Full Disclosure mailing list archives
Re: SSH brute force blocking tool
From: Tonnerre Lombard <tonnerre.lombard () sygroup ch>
Date: Fri, 01 Dec 2006 13:17:26 +0100
Salut, On Fri, 2006-12-01 at 06:59 -0500, J. Oquendo wrote:
Nov 27 16:31:21 local sshd[67010]: Illegal user dd from 213.134.128.227 awk '($5=="Illegal"||$6=="Illegal")&&$9=="from"{print $10}'What if I set my user name to "bikermice from mars"? Are you going to blacklist mars then?Apparently you are as stupid as your question is. The syntax won't allow to pass off anything. Try it before responding idiotically
Did you even try it? And what exactly in this awk statement would prevent me from inserting mars in this case? The log statement would look like this: Nov 27 16:31:21 local sshd[67010]: Illegal user bikermice from mars from 213.134.128.227 In this case, your awk statement checks that argument $6 is "Illegal" (which it is) and argument $9 is "from" (which it is). So it takes $10 and prints it (in this case, mars.) If you check $10 to look like an IP address, I set my username to "bikermice from 217.14.64.1", you're going to blacklist 217.14.64.1 because it is a valid IP. Tonnerre -- SyGroup GmbH Tonnerre Lombard Solutions Systematiques Tel:+41 61 333 80 33 Roeschenzerstrasse 9 Fax:+41 61 383 14 67 4153 Reinach BL Web:www.sygroup.ch tonnerre.lombard () sygroup ch
Attachment:
signature.asc
Description: This is a digitally signed message part
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: SSH brute force blocking tool Tonnerre Lombard (Dec 01)
- Re: SSH brute force blocking tool J. Oquendo (Dec 01)
- Re: SSH brute force blocking tool Tonnerre Lombard (Dec 01)
- Re: SSH brute force blocking tool J. Oquendo (Dec 01)
- Re: SSH brute force blocking tool Raphael Marichez (Dec 01)
- Re: SSH brute force blocking tool Raphael Marichez (Dec 01)
- Re: SSH brute force blocking tool J. Oquendo (Dec 01)
- Re: SSH brute force blocking tool Tonnerre Lombard (Dec 01)
- <Possible follow-ups>
- Re: SSH brute force blocking tool Simon Smith (Dec 05)
- Re: SSH brute force blocking tool J. Oquendo (Dec 01)