full-disclosure - reduction of brute force login attempts via SSHthrough iptables --hashlimit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1141317374.3571.11.camel@scheme.psc.edu>
Date: Thu Mar  2 16:36:39 2006
From: ben at psc.edu (Benjamin Bennett)
Subject: reduction of brute force login attempts via
	SSHthrough iptables --hashlimit

On Thu, 2006-03-02 at 17:23 +0100, GroundZero Security wrote:
> Well i dont want to destroy your happy time where you can feel superior, but
> if you would read the manpage of lastb you would notice that this approach wont work at all.
> lastb just shows successfull logins! not all the attempted logins....we discussed that before though,
> so better pay attention next time.
> 
> Another thing is that on many systems btmp is not present and thus lastb wouldnt work even if it
> would show failed logins.
> 
> NAME
>        last, lastb - show listing of last logged in users
> 
> SYNOPSIS
>        last [-R] [-num] [ -n num ] [-adiox] [ -f file ] [name...]  [tty...]
>        lastb [-R] [-num] [ -n num ] [ -f file ] [-adiox] [name...]  [tty...]
> 
> DESCRIPTION
>        Last  searches  back  through  the  file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all
> users logged in (and out)
>        since that file was created.
>        ....

...and a little farther down...

  "Lastb is the same as last, except that by default it shows a  log  of
the file /var/log/btmp, which contains all the bad login attempts."

> as you can see it only logs "logged in" users not all those that tried. so your script is useless.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060302/ce7e4807/attachment.bin