Date: Thu Mar  2 16:36:39 2006
From: ben at psc.edu (Benjamin Bennett)
Subject: reduction of brute force login attempts via
	SSHthrough iptables --hashlimit

On Thu, 2006-03-02 at 17:23 +0100, GroundZero Security wrote:
> Well i dont want to destroy your happy time where you can feel superior, but
> if you would read the manpage of lastb you would notice that this approach wont work at all.
> lastb just shows successfull logins! not all the attempted logins....we discussed that before though,
> so better pay attention next time.
> 
> Another thing is that on many systems btmp is not present and thus lastb wouldnt work even if it
> would show failed logins.
> 
> NAME
>        last, lastb - show listing of last logged in users
> 
> SYNOPSIS
>        last [-R] [-num] [ -n num ] [-adiox] [ -f file ] [name...]  [tty...]
>        lastb [-R] [-num] [ -n num ] [ -f file ] [-adiox] [name...]  [tty...]
> 
> DESCRIPTION
>        Last  searches  back  through  the  file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all
> users logged in (and out)
>        since that file was created.
>        ....

...and a little farther down...

  "Lastb is the same as last, except that by default it shows a  log  of
the file /var/log/btmp, which contains all the bad login attempts."

> as you can see it only logs "logged in" users not all those that tried. so your script is useless.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060302/ce7e4807/attachment.bin

Hosted by DataForce ISP - Powered by Openwall GNU/*/Linux