Block IP

[Kaushal Shriyan]

Hi ALL

w command showed me suspicious IP.
How do i block the IP from allowing ssh to my linux box
can i use TCP wrappers and how do i do it

Thanks and Regards

Kaushal

[Ankush Grover]

On 8/31/06, Kaushal Shriyan <kaushalshriyan(a)gmail.com&gt; wrote:
>  Hi ALL
>
>  w command showed me suspicious IP.
>  How do i block the IP from allowing ssh to my linux box
>  can i use TCP wrappers and how do i do it
>
>  Thanks and Regards
>  
For tcp wrappers see this page

http://linux.about.com/od/commands/l/blcmdl5_hostsal.htm

[JeeBee]

I just had the same problem. I wanted to block an ip that is constantly
doing a dictionary attack on my system. This is the situation before:

/etc/hosts.allow:
  ALL : <some trusted domains here>
  sshd : ALL
/etc/hosts.deny:
  ALL : ALL

The only way I could see to add this ip address I want to block is
to change sshd:ALL in hosts.allow to sshd:ALL EXCEPT 1.2.3.4.

If I sould add sshd:1.2.3.4 to hosts.deny, this would totally be
ignored.
Perhaps it would be more neat to remove sshd:ALL from hosts.allow
and to remove ALL:ALL from hosts.deny.
Then I could say sshd:1.2.3.4 in hosts.deny.
However, what more will be allowed then? The ALL:ALL in hosts.deny
blocks a lot more of course.

Still, I have the feeling that ALL EXCEPT <long lists of untrusted ips
here> is not the way to go.
Can anybody tell me how this should be done?

Thanks in advance,
JeeBee.

[Ankush Grover]

On 8/31/06, JeeBee <JeeBee(a)troefpunt.nl&gt; wrote:
>  I just had the same problem. I wanted to block an ip that is
> constantly
>  doing a dictionary attack on my system. This is the situation before:
>
>  /etc/hosts.allow:
>    ALL : <some trusted domains here>
>    sshd : ALL
>  /etc/hosts.deny:
>    ALL : ALL
>
>  The only way I could see to add this ip address I want to block is
>  to change sshd:ALL in hosts.allow to sshd:ALL EXCEPT 1.2.3.4.
>
>  If I sould add sshd:1.2.3.4 to hosts.deny, this would totally be
>  ignored.
>  Perhaps it would be more neat to remove sshd:ALL from hosts.allow
>  and to remove ALL:ALL from hosts.deny.
>  Then I could say sshd:1.2.3.4 in hosts.deny.
>  However, what more will be allowed then? The ALL:ALL in hosts.deny
>  blocks a lot more of course.
>
>  Still, I have the feeling that ALL EXCEPT <long lists of untrusted ips
>  here> is not the way to go.
>  Can anybody tell me how this should be done?
>  
Hey,

A script which automatically blocks the offending ips. Please read the
documentation for more information regarding this.

http://denyhosts.sourceforge.net/

Regards

Ankush Grover

[Mike]

Ankush Grover schreef:
>  On 8/31/06, JeeBee <JeeBee(a)troefpunt.nl&gt; wrote:
> > I just had the same problem. I wanted to block an ip that is constantly
> > doing a dictionary attack on my system. This is the situation before:
> >
> > /etc/hosts.allow:
> >   ALL : <some trusted domains here>
> >   sshd : ALL
> > /etc/hosts.deny:
> >   ALL : ALL
> >
> > The only way I could see to add this ip address I want to block is
> > to change sshd:ALL in hosts.allow to sshd:ALL EXCEPT 1.2.3.4.
> >
> > If I sould add sshd:1.2.3.4 to hosts.deny, this would totally be
> > ignored.
> > Perhaps it would be more neat to remove sshd:ALL from hosts.allow
> > and to remove ALL:ALL from hosts.deny.
> > Then I could say sshd:1.2.3.4 in hosts.deny.
> > However, what more will be allowed then? The ALL:ALL in hosts.deny
> > blocks a lot more of course.
> >
> > Still, I have the feeling that ALL EXCEPT <long lists of untrusted ips
> > here> is not the way to go.
> > Can anybody tell me how this should be done?
> >
>
>  Hey,
>
>  A script which automatically blocks the offending ips. Please read the
>  documentation for more information regarding this.
>
>  http://denyhosts.sourceforge.net/
>
>  Regards
>
>  Ankush Grover
>  
Hey, or you can put your SSHd on an other port... worked for me ;)

- Mike

-- 
ATN Networks
Dirk de Derdelaan 215
3132 HE VLAARDINGEN
url: www.atn-networks.nl
mail: mike(a)atn-networks.nl
mobiel: 06 - 28 11 49 91

Voor al uw hostinggebonden oplossingen

[JeeBee]

Thanks Mike and Ankush, both suggestions are really nice.
I installed and am running denyhosts now :)

[Jacques B.]

On 8/31/06, JeeBee <JeeBee(a)troefpunt.nl&gt; wrote:
>  Thanks Mike and Ankush, both suggestions are really nice.
>  I installed and am running denyhosts now :) 
I had it installed on another system at my previous location.  Works
well, sometimes too well.  I ended up getting my own IP blocked a few
times from typos when trying to log in.

Jacques B.

[Claude Jones]

On Thursday August 31 2006 8:12 am, Jacques B. wrote:
>  On 8/31/06, JeeBee <JeeBee(a)troefpunt.nl&gt; wrote:
>  > Thanks Mike and Ankush, both suggestions are really nice.
>  > I installed and am running denyhosts now :)
>
>  I had it installed on another system at my previous location.  Works
>  well, sometimes too well.  I ended up getting my own IP blocked a few
>  times from typos when trying to log in. 
That one is easy to solve. Add yourself to hosts.allow which overrides any 
entries in hosts.deny  

-- 
Claude Jones
Brunswick, MD, USA

[Jacques B.]

On 8/31/06, Claude Jones <claude_jones(a)levitjames.com&gt; wrote:
>  On Thursday August 31 2006 8:12 am, Jacques B. wrote:
>  > On 8/31/06, JeeBee <JeeBee(a)troefpunt.nl&gt; wrote:
>  > > Thanks Mike and Ankush, both suggestions are really nice.
>  > > I installed and am running denyhosts now :)
>  >
>  > I had it installed on another system at my previous location.  Works
>  > well, sometimes too well.  I ended up getting my own IP blocked a few
>  > times from typos when trying to log in.
>
>  That one is easy to solve. Add yourself to hosts.allow which overrides any
>  entries in hosts.deny
>
>  --
>  Claude Jones
>  Brunswick, MD, USA
>
>  --
>  fedora-list mailing list
>  fedora-list(a)redhat.com
>  To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>  
Good point.  I was coming from a dynamic IP.  But I could have added
the ISP's subnet in the hosts.allow.  Wasn't a big issue as it only
happened a few times and was only a R&D box to play with so it could
always wait until the next morning when I went in and removed the
entry from host.deny.  So never explored a better solution.

Jacques B.

[Claude Jones]

On Thursday August 31 2006 8:30 am, Jacques B. wrote:
>  Good point.  I was coming from a dynamic IP.  But I could have added
>  the ISP's subnet in the hosts.allow.  Wasn't a big issue as it only
>  happened a few times and was only a R&D box to play with so it could
>  always wait until the next morning when I went in and removed the
>  entry from host.deny.  So never explored a better solution. 
I'm actually in the opposite situation. I discovered the above while I was on 
an ISP that gave me a fixed IP address. I've since moved and am on Verizon 
DSL now and get my IP dynamically. Given the number of probes I get from 
addresses in the Verizon world, I'm not too happy with that solution at 
present. ;-)
-- 
Claude Jones
Brunswick, MD, USA

[James Wilkinson]

Kaushal Shriyan wrote:
>  w command showed me suspicious IP. 
w shows who's got past your defences and actually logged in. So
"suspicious" is worrying.

Is there any chance that it could be legitimate -- say, someone you know
SSHing in from an unusual IP address?

Can you run
host 10.10.10.10
(where 10.10.10.10 is the IP address) to see if there's a name
associated with it, and
whois 10.10.10.10
to see who "owns" that IP block?

Unless you can verify that whoever it was had permission to be on your
computer, you should worry, try to find out how they got in (are any of
your passwords guessable? How many usernames are allowed to SSH in? Are
you running any other server programs?) *re-install your system from
scratch*, and do your best to close the holes.

If you want any further explanation, please ask this list.

Thanks,

James. 

-- 
E-mail:     james@ |  ... more holes in Internet Explorer than
aprilcottage.co.uk | Blackburn, Lancashire...
                   |     -- http://theinquirer.net/?article=17235