full-disclosure - Re: targetted SSH bruteforce attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4C1A3F04.5040708@baribault.net>
Date: Thu, 17 Jun 2010 11:28:04 -0400
From: Gary Baribault <gary@...ibault.net>
To: Michael Holstein <michael.holstein@...ohio.edu>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: targetted SSH bruteforce attacks

On this system, there is only one user allowed, and that's me. On one
of my other systems, where two, but both good security guys. I run a
bash script every night to grep the successful and unsuccessful logins
every night that is mailed to me, that's how I spot these things
quick. Also Denyhosts emails me for every Deny.

Gary Baribault
Courriel: gary@...ibault.net
GPG Key: 0x685430d1
Signature: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1


On 06/17/2010 10:56 AM, Michael Holstein wrote:
>
>> Is anyone else seeing this type of attack? Or is someone really
>> targeting MY box?
>>
>>  
>
> No, I assure you it's not just you.
>
> It's also not uncommon to see a sequential (basically a nmap -p 22) scan
> at full throttle several times a day.
>
> You can basically :
>
> a) move to another port (obscurity .. but pretty effective in weeding
> out the casual versus committed)
> b) switch to public key only auth (recommended anyway if possible).
> c) use denyhosts, tarpitting, etc. to frustrate the casual guessers and
> bots.
>
> The ones that are committed will find a way around (a) and (c). But it
> will take somebody a long time to properly guess a key for (b) ..
> unless you forgot to patch your Debian SSHd from their little snafu ..
> but you'd have been owned long ago if that was the case.
>
> If you really must use passwords on a multi-user system listening on
> tcp/22, then employ something like the PAM modules for JTR
> (/pam_passwdqc) /just to make sure people don't use stupid ones.
>
> Cheers,
>
> Michael Holstein
> Cleveland State University
>


Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/