Re: [Full-disclosure] targetted SSH bruteforce attacks

[Gary Baribault <gary@xxxxxxxxxxxxx>]

On this system, there is only one user allowed, and that's me. On one
of my other systems, where two, but both good security guys. I run a
bash script every night to grep the successful and unsuccessful logins
every night that is mailed to me, that's how I spot these things
quick. Also Denyhosts emails me for every Deny.

Gary Baribault
Courriel: gary@xxxxxxxxxxxxx
GPG Key: 0x685430d1
Signature: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1


On 06/17/2010 10:56 AM, Michael Holstein wrote:
>
>> Is anyone else seeing this type of attack? Or is someone really
>> targeting MY box?
>>
>>  
>
> No, I assure you it's not just you.
>
> It's also not uncommon to see a sequential (basically a nmap -p 22) scan
> at full throttle several times a day.
>
> You can basically :
>
> a) move to another port (obscurity .. but pretty effective in weeding
> out the casual versus committed)
> b) switch to public key only auth (recommended anyway if possible).
> c) use denyhosts, tarpitting, etc. to frustrate the casual guessers and
> bots.
>
> The ones that are committed will find a way around (a) and (c). But it
> will take somebody a long time to properly guess a key for (b) ..
> unless you forgot to patch your Debian SSHd from their little snafu ..
> but you'd have been owned long ago if that was the case.
>
> If you really must use passwords on a multi-user system listening on
> tcp/22, then employ something like the PAM modules for JTR
> (/pam_passwdqc) /just to make sure people don't use stupid ones.
>
> Cheers,
>
> Michael Holstein
> Cleveland State University
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/