Full Disclosure mailing list archives
Re: targetted SSH bruteforce attacks
From: Gary Baribault <gary () baribault net>
Date: Thu, 17 Jun 2010 11:28:04 -0400
On this system, there is only one user allowed, and that's me. On one of my other systems, where two, but both good security guys. I run a bash script every night to grep the successful and unsuccessful logins every night that is mailed to me, that's how I spot these things quick. Also Denyhosts emails me for every Deny. Gary Baribault Courriel: gary () baribault net GPG Key: 0x685430d1 Signature: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1 On 06/17/2010 10:56 AM, Michael Holstein wrote:
Is anyone else seeing this type of attack? Or is someone really targeting MY box?No, I assure you it's not just you. It's also not uncommon to see a sequential (basically a nmap -p 22) scan at full throttle several times a day. You can basically : a) move to another port (obscurity .. but pretty effective in weeding out the casual versus committed) b) switch to public key only auth (recommended anyway if possible). c) use denyhosts, tarpitting, etc. to frustrate the casual guessers and bots. The ones that are committed will find a way around (a) and (c). But it will take somebody a long time to properly guess a key for (b) .. unless you forgot to patch your Debian SSHd from their little snafu .. but you'd have been owned long ago if that was the case. If you really must use passwords on a multi-user system listening on tcp/22, then employ something like the PAM modules for JTR (/pam_passwdqc) /just to make sure people don't use stupid ones. Cheers, Michael Holstein Cleveland State University
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [SECURITY] [DSA 2062-1] New sudo packages fix environment sanitization bypass vulnerability Giuseppe Iuculano (Jun 17)
- targetted SSH bruteforce attacks Gary Baribault (Jun 17)
- Re: targetted SSH bruteforce attacks Emmanuel VERCHERE (Jun 17)
- Re: targetted SSH bruteforce attacks Gary Baribault (Jun 17)
- Re: targetted SSH bruteforce attacks Randal L. Schwartz (Jun 17)
- Re: targetted SSH bruteforce attacks Paul Schmehl (Jun 17)
- Re: targetted SSH bruteforce attacks Emmanuel VERCHERE (Jun 17)
- Re: targetted SSH bruteforce attacks Adam Richards (Jun 17)
- Re: targetted SSH bruteforce attacks Gary Baribault (Jun 17)
- Re: targetted SSH bruteforce attacks Valdis . Kletnieks (Jun 17)
- Re: targetted SSH bruteforce attacks Michael Holstein (Jun 17)
- Re: targetted SSH bruteforce attacks Gary Baribault (Jun 17)
- Re: targetted SSH bruteforce attacks Bipin Gautam (Jun 17)
- targetted SSH bruteforce attacks Gary Baribault (Jun 17)
- Re: targetted SSH bruteforce attacks Gregory Bellier (Jun 17)
- Re: targetted SSH bruteforce attacks Gary Baribault (Jun 17)
- Re: targetted SSH bruteforce attacks Samuel MartÃn Moro (Jun 17)
- Re: targetted SSH bruteforce attacks yersinia (Jun 23)
- Re: targetted SSH bruteforce attacks Cody Robertson (Jun 23)
- Re: targetted SSH bruteforce attacks Gary Baribault (Jun 23)
- Re: targetted SSH bruteforce attacks Cody Robertson (Jun 23)
- Re: targetted SSH bruteforce attacks Paul Schmehl (Jun 17)