Example Configuration

# Fire events on all failed logins
beacons:
  btmp: []

# Matching on user name, using a default time range
beacons:
  btmp:
    - users:
        gareth:
    - defaults:
        time_range:
            start: '8am'
            end: '4pm'

# Matching on user name, overriding the default time range
beacons:
  btmp:
    - users:
        gareth:
            time_range:
                start: '8am'
                end: '4pm'
    - defaults:
        time_range:
            start: '8am'
            end: '4pm'

# Matching on group name, overriding the default time range
beacons:
  btmp:
    - groups:
        users:
            time_range:
                start: '8am'
                end: '4pm'
    - defaults:
        time_range:
            start: '8am'
            end: '4pm'

Use Case: Posting Failed Login Events to Slack

This can be done using the following reactor SLS:

report-wtmp:
  runner.salt.cmd:
    - args:
      - fun: slack.post_message
      - channel: mychannel      # Slack channel
      - from_name: someuser     # Slack user
      - message: "Failed login from `{{ data.get('user', '') or 'unknown user' }}` on `{{ data['id'] }}`"

Match the event like so in the master config file:

reactor:

  - 'salt/beacon/*/btmp/':
    - salt://reactor/btmp.sls

slack:
  api_key: xoxb-XXXXXXXXXXXX-XXXXXXXXXXXX-XXXXXXXXXXXXXXXXXXXXXXXX

salt.beacons.btmp.beacon(config)

Read the last btmp file and return information on the failed logins

salt.beacons.btmp.validate(config)

Validate the beacon configuration