-19T09:58:43Z

          state: open
      - name: Comment PR if errors
-        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') }}
+        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') && (steps.findPr.outputs.pr != 'false') }}


Unrelated change ?

blotus · 2026-05-19T09:59:37Z

@@ -0,0 +1 @@
+len(results) == 0


This file being empty for a scenario test likely means your scenario did not work as expected.

blotus · 2026-05-19T10:00:26Z

  SSHD_AUTH_FAIL: 'pam_%{DATA:pam_type}\(sshd:auth\): authentication failure; logname= uid=%{NUMBER:uid}? euid=%{NUMBER:euid}? tty=ssh ruser= rhost=%{IP_WORKAROUND:sshd_client_ip}( %{SPACE}user=%{USERNAME:sshd_invalid_user})?'
  SSHD_MAGIC_VALUE_FAILED: 'Magic value check failed \(\d+\) on obfuscated handshake from %{IP_WORKAROUND:sshd_client_ip} port \d+'
  SSHD_INVALID_USER: 'Invalid user\s*%{USERNAME:sshd_invalid_user}? from %{IP_WORKAROUND:sshd_client_ip}( port \d+)?'
+  SSHD_INVALID_USER_SYNO: 'pam_%{DATA:pam_type}\(sshd:auth\): Can.t get user uid \(%{USERNAME:sshd_invalid_user}\)'


Looks like there's a typo in the pattern: can.t vs can't.

The logs you provided for the tests are using can't.

blotus · 2026-05-19T10:01:57Z

-    expression: "evt.Parsed.src_ip"
+    - meta: service
+      value: synology-dsm
+    - meta: source_ip


Don't move the statics, if we ever add another pattern in the file, we would need to move them back on top level

blotus · 2026-05-19T10:04:00Z

@@ -0,0 +1,18 @@
+# Synology DSM auth.log bruteforce
+type: leaky
+name: crowdsecurity/synology-dsm-bf-slow-1h


Don't use the crowdsecurity namespace.

blotus · 2026-05-19T10:04:26Z

Unrelated changes

blotus · 2026-05-19T10:04:35Z

Unrelated changes

blotus · 2026-05-19T10:04:44Z

Unrelated changes

blotus · 2026-05-19T10:05:25Z

Unrelated change

lachapette force-pushed the dev/new-pattern-sshd-logs-for-synology branch 3 times, most recently from 12f3e98 to b002c0d Compare May 14, 2026 13:18

actions-user and others added 7 commits May 14, 2026 16:15

Update index

b06017d

Update taxonomy

fe100d6

Add a pattern for sshd logs parser of invalid user auth specific to S…

275faab

…ynology machines - Add a pattern log detection into sshd parser and scenario SSH BF specific to invalid users Synology DSM 7.x logs formats

Update a pattern with invalid user auth for Synology DSM logs API

740dd5a

- Updated a pattern log detection into synology-dsm-logs parser specific to invalid users Synology DSM 7.x logs formats

Add a test slow strategy 1 hour with invalid user auth for Synology D…

3d80986

…SM logs API

Add a scenario slow strategy 1 hour with invalid user auth for Synolo…

40ec86a

…gy DSM logs API

Fix classification cast list to string

560f448

lachapette force-pushed the dev/new-pattern-sshd-logs-for-synology branch from b002c0d to 560f448 Compare May 14, 2026 14:15

blotus requested changes May 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Dev/new pattern sshd logs for synology#1798

Dev/new pattern sshd logs for synology#1798
lachapette wants to merge 7 commits into
crowdsecurity:masterfrom
lachapette:dev/new-pattern-sshd-logs-for-synology

lachapette commented May 13, 2026 •

edited

Loading

Uh oh!

lachapette commented May 13, 2026 •

edited

Loading

Uh oh!

blotus May 19, 2026

Uh oh!

blotus May 19, 2026

Uh oh!

blotus May 19, 2026

Uh oh!

blotus May 19, 2026

Uh oh!

blotus May 19, 2026

Uh oh!

blotus May 19, 2026

Uh oh!

blotus May 19, 2026

Uh oh!

blotus May 19, 2026

Uh oh!

blotus May 19, 2026

Uh oh!

blotus May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -0,0 +1 @@
		len(results) == 0 No newline at end of file

Conversation

lachapette commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

1. SSH Parser (sshd-logs.yaml)

2. DSM Parser (synology-dsm-logs.yaml)

3. New Scenario

4. Tests Added

Checklist

Uh oh!

lachapette commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lachapette commented May 13, 2026 •

edited

Loading

lachapette commented May 13, 2026 •

edited

Loading