Enterasys Security Information and Event Manager, Configuration Manual

Page: 138 / 426

Configuring DSMs
122 G
ENERIC
A
UTHORIZATION
S
ERVER
For example, if your authentication server generates the following log message for
accepted packets:
Jun 27 12:11:21 expo sshd[19926]: Accepted password for root
from 10.100.100.109 port 1727 ssh2
The pattern for successful login is
Accepted password
.
Step 6
Add the following entry to the file:
login_success_pattern=<login success pattern>
Where
<login success pattern>
is the pattern determined in Step 5 .
For example:
login_success_pattern=Accepted password
All entries are case insensitive.
Step 7
Review the file to determine a pattern for login failures.
For example, if your authentication server generates the following log message for
login failures:
Jun 27 12:58:33 expo sshd[20627]: Failed password for root from
10.100.100.109 port 1849 ssh2
The pattern for login failures is
Failed password
.
Step 8
Add the following to the file:
login_failed_pattern=<login failure pattern>
Where
<login failure pattern>
is the pattern determined for login failure.
For example:
login_failed_pattern=Failed password
All entries are case insensitive.
Step 9
Review the file to determine a pattern for logout:
For example, if your authentication server generates the following log message for
logout:
Jun 27 13:00:01 expo su(pam_unix)[22723]: session closed for
user genuser
The pattern for lookout is
session closed.
Step 10
Add the following to the genericAuthServer.conf file:
logout_pattern=<logout pattern>
Where
<logout pattern>
is the pattern determined for logout in Step 9 .
For example:
logout_pattern=session closed
All entries are case insensitive.
Step 11
Review the file to determine a pattern, if present, for source IP address and source
port.