RE: Does anyone have a list of possible authentication failures UTM can generate?

DouglasFoster — Wed, 03 Oct 2018 15:26:12 GMT

My actual logic works like this:

Every line has a standard header, so I separate the header section from the message body.
If the message body does not begin with "id=", then I append the message body to the previous line.
I parse all expected keyword="value" tokens into database fields where fieldname=keyword and field contents = value.
Any unparsed text is thrown into a database field labelled "Comments".

With this arrangement, I am able to pick up the occurrences of "[WARN-070] Too many failed logins", which appear on a continuation line.

But...

you wanted to pick up the id="3006" name="OTP verification did not succeed, failing authentication." entries, and they don't fit my model. They contain an "id=" clause, so they get their own database record. Also, they come before the 3005 entry which contains the username.

Solution:

Give each row in the file a sequential number, then you can match using sequence numbers.

First, find the OTP errors based on text match.
Then the immediately preceding sequence number should be the "3006-Trying" message. This identifies the server.
Then the immediately following sequence number should be the id="3005" entry (to get the username and source IP).

Even in the context with multiple servers, I think the 3005 entry will always be the next sequence number, because after an explicit fail, it does not try any additional servers.

RE: Does anyone have a list of possible authentication failures UTM can generate?

Daniel James1 — Wed, 03 Oct 2018 02:29:27 GMT

Hi.

Thank you, I'll take another look.

RE: Does anyone have a list of possible authentication failures UTM can generate?

DouglasFoster — Tue, 02 Oct 2018 20:46:31 GMT

There really are not many ways to do a login incorrectly: wrong username/password or wrong OTP.

I have parsed the log files, and concluded that the rows with id="3004 name="Authentication successful" or id="3005" name="Authentication failed" are all that matter. They gives you the IP, username, and timestamp. For successes, it gives you the type of authentication service that issued the approval.