| 1 |
Hi Mick, |
| 2 |
|
| 3 |
Mick wrote on 01/04/07 20:44: |
| 4 |
>> Recently I was looking through my logs when I got pissed off (again) by |
| 5 |
>> the big number of lines showing something like 'sshd: auth. error: |
| 6 |
>> unknown user "XXX" from "some IP address"'. I wrote a script which |
| 7 |
>> automatically sets all connections from those IP addresses to be |
| 8 |
>> dropped. Next I decided to change "-j DROP" with "-j TARPIT" and I |
| 9 |
>> realized that gentoo-sources doesn't provide the netfilter target "TARPIT". |
| 10 |
|
| 11 |
> Given that others have already replied how patch the kernel, here's a somewhat |
| 12 |
> indirect answer which may resolve the route cause: Are you using passwd |
| 13 |
> authentication? I wonder if the logs would still be filling up by such |
| 14 |
> botnets if you had allowed only 'PubkeyAuthentication yes'. The other thing |
| 15 |
> to consider is changing the default ssh port 22 to some other random port |
| 16 |
> which is not hit as frequently by botnets, only by more comprehensive port |
| 17 |
> scans. Then remove your iptables LOG rule for port 22 (if you have one) and |
| 18 |
> you should get rid of almost all related messages. |
| 19 |
|
| 20 |
Daniel complained about the sshd messages, not iptables messages. |
| 21 |
|
| 22 |
I fully agree that he should implement pub/priv key authentication, but |
| 23 |
even so, that will not prevent the flood of ssh messages in syslog. |
| 24 |
|
| 25 |
Adding an unlogged iptables DROP target rule for port 22 will suppress |
| 26 |
the messages, but not the attacks. |
| 27 |
|
| 28 |
The botnet / script kiddie morons are a pain in the (anatomy of choice). |
| 29 |
|
| 30 |
Cheers, Dave |
| 31 |
-- |
| 32 |
gentoo-user@g.o mailing list |
Archives