Re: targetted SSH bruteforce attacks

[Gary Baribault <gary () baribault net>]

Thanks Emmanuel,

    I have to access that box sometimes from other machines than my
own, so I would have to have my key and install it on all kinds of
Windows boxen .. I have extremely good passwords that I change every
30 days, or every time I use a machine that I'm not 100% sure of.

Gary Baribault

Courriel: gary () baribault net
GPG Key: 0x685430d1
Signature: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1


On 06/17/2010 08:45 AM, Emmanuel VERCHERE wrote:
> Hi Gary,
>
> SSH daemons using password auth exposed to the Internet _do_ get
> bruteforce attempts. I would not recommend moving it to a different port
> than 22 as that would be of very, _very_ little help - rather switch to
> public key auth (plus SPA if you're paranoid), et voila.
> I don't think there's someone out there craving for _your_ box - but
> scripts running from compromised hosts, scanning for password-protected
> SSH daemons (as well as a bunch of known exploitable webapps and
> services), trying to reach out for 'fresh meat', and as such expand the
> zombie net? Definitely ;)
>
> Cheers.
>
>
>
> On Thu, 17 Jun 2010 07:48:18 -0400
> Gary Baribault <gary () baribault net> wrote:
>
> > Hello list,
> >
> >     I have a strange situation and would like information from the
> > list members. I have three Linux boxes exposed to the Internet. Two of
> > them are on cable modems, and both have two services that are publicly
> > available. In both cases, I have SSH and named running and available
> > to the public. Before you folks say it, yes I run SSH on TCP/22 and no
> > I don't want to move it to another port, and no I don't want to
> > restrict it to certain source IPs.
> >
> >     Both of these systems are within one /21 and get attacked
> > regularly. I run Denyhosts on them, and update the central server once
> > an hour with attacking IPs, and obviously also download the public
> > hosts.deny list.
> >
> >     These machines get hit regularly, so often that I don't really
> > care, it's fun to make the script kiddies waste their time! But in
> > this instance, only my home box is being attacked... someone is
> > burning a lot of cycles and hosts to do a distributed dictionary
> > attack on my one box! The named daemon is non recursive, properly
> > configured, up to date and not being attacked.
> >
> >     Is anyone else seeing this type of attack? Or is someone really
> > targeting MY box?
> >
> > Thanks
> >
> >
> > Gary Baribault
> > Courriel: gary () baribault net
> > GPG Key: 0x685430d1
> > Signature: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/