Dev/new pattern sshd logs for synology by lachapette · Pull Request #1798 · crowdsecurity/hub

lachapette · 2026-05-13T21:58:56Z

Description

Add Synology-specific patterns and tests for invalid user authentication (SSH and DSM logs API)

Impact: Enhances detection of brute force attacks on Synology devices (SSH and DSM API) with patterns specific to Synology DSM 7.x log formats.

1. SSH Parser (sshd-logs.yaml)

New pattern for Synology DSM 7.x:

Added Pattern: SSHD_INVALID_USER_SYNO: 'pam_%{DATA:pam_type}(sshd:auth): Can.t get user uid (%{USERNAME: sshd_invalid_user})'
- Associated grok node with metadata:
  - log_type: ssh_failed-auth
  - target_user: evt.Parsed.sshd_invalid_user
- Example log covered:
  - pam_syno_log_fail(sshd:auth): Can't get user uid (zm)

2. DSM Parser (synology-dsm-logs.yaml)

Updated Pattern:

Old: AUTH_LOG_FAIL: 'pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=%{IP_WORKAROUND:src_ip}'
New: Added (\s+user=%{USERNAME:sshd_invalid_user})? to capture the username
Example log covered:
- pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116 user=admin

3. New Scenario

synology-dsm-bf-slow-1h.yaml:

Type: leaky
Filter: evt.Meta.log_type == 'synology-dsm_failed_auth'
Strategy: Slow detection over 1 hour (leakspeed: "1h", capacity: 10)
Group by: source_ip
Blackhole: 10h
Added to the crowdsecurity/synology-dsm collection

4. Tests Added

Component	Files created	Lines
SSH BF Tests	`config.yaml`, `parser.assert` (760 lines), `scenario.assert`, `synology-dsm-ssh-bf.log` (21 lines)	802+
DSM Slow Tests	`config.yaml`, `parser.assert` (829 lines), `scenario.assert` (49 lines), `synology-dsm-logs-bf-slow.log` (61 lines)	952+
Existing DSM Tests	Updated `parser.assert` (+65 lines) and `synology-dsm-logs.log` (+5 lines)	71+

Checklist

I have read the contributing guide
I have tested my changes locally
For new parsers or scenarios, tests have been added
I have run the hub linter and no issues were reported (see contributing guide)
Automated tests are passing
AI was used to generate any/all content of this PR

lachapette · 2026-05-13T22:04:48Z

@crowdsecurity/team-hub , @dimatha , @maximelouet , @buixor , @sabban Could you please review this PR ?

…ynology machines - Add a pattern log detection into sshd parser and scenario SSH BF specific to invalid users Synology DSM 7.x logs formats

- Updated a pattern log detection into synology-dsm-logs parser specific to invalid users Synology DSM 7.x logs formats

…SM logs API

…gy DSM logs API

blotus · 2026-05-19T09:58:33Z

          state: open
      - name: Comment PR if errors
-        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') }}
+        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') && (steps.findPr.outputs.pr != 'false') }}


Unrelated change ?

Yes. Due to a taxonomy check inherited from https://github.com/lachapette/crowdsecurity-hub/tree/dependabot/uv/uv-c30c77f42d
I don't know how to bypass it.

blotus · 2026-05-19T09:58:43Z

          state: open
      - name: Comment PR if errors
-        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') }}
+        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') && (steps.findPr.outputs.pr != 'false') }}


Unrelated change ?

Yes. Due to a taxonomy check inherited from https://github.com/lachapette/crowdsecurity-hub/tree/dependabot/uv/uv-c30c77f42d
I don't know how to bypass it.

blotus · 2026-05-19T09:59:37Z

@@ -0,0 +1 @@
+len(results) == 0


This file being empty for a scenario test likely means your scenario did not work as expected.

It works on runtime but i can't push it with scenario success due slow bruteforce in logs above several hours. It does not work in tests scenarios. If there is a way tell me i will rework it.

blotus · 2026-05-19T10:00:26Z

  SSHD_AUTH_FAIL: 'pam_%{DATA:pam_type}\(sshd:auth\): authentication failure; logname= uid=%{NUMBER:uid}? euid=%{NUMBER:euid}? tty=ssh ruser= rhost=%{IP_WORKAROUND:sshd_client_ip}( %{SPACE}user=%{USERNAME:sshd_invalid_user})?'
  SSHD_MAGIC_VALUE_FAILED: 'Magic value check failed \(\d+\) on obfuscated handshake from %{IP_WORKAROUND:sshd_client_ip} port \d+'
  SSHD_INVALID_USER: 'Invalid user\s*%{USERNAME:sshd_invalid_user}? from %{IP_WORKAROUND:sshd_client_ip}( port \d+)?'
+  SSHD_INVALID_USER_SYNO: 'pam_%{DATA:pam_type}\(sshd:auth\): Can.t get user uid \(%{USERNAME:sshd_invalid_user}\)'


Looks like there's a typo in the pattern: can.t vs can't.

The logs you provided for the tests are using can't.

i didn't succeeded to escape ' character in the regex as it is enclosed by 2 ' characters so i match it with a dot. There is not impact.

blotus · 2026-05-19T10:01:57Z

-    expression: "evt.Parsed.src_ip"
+    - meta: service
+      value: synology-dsm
+    - meta: source_ip


Don't move the statics, if we ever add another pattern in the file, we would need to move them back on top level

Ok i will put it back.

blotus · 2026-05-19T10:04:00Z

@@ -0,0 +1,18 @@
+# Synology DSM auth.log bruteforce
+type: leaky
+name: crowdsecurity/synology-dsm-bf-slow-1h


Don't use the crowdsecurity namespace.

Ok i can create a new namespace but it will be duplicated for further maintainability ?

blotus · 2026-05-19T10:04:26Z

Unrelated changes

Same reason as above due to classification error string expected instead of list when running tests.

blotus · 2026-05-19T10:04:35Z

Unrelated changes

This is automated style fixing IDE (IntelliJ). i can revert it.

blotus · 2026-05-19T10:04:44Z

Unrelated changes

Yes same root cause due to taxonomy MR with dependency bot.

blotus · 2026-05-19T10:05:25Z

Unrelated change

is a mistake i guess. You want it reverted or in another MR ?

lachapette force-pushed the dev/new-pattern-sshd-logs-for-synology branch 3 times, most recently from 12f3e98 to b002c0d Compare May 14, 2026 13:18

actions-user and others added 7 commits May 14, 2026 16:15

Update index

b06017d

Update taxonomy

fe100d6

Add a pattern for sshd logs parser of invalid user auth specific to S…

275faab

…ynology machines - Add a pattern log detection into sshd parser and scenario SSH BF specific to invalid users Synology DSM 7.x logs formats

Update a pattern with invalid user auth for Synology DSM logs API

740dd5a

- Updated a pattern log detection into synology-dsm-logs parser specific to invalid users Synology DSM 7.x logs formats

Add a test slow strategy 1 hour with invalid user auth for Synology D…

3d80986

…SM logs API

Add a scenario slow strategy 1 hour with invalid user auth for Synolo…

40ec86a

…gy DSM logs API

Fix classification cast list to string

560f448

lachapette force-pushed the dev/new-pattern-sshd-logs-for-synology branch from b002c0d to 560f448 Compare May 14, 2026 14:15

blotus requested changes May 19, 2026

View reviewed changes

lachapette requested a review from blotus May 21, 2026 20:34

		@@ -0,0 +1 @@
		len(results) == 0 No newline at end of file

Conversation

lachapette commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

1. SSH Parser (sshd-logs.yaml)

2. DSM Parser (synology-dsm-logs.yaml)

3. New Scenario

4. Tests Added

Checklist

Uh oh!

lachapette commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lachapette commented May 13, 2026 •

edited

Loading

lachapette commented May 13, 2026 •

edited

Loading