RE: SSH Scans - Homebrew dictionary

["Michael L. Benjamin" <mike.benjamin () clarinet com au>]

-----Original Message-----
From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of 
Michel Pereira
Sent: Friday, March 17, 2006 10:44 AM
To: full-disclosure () lists grok org uk
Subject: [Full-disclosure] SSH Scans - Homebrew dictionary

   After of seeing a lot of ssh scans on my firewalls and home PC, I made a script that filters out the "Invalid User" 
entry inside /var/log/messages and do some cleaning process, the result is a dictionary (homebrew) of users that tried 
to login into my hosts.
   Into the dictionary I saw english and Brazilian Portuguese words, maybe we have Brazilian hackers running scan bots 
too.
   This work is only for experiment and curiosity to see what is happening with Internet today, you can get the script 
and dictionary in http://www.michel.eti.br/2006/03/ssh-scans.html

   If you have a better idea of sugestion, please mail me:
"michel () michel eti br"

Bye
--
Só Jesus salva,o homem faz backups.
http://www.michel.eti.br

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



-----------------------------------------------------------

Although not perfect... I like mine better.

(Debugging lines left in)

Of course you can apply it to anything, not just SSH and /var/log/secure. Say /var/log/maillog, or 
/var/log/httpd/access_log and make it do any sort of task, not just block hosts. If anyone has suggestions to improve 
the code in the script, optimise it etc. I'm all ears...

Launch on boot in /etc/rc.local as follows:

Of course the best thing to do is to block SSH at your iptables and only let in the addresses/networks you trust, or 
utilise port knocking or somesuch equally nerdy approach :) Moving SSH off port 22 is a pain, and I don't like 
non-standard port numbering if I can avoid it. Logging into port 31337 is not going to be intuitive for another 
administrator simply trying to start an SSH session. :-)

Redhat /etc/sysconfig/iptables entries:-

-A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xxx.xx.xx -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xx.xxx.x/255.255.255.0 -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xxx.xxx.x/255.255.255.0 -m tcp -p tcp --dport 22 -j ACCEPT

I have run this script successfully for a number of months (about 6) and it works very well. It is structured for
expected output from /var/log/secure on a Redhat server, so you might need to massage it for your own needs.

----------------------------------------------------------------------------------------------------------------
#/etc/rc.local:

# Fire up ssh_brute_blocker security script
/usr/local/scripts/ssh_brute_blocker &

----------------------------------------------------------------------------------------------------------------
#!/bin/ksh
#
# ssh_brute_blocker
#
# xx/xx/2005 xx:xx - Michael L. Benjamin
#

LOG_FILE="/var/log/secure"
DENY_FILE="/etc/hosts.deny"
TMP_FILE=$(mktemp)
INBOUND_IP=""
INLINE=""
GUESS_COUNT=0
PERMIT_GUESS=4

while :
do

tail -10000 ${LOG_FILE} | grep "Failed password for illegal user" | awk -F"from" {'print $2'} | awk {'print $1'} | uniq 
> ${TMP_FILE}

while read -r INBOUND_IP
do
  GUESS_COUNT=0
#  GUESS_COUNT=$(grep ${INBOUND_IP} ${LOG_FILE} | wc -l)
  GUESS_COUNT=$(grep "from ${INBOUND_IP}" /var/log/secure | grep "Failed password for" | wc -l | awk {'print $1'})

#  echo IP: ${INBOUND_IP} made ${GUESS_COUNT} guesses against our server

  if [ ${GUESS_COUNT} -ge ${PERMIT_GUESS} ]
  then
      if grep ${INBOUND_IP} ${DENY_FILE} > /dev/null
      then
#          echo ${INBOUND_IP} is already listed in ${DENY_FILE} ; echo
           echo > /dev/null
      else
#          echo ${INBOUND_IP} is not listed. Adding host ${INBOUND_IP} to ${DENY_FILE} ; echo
          echo "ALL: ${INBOUND_IP}" >> ${DENY_FILE}
          /usr/bin/logger -t ssh_brute_blocker -is Added SSH attacking host ${INBOUND_IP} to ${DENY_FILE} 
[${GUESS_COUNT} attempts].
  fi
  else
#     echo Ignoring host ${INBOUND_IP} less than ${PERMIT_GUESS} wrong guesses.
      echo > /dev/null
  fi

done < ${TMP_FILE}

sleep 30

rm -f ${TMP_FILE}

done

exit 0


-----------------------------------------------------------------------------------------------------------------


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/