Extend syslog SSH record handling to current OpenSSH releases #5183

[kev365]

Implements #5183.

OpenSSH 9.8 split the server into a listener binary, sshd, and a per-session binary,
sshd-session, which writes the authentication messages. This recognises both reporter names and
extends three of the sshd structures to the message forms current releases write.

The per-session reporter name

_SSHD_REPORTERS holds both names and the dispatch in both plugins uses it. sshd is kept because
the listener still writes its own messages, such as Server listening on 0.0.0.0 port 22.

Key fingerprints

The existing structure matches a key type followed by a colon separated hexadecimal digest, which is
the MD5 form. sshd_config(5) gives the default for FingerprintHash as sha256, so the value now
written is the hash name followed by base64, which can contain + and /. Both forms are matched.

Note the hexadecimal form is tried first: the hash name pattern would otherwise match 00:aa of
00:aa:bb:cc and leave the remainder unparsed.

The ssh2 suffix on unsuccessful authentication

_SSHD_LOGIN already expects ssh2 after the port number. _SSHD_FAILED_CONNECTION ended at the
port, so it now accepts the same optional suffix. test_data/syslog/syslog_ssh.log:6 is a record in
that form and has been in the repository since the file was added.

User names

_SSH_USERNAME matched letters and digits. It is now determined by the text preceding from,
since sshd logs the name as provided by the client, which is not limited to the characters
useradd accepts. Service and directory accounts commonly contain a hyphen, underscore or dot.

Measured effect

Two /var/log/auth.log files from hosts either side of the OpenSSH 9.8 change, run through
log2timeline.py and pinfo.py:

	before	after
Ubuntu 26.04, OpenSSH 10.2p1	syslog:line 3,406 · syslog:ssh:* 0	syslog:line 3,160 · login 240 · failed_connection 6
Ubuntu 24.04, OpenSSH 9.6p1	syslog:line 242 · login 1	syslog:line 221 · login 17 · failed_connection 5

Total event count is unchanged in both cases, 3,409 and 246. No new timeline events are
produced; records that previously took the syslog:line path now take the SSH one.

Four tagging rules in plaso/data/tag_linux.txt that look for a reporter of sshd also apply again
on hosts running the current release.

Backward compatibility

No attribute is removed or renamed and no new data type is added; the three existing SSH data types
are reused, so their formatter and timeliner entries are unchanged. The colon separated hexadecimal
fingerprint form and the unsuffixed unsuccessful form both still parse, and
tests/parsers/text_plugins/syslog.py asserts on records of each.

The verification grammar is untouched, so the plugins claim exactly the same files.

Test data

test_data/syslog/syslog_sshd_session.log — eight records from a Fedora 44 host running OpenSSH
10.2p1, covering the per-session reporter, a base64 fingerprint, user names containing a hyphen, a
dot and an underscore, unsuccessful authentication with the ssh2 suffix, and two messages the
structures do not define, which are retained as syslog:line.

testProcessSshd now also asserts on the two records of syslog_ssh.log described above, which
were counted but not previously inspected.

Points left open in #5183

These are the questions from the issue. I have taken the smallest option in each case and am happy
to change any of them.

• The fingerprint attribute is kept as a single value, matching how it is stored today, rather
  than splitting out the key type and hash name.
• Unsuccessful authentication for accounts that do not exist, written as Failed password for invalid user …, is not covered here; it fits with the group of messages I offered to raise
  separately.
• The reporter name is handled by an alternation rather than by normalising the name first,
  since normalising would change how every reporter is dispatched.
• No extraction warning is produced when an SSH message does not match. On the hosts I measured,
  around 40% of the messages are ones the structures do not define at all, so a warning for each
  would be a large volume for something that is not an error.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.10%. Comparing base (ae6a054) to head (c7cf290).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5193   +/-   ##
=======================================
  Coverage   85.10%   85.10%           
=======================================
  Files         456      456           
  Lines       41095    41096    +1     
=======================================
+ Hits        34975    34976    +1     
  Misses       6120     6120           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.