[Full-disclosure] targetted SSH bruteforce attacks
gary at baribault.net
Thu Jun 17 16:28:04 BST 2010
On this system, there is only one user allowed, and that's me. On one
of my other systems, where two, but both good security guys. I run a
bash script every night to grep the successful and unsuccessful logins
every night that is mailed to me, that's how I spot these things
quick. Also Denyhosts emails me for every Deny.
Courriel: gary at baribault.net
GPG Key: 0x685430d1
Signature: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1
On 06/17/2010 10:56 AM, Michael Holstein wrote:
>> Is anyone else seeing this type of attack? Or is someone really
>> targeting MY box?
> No, I assure you it's not just you.
> It's also not uncommon to see a sequential (basically a nmap -p 22) scan
> at full throttle several times a day.
> You can basically :
> a) move to another port (obscurity .. but pretty effective in weeding
> out the casual versus committed)
> b) switch to public key only auth (recommended anyway if possible).
> c) use denyhosts, tarpitting, etc. to frustrate the casual guessers and
> The ones that are committed will find a way around (a) and (c). But it
> will take somebody a long time to properly guess a key for (b) ..
> unless you forgot to patch your Debian SSHd from their little snafu ..
> but you'd have been owned long ago if that was the case.
> If you really must use passwords on a multi-user system listening on
> tcp/22, then employ something like the PAM modules for JTR
> (/pam_passwdqc) /just to make sure people don't use stupid ones.
> Michael Holstein
> Cleveland State University
-------------- next part --------------
An HTML attachment was scrubbed...
Full-Disclosure is hosted and sponsored by Secunia.