# ssh-detect-bruteforcing: auth\_success and auth\_attempts are not recorded in ssh.log **URL:** \ **Category:** Zeek\ **Created:** [October 19, 2020, 2:08pm UTC](https://community.zeek.org/t/ssh-detect-bruteforcing-auth-success-and-auth-attempts-are-not-recorded-in-ssh-log/6252 "2020-10-19T14:08:49Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![seshu.pyla](https://avatars.discourse-cdn.com/v4/letter/s/8491ac/32.png) [@seshu.pyla](https://community.zeek.org/u/seshu.pyla)\ **Post date:** [October 19, 2020, 2:08pm UTC](https://community.zeek.org/t/ssh-detect-bruteforcing-auth-success-and-auth-attempts-are-not-recorded-in-ssh-log/6252/1 "2020-10-19T14:08:49Z")
Hi, I am new to the bro(/zeek), and learning how it can be used as IDS in my Debian system. I have installed bro and trying a simple bro script for detecting ssh bruteforcing. bro version 2.5.5 used below command to monitor and check if it detects the ssh bruteforcing bro -C -i enp0s3 /usr/share/bro/policy/protocols/ssh/detect-bruteforcing.bro from second machine i have attempted to login the bro mornitoring system with wrong passwords. and i have checked ssh.log in the bro monitoring system, and i see empty fields for the fields auth\_success and auth\_attempts. ---
**Author:** ![seshu.pyla](https://avatars.discourse-cdn.com/v4/letter/s/8491ac/32.png) [@seshu.pyla](https://community.zeek.org/u/seshu.pyla)\ **Post date:** [October 23, 2020, 9:28am UTC](https://community.zeek.org/t/ssh-detect-bruteforcing-auth-success-and-auth-attempts-are-not-recorded-in-ssh-log/6252/2 "2020-10-23T09:28:06Z")
Hi, I learnt that in the above log the following two fields are not recorded "auth\_success" & "auth\_attempts" and so it can not detect bruteforcing. after googling i found that recording "auth\_attempts" and "auth\_success" is fixed in version 2.6. [https://github.com/zeek/zeek/issues/192](https://github.com/zeek/zeek/issues/192) But when i apply the patch [https://github.com/zeek/zeek/commit/46f727a6fa327e09d246d02148a2f5141512bc5a](https://github.com/zeek/zeek/commit/46f727a6fa327e09d246d02148a2f5141512bc5a) to Bro version source code 2.5 i could still see the same problem not recorded "auth\_success" & "auth\_attempts" Kindly guide me to fix this problem in version 2.5 Thanks venkata. ---
**Author:** ![Richard\_Bejtlich](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/richard_bejtlich/32/597_2.png) [@Richard\_Bejtlich](https://community.zeek.org/u/Richard_Bejtlich)\ **Post date:** [October 23, 2020, 10:59am UTC](https://community.zeek.org/t/ssh-detect-bruteforcing-auth-success-and-auth-attempts-are-not-recorded-in-ssh-log/6252/3 "2020-10-23T10:59:14Z")
Hello, It’s not a good idea to run Bro 2.5.5. It’s unsupported and has security vulnerabilities. Sincerely, Richard ---
**Author:** ![Ankith\_Kumar\_Hanuman](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@Ankith\_Kumar\_Hanuman](https://community.zeek.org/u/Ankith_Kumar_Hanuman)\ **Post date:** [October 24, 2020, 3:48pm UTC](https://community.zeek.org/t/ssh-detect-bruteforcing-auth-success-and-auth-attempts-are-not-recorded-in-ssh-log/6252/4 "2020-10-24T15:48:31Z")
You could probably detect it by using the conn.log too. In theory lots of similar sized smalk responses to same source host where it does not look like much is changing might be brute force. This assumes both the connection rate for new sessions are too numerous (but you need to account by for slower brute forces) and that the session seems short and smalk amounts of data, you would assume a deny would be similarly sized each time during a failed session. Also you would assume there would be more than average unique ssh.log and conn.log entries. Hassh plugin may help too as you could identify no standard clients too by hashes and encryption used like how ja3 works. This would help identify actual nonstandard brute forcing tools by values, encryption and uniqueness in the environment if not using standard tools and just scripting them ---
**Author:** ![seshu.pyla](https://avatars.discourse-cdn.com/v4/letter/s/8491ac/32.png) [@seshu.pyla](https://community.zeek.org/u/seshu.pyla)\ **Post date:** [October 27, 2020, 5:37am UTC](https://community.zeek.org/t/ssh-detect-bruteforcing-auth-success-and-auth-attempts-are-not-recorded-in-ssh-log/6252/5 "2020-10-27T05:37:03Z")
Thank you Richard for your comment, we were using Debian based system (buster version) where it uses bro version 2.5, and we were evaluating to use Bro in our systems but facing this problem (could not detect brute-forcing). I have tried applying this patch [https://github.com/zeek/zeek/commit/46f727a6fa327e09d246d02148a2f5141512bc5a](https://github.com/zeek/zeek/commit/46f727a6fa327e09d246d02148a2f5141512bc5a) but still no use. Please suggest me if i can fix this issue in version 2.5 Thanks venkata ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/ssh-detect-bruteforcing-auth-success-and-auth-attempts-are-not-recorded-in-ssh-log/6252/6 "2022-05-06T15:47:29Z")