diff --git a/LibreNMS/Snmptrap/Handlers/SnTrapUserLogin.php b/LibreNMS/Snmptrap/Handlers/SnTrapUserLogin.php new file mode 100644 index 0000000000..6a4aef888e --- /dev/null +++ b/LibreNMS/Snmptrap/Handlers/SnTrapUserLogin.php @@ -0,0 +1,47 @@ +. + * + * @link https://www.librenms.org + */ + +namespace LibreNMS\Snmptrap\Handlers; + +use App\Models\Device; +use LibreNMS\Interfaces\SnmptrapHandler; +use LibreNMS\Snmptrap\Trap; +use Log; + +class SnTrapUserLogin implements SnmptrapHandler +{ + /** + * Handle snmptrap. + * Data is pre-parsed and delivered as a Trap. + * + * @param Device $device + * @param Trap $trap + * @return void + */ + public function handle(Device $device, Trap $trap) + { + $message = $trap->getOidData($trap->findOid('FOUNDRY-SN-AGENT-MIB::snAgGblTrapMessage.0')); + Log::event("$message", $device->device_id, 'trap', 2); + } +} diff --git a/LibreNMS/Snmptrap/Handlers/SnTrapUserLogout.php b/LibreNMS/Snmptrap/Handlers/SnTrapUserLogout.php new file mode 100644 index 0000000000..db6a25d077 --- /dev/null +++ b/LibreNMS/Snmptrap/Handlers/SnTrapUserLogout.php @@ -0,0 +1,47 @@ +. + * + * @link https://www.librenms.org + */ + +namespace LibreNMS\Snmptrap\Handlers; + +use App\Models\Device; +use LibreNMS\Interfaces\SnmptrapHandler; +use LibreNMS\Snmptrap\Trap; +use Log; + +class SnTrapUserLogout implements SnmptrapHandler +{ + /** + * Handle snmptrap. + * Data is pre-parsed and delivered as a Trap. + * + * @param Device $device + * @param Trap $trap + * @return void + */ + public function handle(Device $device, Trap $trap) + { + $message = $trap->getOidData($trap->findOid('FOUNDRY-SN-AGENT-MIB::snAgGblTrapMessage.0')); + Log::event("$message", $device->device_id, 'trap', 2); + } +} diff --git a/config/snmptraps.php b/config/snmptraps.php index c22ff36b86..87c2fc3de3 100644 --- a/config/snmptraps.php +++ b/config/snmptraps.php @@ -6,7 +6,7 @@ | You can change settings by setting them in the environment or .env | If there is something you need to change, but is not available as an environment setting, | request an environment variable to be created upstream or send a pull request. -*/ + */ return [ 'trap_handlers' => [ @@ -68,6 +68,8 @@ return [ 'FORTINET-FORTIGATE-MIB::fgTrapVpnTunDown' => \LibreNMS\Snmptrap\Handlers\FgTrapVpnTunDown::class, 'FORTINET-FORTIGATE-MIB::fgTrapVpnTunUp' => \LibreNMS\Snmptrap\Handlers\FgTrapVpnTunUp::class, 'FORTINET-FORTIMANAGER-FORTIANALYZER-MIB::fmTrapLogRateThreshold' => \LibreNMS\Snmptrap\Handlers\FmTrapLogRateThreshold::class, + 'FOUNDRY-SN-TRAP-MIB::snTrapUserLogin' => \LibreNMS\Snmptrap\Handlers\SnTrapUserLogin::class, + 'FOUNDRY-SN-TRAP-MIB::snTrapUserLogout' => \LibreNMS\Snmptrap\Handlers\SnTrapUserLogout::class, 'IF-MIB::linkDown' => \LibreNMS\Snmptrap\Handlers\LinkDown::class, 'IF-MIB::linkUp' => \LibreNMS\Snmptrap\Handlers\LinkUp::class, 'JUNIPER-CFGMGMT-MIB::jnxCmCfgChange' => \LibreNMS\Snmptrap\Handlers\JnxCmCfgChange::class, diff --git a/tests/Feature/SnmpTraps/SnTrapUserAuthTest.php b/tests/Feature/SnmpTraps/SnTrapUserAuthTest.php new file mode 100644 index 0000000000..a0fbc7e254 --- /dev/null +++ b/tests/Feature/SnmpTraps/SnTrapUserAuthTest.php @@ -0,0 +1,81 @@ +. + * + * @link https://www.librenms.org + * + * @copyright 2022 Heath Barnhart + * @author Heath Barnhart + */ + +namespace LibreNMS\Tests\Feature\SnmpTraps; + +use App\Models\Device; +use LibreNMS\Snmptrap\Dispatcher; +use LibreNMS\Snmptrap\Trap; + +class SnTrapUserAuthTest extends SnmpTrapTestCase +{ + /** + * Create snTrapUserLogin trap object + * Test SnTrapUserLogin handler + * + * @return void + */ + public function testSnTrapUserLogin() + { + $device = Device::factory()->create(); /** @var Device $device */ + $trapText = "$device->hostname +UDP: [$device->ip]:57602->[192.168.5.5]:162 +SNMPv2-MIB::snmpTrapOID.0 FOUNDRY-SN-TRAP-MIB::snTrapUserLogin +DISMAN-EVENT-MIB::sysUpTimeInstance 172:9:43:55.64 +FOUNDRY-SN-AGENT-MIB::snAgGblTrapMessage.0 \"Security: ssh login by rancid from src IP $device->ip to PRIVILEGED EXEC mode using RSA as Server Host Key. \""; + + $trap = new Trap($trapText); + + $message = "Security: ssh login by rancid from src IP $device->ip to PRIVILEGED EXEC mode using RSA as Server Host Key. "; + \Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 2); + + $this->assertTrue(Dispatcher::handle($trap), 'Could not handle snTrapUserLogin'); + } + + /** + * Create snTrapUserLogout trap object + * Test SnTrapUserLogout handler + * + * @return void + */ + public function testSnTrapUserLogout() + { + $device = Device::factory()->create(); /** @var Device $device */ + $trapText = "$device->hostname +UDP: [$device->ip]:57602->[192.168.5.5]:162 +SNMPv2-MIB::snmpTrapOID.0 FOUNDRY-SN-TRAP-MIB::snTrapUserLogin +DISMAN-EVENT-MIB::sysUpTimeInstance 172:9:43:55.64 +FOUNDRY-SN-AGENT-MIB::snAgGblTrapMessage.0 \"Security: ssh logout by rancid from src IP $device->ip from USER EXEC mode using RSA as Server Host Key. \""; + + $trap = new Trap($trapText); + + $message = "Security: ssh logout by rancid from src IP $device->ip from USER EXEC mode using RSA as Server Host Key. "; + \Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 2); + + $this->assertTrue(Dispatcher::handle($trap), 'Could not handle snTrapUserLogout'); + } +}