-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michel Pereira Sent: Friday, March 17, 2006 10:44 AM To: [email protected] Subject: [Full-disclosure] SSH Scans - Homebrew dictionary
After of seeing a lot of ssh scans on my firewalls and home PC, I made a script that filters out the "Invalid User" entry inside /var/log/messages and do some cleaning process, the result is a dictionary (homebrew) of users that tried to login into my hosts. Into the dictionary I saw english and Brazilian Portuguese words, maybe we have Brazilian hackers running scan bots too. This work is only for experiment and curiosity to see what is happening with Internet today, you can get the script and dictionary in http://www.michel.eti.br/2006/03/ssh-scans.html If you have a better idea of sugestion, please mail me: "[EMAIL PROTECTED]" Bye -- Só Jesus salva,o homem faz backups. http://www.michel.eti.br _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ----------------------------------------------------------- Although not perfect... I like mine better. (Debugging lines left in) Of course you can apply it to anything, not just SSH and /var/log/secure. Say /var/log/maillog, or /var/log/httpd/access_log and make it do any sort of task, not just block hosts. If anyone has suggestions to improve the code in the script, optimise it etc. I'm all ears... Launch on boot in /etc/rc.local as follows: Of course the best thing to do is to block SSH at your iptables and only let in the addresses/networks you trust, or utilise port knocking or somesuch equally nerdy approach :) Moving SSH off port 22 is a pain, and I don't like non-standard port numbering if I can avoid it. Logging into port 31337 is not going to be intuitive for another administrator simply trying to start an SSH session. :-) Redhat /etc/sysconfig/iptables entries:- -A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xxx.xx.xx -m tcp -p tcp --dport 22 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xx.xxx.x/255.255.255.0 -m tcp -p tcp --dport 22 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xxx.xxx.x/255.255.255.0 -m tcp -p tcp --dport 22 -j ACCEPT I have run this script successfully for a number of months (about 6) and it works very well. It is structured for expected output from /var/log/secure on a Redhat server, so you might need to massage it for your own needs. ---------------------------------------------------------------------------------------------------------------- #/etc/rc.local: # Fire up ssh_brute_blocker security script /usr/local/scripts/ssh_brute_blocker & ---------------------------------------------------------------------------------------------------------------- #!/bin/ksh # # ssh_brute_blocker # # xx/xx/2005 xx:xx - Michael L. Benjamin # LOG_FILE="/var/log/secure" DENY_FILE="/etc/hosts.deny" TMP_FILE=$(mktemp) INBOUND_IP="" INLINE="" GUESS_COUNT=0 PERMIT_GUESS=4 while : do tail -10000 ${LOG_FILE} | grep "Failed password for illegal user" | awk -F"from" {'print $2'} | awk {'print $1'} | uniq > ${TMP_FILE} while read -r INBOUND_IP do GUESS_COUNT=0 # GUESS_COUNT=$(grep ${INBOUND_IP} ${LOG_FILE} | wc -l) GUESS_COUNT=$(grep "from ${INBOUND_IP}" /var/log/secure | grep "Failed password for" | wc -l | awk {'print $1'}) # echo IP: ${INBOUND_IP} made ${GUESS_COUNT} guesses against our server if [ ${GUESS_COUNT} -ge ${PERMIT_GUESS} ] then if grep ${INBOUND_IP} ${DENY_FILE} > /dev/null then # echo ${INBOUND_IP} is already listed in ${DENY_FILE} ; echo echo > /dev/null else # echo ${INBOUND_IP} is not listed. Adding host ${INBOUND_IP} to ${DENY_FILE} ; echo echo "ALL: ${INBOUND_IP}" >> ${DENY_FILE} /usr/bin/logger -t ssh_brute_blocker -is Added SSH attacking host ${INBOUND_IP} to ${DENY_FILE} [${GUESS_COUNT} attempts]. fi else # echo Ignoring host ${INBOUND_IP} less than ${PERMIT_GUESS} wrong guesses. echo > /dev/null fi done < ${TMP_FILE} sleep 30 rm -f ${TMP_FILE} done exit 0 ----------------------------------------------------------------------------------------------------------------- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
