- WLUG - wlug.mailman3.com

Re: [Wlug] SSH problems

by William Smith

This might be of interest: http://www.fail2ban.org/wiki/index.php/Main_Page Basically, it detects hack attempts and locks off the offending IP address for about five minutes by modifying firewall rules. I've only started looking at it myself, but I know others that use it and it seems to work well. Bill Smith Fall River, MA Charter Member of LOPSA On Tue, Sep 30, 2008 at 8:03 PM, Alex Camilo <alex.camilo(a)gmail.com> wrote: > assuming the set of attacker IPs is finite. could you keep a running log of > IPs discard duplicates and add it to a block list for the duration of > the attack? > > On Tue, Sep 30, 2008 at 4:07 PM, Chuck Anderson <cra(a)wpi.edu> wrote: >> >> On Tue, Sep 30, 2008 at 03:54:52PM -0400, Alex Camilo wrote: >> > <clueless_newbie>just out of curiosity. >> > Could this be an attack from some sort of botnet? would that explain the >> > different IPs? >> >> Yes >> >> > or is he forging packets? >> > </clueless_newbie> >> >> Unlikely >> _______________________________________________ >> Wlug mailing list >> Wlug(a)mail.wlug.org >> http://mail.wlug.org/mailman/listinfo/wlug > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Oct. 1, 2008

Re: [Wlug] SSH problems

by Eric Martin

Alex Camilo wrote: > assuming the set of attacker IPs is finite. could you keep a running log > of IPs discard duplicates and add it to a block list for the duration of > the attack? > > On Tue, Sep 30, 2008 at 4:07 PM, Chuck Anderson <cra(a)wpi.edu > <mailto:cra@wpi.edu>> wrote: > > On Tue, Sep 30, 2008 at 03:54:52PM -0400, Alex Camilo wrote: > > <clueless_newbie>just out of curiosity. > > Could this be an attack from some sort of botnet? would that > explain the > > different IPs? > > Yes > > > or is he forging packets? > > </clueless_newbie> > > Unlikely > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > http://mail.wlug.org/mailman/listinfo/wlug > > > > ------------------------------------------------------------------------ > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug I forgot to mention that the box is also a webserver that clients log into, so blocking IPs (other than ssh) may keep people from accessing a website...It's moving slowly also, (s)he is on ajs right now, as opposed to ach when I sent the original email... -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Oct. 1, 2008

Re: [Wlug] SSH problems

by Alex Camilo

assuming the set of attacker IPs is finite. could you keep a running log of IPs discard duplicates and add it to a block list for the duration of the attack? On Tue, Sep 30, 2008 at 4:07 PM, Chuck Anderson <cra(a)wpi.edu> wrote: > On Tue, Sep 30, 2008 at 03:54:52PM -0400, Alex Camilo wrote: > > <clueless_newbie>just out of curiosity. > > Could this be an attack from some sort of botnet? would that explain the > > different IPs? > > Yes > > > or is he forging packets? > > </clueless_newbie> > > Unlikely > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Oct. 1, 2008

Re: [Wlug] SSH problems

by Eric Martin

Chuck Anderson wrote: > On Tue, Sep 30, 2008 at 03:54:52PM -0400, Alex Camilo wrote: >> <clueless_newbie>just out of curiosity. >> Could this be an attack from some sort of botnet? would that explain the >> different IPs? > > Yes > >> or is he forging packets? >> </clueless_newbie> > > Unlikely > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug agreed -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Sept. 30, 2008

Re: [Wlug] SSH problems

by Tim Keller

It most definitly is. If you expose a box with default ports for any amount of time you'll see all sorts of fun stuff taking a wack at it. If you need to connect from random places, and you can keep your keys safe, going key only and then moving the port is probably going to keep you pretty safe. On 9/30/08, Alex Camilo <alex.camilo(a)gmail.com> wrote: > <clueless_newbie>just out of curiosity. > Could this be an attack from some sort of botnet? would that explain the > different IPs? > or is he forging packets? > </clueless_newbie> > > On Tue, Sep 30, 2008 at 1:43 PM, Eric Martin <freak4uxxx(a)gmail.com> wrote: > >> I have an outward facing ssh box at work that is currently being >> attacked. somebody's going through a dictionary attack of usernames; >> currently he or she is on abl. I can't block the IP Address because the >> ip is different with each username. Does anybody have any good ideas on >> how to stop this? I'm probably going to move the ssh port to some >> random high number to get rid of this, but I don't know yet if anybody >> else ssh's in besides me. >> >> Thanks in advance >> -- >> Eric Martin >> Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F >> >> >> _______________________________________________ >> Wlug mailing list >> Wlug(a)mail.wlug.org >> http://mail.wlug.org/mailman/listinfo/wlug >> >> > -- Sent from Gmail for mobile | mobile.google.com I am weary of the allegiances of any politician who refers to their constituents as "consumers".

Sept. 30, 2008

Re: [Wlug] SSH problems

by Chuck Anderson

On Tue, Sep 30, 2008 at 03:54:52PM -0400, Alex Camilo wrote: > <clueless_newbie>just out of curiosity. > Could this be an attack from some sort of botnet? would that explain the > different IPs? Yes > or is he forging packets? > </clueless_newbie> Unlikely

Sept. 30, 2008

Re: [Wlug] SSH problems

by Alex Camilo

<clueless_newbie>just out of curiosity. Could this be an attack from some sort of botnet? would that explain the different IPs? or is he forging packets? </clueless_newbie> On Tue, Sep 30, 2008 at 1:43 PM, Eric Martin <freak4uxxx(a)gmail.com> wrote: > I have an outward facing ssh box at work that is currently being > attacked. somebody's going through a dictionary attack of usernames; > currently he or she is on abl. I can't block the IP Address because the > ip is different with each username. Does anybody have any good ideas on > how to stop this? I'm probably going to move the ssh port to some > random high number to get rid of this, but I don't know yet if anybody > else ssh's in besides me. > > Thanks in advance > -- > Eric Martin > Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Sept. 30, 2008

Re: [Wlug] SSH problems

by Eric Martin

Gary Hanley wrote: > On Tue, 30 Sep 2008, Tal Cohen wrote: >> Do you know the IP addresses of the users that ARE authorized to SSH into >> the system? If so, add them to /etc/hosts.allow. >> Tal > > Assuming you have TCP Wrappers built into your server of course. > Maybe it's built in by default there days. I haven't built an SSH > Server from source in a long time. > > But if you do have it installed I believe you can add the offending IP > in /etc/hosts.deny which would be much easier. And even better-er, if > the attacker is coming from one IP and you have a firewall it would be > more efficient to stop them there before they reach the SSH service. > > -- Gary > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug Coming from multiple points so that kills the stopping them at the firewall. I could stop them through hosts.allow/deny though... -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Sept. 30, 2008

Re: [Wlug] SSH problems

by Eric Martin

Tal Cohen wrote: > Do you know the IP addresses of the users that ARE authorized to SSH into > the system? If so, add them to /etc/hosts.allow. > > Tal > > -----Original Message----- > From: wlug-bounces(a)mail.wlug.org [mailto:wlug-bounces@mail.wlug.org] On > Behalf Of Eric Martin > Sent: Tuesday, September 30, 2008 1:44 PM > To: Worcester Linux Users Group > Subject: [Wlug] SSH problems > > I have an outward facing ssh box at work that is currently being attacked. > somebody's going through a dictionary attack of usernames; currently he or > she is on abl. I can't block the IP Address because the ip is different > with each username. Does anybody have any good ideas on how to stop this? > I'm probably going to move the ssh port to some random high number to get > rid of this, but I don't know yet if anybody else ssh's in besides me. > > Thanks in advance > -- > Eric Martin > Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug I like it, but I might need access from some random place. Granted I could always vpn into work and then ssh from that known ip... I'll think about it, thanks for the idea! -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Sept. 30, 2008

Re: [Wlug] SSH problems

by Eric Martin

Chuck Anderson wrote: > On Tue, Sep 30, 2008 at 01:43:46PM -0400, Eric Martin wrote: >> I have an outward facing ssh box at work that is currently being >> attacked. somebody's going through a dictionary attack of usernames; >> currently he or she is on abl. I can't block the IP Address because the >> ip is different with each username. Does anybody have any good ideas on >> how to stop this? I'm probably going to move the ssh port to some >> random high number to get rid of this, but I don't know yet if anybody >> else ssh's in besides me. >> >> Thanks in advance > > You could always just ignore it. Especially if you turn off password > authentication and require users to use SSH RSA keys. Then no matter > what dictionary attack it attempted, it will never work. > > I got sick of hearing my hard drive logging all the failed attempts > and finally resorted to moving the SSH port. > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug Yeah, I'm only allowing PKI to authenticate via ssh. I tried to move the port but a firewall (or two) is blocking the high level stuff so I have to trace through and see where it is. I need to document the server so I'm probably going to fix the firewall / move the port then. thanks! -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Sept. 30, 2008