1 |
MaxieZ said: |
2 |
> On Mon, Oct 03, 2005 at 10:10:16AM +1300, Jeremy Brake wrote: |
3 |
>> Hey all, |
4 |
>> |
5 |
>> I'm looking for an app/script which can monitor for failed ssh logins, |
6 |
>> and block using IPTables for $time after $number of failed logins (an |
7 |
>> exclusion list would be handy as well) so that I can put a quick stop to |
8 |
>> these niggly brute-force ssh "attacks" I seem to be getting more and |
9 |
>> more often. |
10 |
> |
11 |
> http://kodu.neti.ee/~risto/sec/ |
12 |
> |
13 |
> or change ports |
14 |
|
15 |
Changing ports does a wonderful job of cutting down on spurious connects. |
16 |
Going one tiny step further, I like to know if anyone has ever connected |
17 |
to my sshd. So I do the following: |
18 |
|
19 |
1. Set loglevel for sshd to verbose |
20 |
2. cron a connect report to run once an hour. This tells me the IP and |
21 |
reverse IP address of every host to do a full connect. AFAIK, a full |
22 |
connect would be necessary to see the banner and identify the port as |
23 |
running sshd. |
24 |
|
25 |
My connect-report script is as follows: |
26 |
echo "Remote SSH Connection report for $HOSTNAME" |
27 |
echo "------------------------------------------" |
28 |
echo |
29 |
egrep "Connection from" < /var/log/auth.log | egrep -o |
30 |
[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+ | sort | uniq | /root/bin/phost |
31 |
|
32 |
The above script relies on phost; a small helper script (because I |
33 |
couldn't stand to spend more than 5 minutes trying to figure out which IP |
34 |
lookups would accept input from stdin): |
35 |
#!/usr/bin/perl |
36 |
while (<STDIN>) { |
37 |
$output = `host $_`; |
38 |
print $output; |
39 |
} |
40 |
|
41 |
I have never seen a connect from an IP I didn't expect, and if I ever do, |
42 |
I can just move sshd to another port if I am feeling excessively paranoid. |
43 |
|
44 |
|
45 |
-- |
46 |
gentoo-security@g.o mailing list |