Full Disclosure mailing list archives
Re: SSH brute force blocking tool
From: Raphael Marichez <falco () gentoo org>
Date: Fri, 1 Dec 2006 15:02:26 +0100
On Fri, 01 Dec 2006, J. Oquendo wrote:
Tonnerre Lombard wrote:In this case, your awk statement checks that argument $6 is "Illegal" (which it is) and argument $9 is "from" (which it is). So it takes $10 and prints it (in this case, mars.) If you check $10 to look like an IP address, I set my username to "bikermice from 217.14.64.1", you're going to blacklist 217.14.64.1 because it is a valid IP. TonnerreSo again... Some of you guys need to go back and read before you post....
ok, you're right, let's go back and let's read again: You mention (from the attached mail, you've written): Nov 27 16:31:21 local sshd[67010]: Illegal user dd from 213.134.128.227 awk '($5=="Illegal"||$6=="Illegal")&&$9=="from"{print $10}' Note that there is no "NF" in this line.
awk 'NF<=10&&($6=="nvalid"||$7=="user")&&$9=="from"{print $10}'
you're fixing your script when someone shows a security hole, that's a good practice. But don't insult the men who mention the vulnerabilities... They are actually helping you, because you're improving your script thanks to them.
Once you try a moronic name insertion it makes the columns more than 10 rows invalidating it. Is this a difficult concept to understand? Set your host to whatever you would like, its been discussed and resolved. Is there anything else? Perhaps I should re-write TCP into the script to ensure no one ever spoofs again.
-- Raphaƫl Marichez aka Falco
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: SSH brute force blocking tool Tonnerre Lombard (Dec 01)
- Re: SSH brute force blocking tool J. Oquendo (Dec 01)
- Re: SSH brute force blocking tool Tonnerre Lombard (Dec 01)
- Re: SSH brute force blocking tool J. Oquendo (Dec 01)
- Re: SSH brute force blocking tool Raphael Marichez (Dec 01)
- Re: SSH brute force blocking tool Raphael Marichez (Dec 01)
- Re: SSH brute force blocking tool J. Oquendo (Dec 01)
- Re: SSH brute force blocking tool Tonnerre Lombard (Dec 01)
- <Possible follow-ups>
- Re: SSH brute force blocking tool Simon Smith (Dec 05)
- Re: SSH brute force blocking tool J. Oquendo (Dec 01)