Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: targetted SSH bruteforce attacks
From: Samuel Martín Moro <faust64 () gmail com>
Date: Thu, 17 Jun 2010 16:21:45 +0200

I also don't want to change my ssh port, nor restrict incoming IPs, ... and
I use keys only to log in without entering password.
So you're not alone.
I had my IP changed several times, my servers are only hosting personal
data.
But I'm still seeing bruteforce attemps in my logs.

Here's something I use on my servers.
In cron, every 5-10 minutes, that should do it.
Of course, if you're running *BSD, pf is way more interesting to do that.


---

#!/bin/sh

AUTH=/var/log/auth.log
BKLST=/var/log/blacklist.log
HOSTS=/etc/hosts
DHOSTS=/etc/hosts.deny
LOCAL_IP=_your_ip_

cat $AUTH | egrep -i "(failed|illegal|invalid)" | awk -F "from" '{ print $2
}' | awk '{ print $1 }' | sort -u >$BKLST

for i in `cat $BKLST`
do
    test `cat $AUTH | egrep -i "(failed|illegal|invalid)" | grep $i | wc
-l` -ge 3 || continue
    test "`echo $i | grep $LOCAL_IP`" && continue
    test "`cat $HOSTS | grep $i`" && continue
    test "`cat $DHOSTS | grep $i`" && continue
    echo "ALL : $i  # matched on `date`" >>$DHOSTS
done

---

Samuel Martín Moro
{EPITECH.} tek4
CamTrace S.A.S

"Nobody wants to say how this works.
 Maybe nobody knows ..."
                     Xorg.conf(5)


On Thu, Jun 17, 2010 at 1:48 PM, Gary Baribault <gary () baribault net> wrote:

Hello list,

   I have a strange situation and would like information from the
list members. I have three Linux boxes exposed to the Internet. Two of
them are on cable modems, and both have two services that are publicly
available. In both cases, I have SSH and named running and available
to the public. Before you folks say it, yes I run SSH on TCP/22 and no
I don't want to move it to another port, and no I don't want to
restrict it to certain source IPs.

   Both of these systems are within one /21 and get attacked
regularly. I run Denyhosts on them, and update the central server once
an hour with attacking IPs, and obviously also download the public
hosts.deny list.

   These machines get hit regularly, so often that I don't really
care, it's fun to make the script kiddies waste their time! But in
this instance, only my home box is being attacked... someone is
burning a lot of cycles and hosts to do a distributed dictionary
attack on my one box! The named daemon is non recursive, properly
configured, up to date and not being attacked.

   Is anyone else seeing this type of attack? Or is someone really
targeting MY box?

Thanks


Gary Baribault
Courriel: gary () baribault net
GPG Key: 0x685430d1
Signature: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault