full-disclosure - SSH Scans - Homebrew dictionary

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri Mar 17 03:33:43 2006
From: mike.benjamin at clarinet.com.au (Michael L. Benjamin)
Subject: SSH Scans - Homebrew dictionary

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Michel Pereira
Sent: Friday, March 17, 2006 10:44 AM
To: full-disclosure@...ts.grok.org.uk
Subject: [Full-disclosure] SSH Scans - Homebrew dictionary

   After of seeing a lot of ssh scans on my firewalls and home PC, I made a script that filters out the "Invalid User" entry inside /var/log/messages and do some cleaning process, the result is a dictionary (homebrew) of users that tried to login into my hosts.
   Into the dictionary I saw english and Brazilian Portuguese words, maybe we have Brazilian hackers running scan bots too.
   This work is only for experiment and curiosity to see what is happening with Internet today, you can get the script and dictionary in http://www.michel.eti.br/2006/03/ssh-scans.html

   If you have a better idea of sugestion, please mail me:
"michel@...hel.eti.br"

Bye
--
S? Jesus salva,o homem faz backups.
http://www.michel.eti.br

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

-----------------------------------------------------------

Although not perfect... I like mine better.

(Debugging lines left in)

Of course you can apply it to anything, not just SSH and /var/log/secure. Say /var/log/maillog, or /var/log/httpd/access_log and make it do any sort of task, not just block hosts. If anyone has suggestions to improve the code in the script, optimise it etc. I'm all ears...

Launch on boot in /etc/rc.local as follows:

Of course the best thing to do is to block SSH at your iptables and only let in the addresses/networks you trust, or utilise port knocking or somesuch equally nerdy approach :) Moving SSH off port 22 is a pain, and I don't like non-standard port numbering if I can avoid it. Logging into port 31337 is not going to be intuitive for another administrator simply trying to start an SSH session. :-)

Redhat /etc/sysconfig/iptables entries:-

-A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xxx.xx.xx -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xx.xxx.x/255.255.255.0 -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xxx.xxx.x/255.255.255.0 -m tcp -p tcp --dport 22 -j ACCEPT

I have run this script successfully for a number of months (about 6) and it works very well. It is structured for
expected output from /var/log/secure on a Redhat server, so you might need to massage it for your own needs.

----------------------------------------------------------------------------------------------------------------
#/etc/rc.local:

# Fire up ssh_brute_blocker security script
/usr/local/scripts/ssh_brute_blocker &

----------------------------------------------------------------------------------------------------------------
#!/bin/ksh
#
# ssh_brute_blocker
#
# xx/xx/2005 xx:xx - Michael L. Benjamin
#

LOG_FILE="/var/log/secure"
DENY_FILE="/etc/hosts.deny"
TMP_FILE=$(mktemp)
INBOUND_IP=""
INLINE=""
GUESS_COUNT=0
PERMIT_GUESS=4

while :
do

tail -10000 ${LOG_FILE} | grep "Failed password for illegal user" | awk -F"from" {'print $2'} | awk {'print $1'} | uniq > ${TMP_FILE}

while read -r INBOUND_IP
do
  GUESS_COUNT=0
#  GUESS_COUNT=$(grep ${INBOUND_IP} ${LOG_FILE} | wc -l)
  GUESS_COUNT=$(grep "from ${INBOUND_IP}" /var/log/secure | grep "Failed password for" | wc -l | awk {'print $1'})

#  echo IP: ${INBOUND_IP} made ${GUESS_COUNT} guesses against our server

  if [ ${GUESS_COUNT} -ge ${PERMIT_GUESS} ]
  then
      if grep ${INBOUND_IP} ${DENY_FILE} > /dev/null
      then
#          echo ${INBOUND_IP} is already listed in ${DENY_FILE} ; echo
           echo > /dev/null
      else
#          echo ${INBOUND_IP} is not listed. Adding host ${INBOUND_IP} to ${DENY_FILE} ; echo
          echo "ALL: ${INBOUND_IP}" >> ${DENY_FILE}
          /usr/bin/logger -t ssh_brute_blocker -is Added SSH attacking host ${INBOUND_IP} to ${DENY_FILE} [${GUESS_COUNT} attempts].
  fi
  else
#     echo Ignoring host ${INBOUND_IP} less than ${PERMIT_GUESS} wrong guesses.
      echo > /dev/null
  fi

done < ${TMP_FILE}

sleep 30

rm -f ${TMP_FILE}

done

exit 0

-----------------------------------------------------------------------------------------------------------------