Full Disclosure mailing list archives
Re: SSH brute force blocking tool
From: Tavis Ormandy <taviso () gentoo org>
Date: Tue, 28 Nov 2006 16:32:42 +0000
On Tue, Nov 28, 2006 at 05:14:28PM +0100, Thierry Zoller wrote:
Dear Tavis, TO> J, you have made an attempt to fix it, but is is not sufficient. TO> An attacker can still add arbitrary hosts to the deny list. Can you propose a fix ? Apart from the aggressivness of this thread I find it interesting to read (from a tech standpoint).
openssh can be configured to log to btmp, I would suggest parsing this file, it's format is documented in utmp(5). I wouldnt use a shell script to do so, but I suppose you could use lastb if you really wanted to, something like `lastb -ai ssh:notty | awk '{print $(NF)}'`. I think increasing the codepaths that an unauthenticated attacker can access is always going to be a bad idea, enforcing good password policies via cracklib or jtr and just ignoring the minor irritation of these automated attacks would be a safer bet. Thanks, Tavis. -- ------------------------------------- taviso () sdf lonestar org | finger me for my pgp key. -------------------------------------------------------
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: SSH brute force blocking tool, (continued)
- Re: SSH brute force blocking tool J. Oquendo (Nov 27)
- Re: SSH brute force blocking tool Tonnerre Lombard (Nov 28)
- Re: SSH brute force blocking tool Brian Eaton (Nov 27)
- Re: SSH brute force blocking tool Thierry Zoller (Nov 28)
- Re: SSH brute force blocking tool J. Oquendo (Nov 28)
- Re: SSH brute force blocking tool Tavis Ormandy (Nov 28)
- Re: SSH brute force blocking tool J. Oquendo (Nov 28)
- Re: SSH brute force blocking tool Tavis Ormandy (Nov 28)
- Re: SSH brute force blocking tool J. Oquendo (Nov 28)
- Re: SSH brute force blocking tool Thierry Zoller (Nov 28)
- Re: SSH brute force blocking tool Tavis Ormandy (Nov 28)
- Re: SSH brute force blocking tool Brian Eaton (Nov 28)
- Re: SSH brute force blocking tool Brian Eaton (Nov 28)
- Re: SSH brute force blocking tool Tavis Ormandy (Nov 28)
- Re: SSH brute force blocking tool J. Oquendo (Nov 28)
- Re: SSH brute force blocking tool Tavis Ormandy (Nov 28)
- Re: SSH brute force blocking tool Anders B Jansson (Nov 28)
- Re: SSH brute force blocking tool J. Oquendo (Nov 28)
- Re: SSH brute force blocking tool Thierry Zoller (Nov 28)
- Re: SSH brute force blocking tool Tonnerre Lombard (Nov 30)