full-disclosure - Re: targetted SSH bruteforce attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 17 Jun 2010 10:56:18 -0400
From: Michael Holstein <michael.holstein@...ohio.edu>
To: Gary Baribault <gary@...ibault.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: targetted SSH bruteforce attacks

> Is anyone else seeing this type of attack? Or is someone really
> targeting MY box?
>
>   

No, I assure you it's not just you.

It's also not uncommon to see a sequential (basically a nmap -p 22) scan
at full throttle several times a day.

You can basically :

a) move to another port (obscurity .. but pretty effective in weeding
out the casual versus committed)
b) switch to public key only auth (recommended anyway if possible).
c) use denyhosts, tarpitting, etc. to frustrate the casual guessers and
bots.

The ones that are committed will find a way around (a) and (c). But it
will take somebody a long time to properly guess a key for (b) .. 
unless you forgot to patch your Debian SSHd from their little snafu ..
but you'd have been owned long ago if that was the case.

If you really must use passwords on a multi-user system listening on
tcp/22, then employ something like the PAM modules for JTR
(/pam_passwdqc) /just to make sure people don't use stupid ones.

Cheers,

Michael Holstein
Cleveland State University

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/