SSH Forensics Analysis

SSH forensics involves the collection, preservation, and analysis of evidence related to SSH connections and activities. This process helps security professionals investigate potential security incidents, detect unauthorized access, and understand attack patterns.

SSH Log Analysis

SSH logs are a primary source of evidence in SSH forensic investigations. They record authentication attempts, successful logins, and various SSH-related activities.

Common SSH Log Locations

# Debian/Ubuntu
/var/log/auth.log

# RHEL/CentOS/Fedora
/var/log/secure

# OpenBSD
/var/log/authlog

# FreeBSD
/var/log/auth.log

# Systemd Journal
journalctl _COMM=sshd

Key Log Entry Types

• Authentication Attempts: Records of login attempts, both successful and failed
• Session Establishment: Information about established SSH sessions
• Key-Based Authentication: Records of key-based authentication attempts
• Connection Closures: Information about terminated SSH connections
• Configuration Changes: Records of changes to SSH server configuration

Log Analysis Techniques

Several techniques can be used to effectively analyze SSH logs:

# Find failed login attempts
grep "Failed password" /var/log/auth.log

# Find successful logins
grep "Accepted" /var/log/auth.log

# Count login attempts by IP
grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr

# Find login attempts for specific user
grep "Failed password.*for root" /var/log/auth.log

SSH Artifact Analysis

Beyond logs, various SSH-related artifacts can provide valuable forensic evidence.

SSH Configuration Analysis

Examining SSH server and client configurations can reveal unauthorized changes or security weaknesses.

# Server configuration
/etc/ssh/sshd_config

# Client configuration
/etc/ssh/ssh_config
~/.ssh/config

# Host keys
/etc/ssh/ssh_host_*_key
/etc/ssh/ssh_host_*_key.pub

SSH Key Analysis

Analyzing SSH keys can help identify unauthorized access methods or backdoors.

Key Files to Examine

• Authorized Keys: ~/.ssh/authorized_keys files for all users
• Known Hosts: ~/.ssh/known_hosts files for connection history
• User Private Keys: ~/.ssh/id_* files for potential exfiltration
• Host Keys: /etc/ssh/ssh_host_*_key files for potential tampering

# Find all authorized_keys files
find / -name "authorized_keys" -type f 2>/dev/null

# Check creation/modification times
stat ~/.ssh/authorized_keys

# Extract key fingerprints
for key in $(cat ~/.ssh/authorized_keys); do echo $key | ssh-keygen -lf -; done

Memory Analysis

Analyzing system memory can reveal active SSH sessions, decrypted keys, and other volatile evidence.

SSH Network Forensics

Analyzing network traffic can provide insights into SSH connection patterns and potential data exfiltration.

SSH Traffic Analysis

While SSH traffic is encrypted, metadata analysis can still provide valuable information.

# Capture SSH traffic
tcpdump -i eth0 -n "tcp port 22" -w ssh_traffic.pcap

# Analyze SSH connections
tcpdump -r ssh_traffic.pcap -n "tcp[tcpflags] & (tcp-syn|tcp-fin) != 0"

# Analyze SSH data transfer volumes
tcpdump -r ssh_traffic.pcap -n "tcp port 22" | awk '{print $3}' | sort | uniq -c

SSH Tunnel Detection

Detecting SSH tunnels used for data exfiltration or command and control.

SSH Timeline Analysis

Creating a timeline of SSH-related events can help understand the sequence and context of suspicious activities.

Creating an SSH Activity Timeline

Combining timestamps from various sources to create a comprehensive timeline.

# Extract SSH events with timestamps
grep sshd /var/log/auth.log | awk '{ $1=$1; $2=$2; $3="" ; print $0}' | sort -k1,2

# Combine with file modification times
find ~/.ssh -type f -exec stat --format="%y %n" {} \; | sort

SSH Forensics Case Studies

Case Study: Brute Force Attack Detection

Identifying and analyzing a brute force SSH attack through log analysis.

Brute Force Attack Indicators

• Multiple failed login attempts from the same IP address
• Failed attempts for multiple usernames
• Regular timing patterns in login attempts
• Attempts originating from known malicious IP ranges

Case Study: SSH Backdoor Detection

Identifying an SSH backdoor through configuration and artifact analysis.

Essential SSH Forensics Tools

Several specialized tools can assist in SSH forensic investigations:

• Log2Timeline/Plaso: Timeline creation and analysis tool
• Volatility: Memory forensics framework
• The Sleuth Kit: Disk image forensics toolkit
• Wireshark: Network traffic analysis tool
• OSSEC: Host-based intrusion detection system with SSH monitoring
• ELK Stack: Log collection, analysis, and visualization platform

SSH Forensics Best Practices

Follow these best practices for effective SSH forensic investigations: