bruteforce protection howto

[Arthur Bela]

Two pc's:

1 - router
2 - logger

Situation: someone tries to bruteforce into a server, and the logger
get's a log about it [e.g.: ssh login failed].

What's the best method to ban that ip [what is bruteforcig a server]
what was logged on the logger?
I need to ban the ip on the router pc.

How can i send the bad ip to the router, to ban it?

Just run a cronjob, and e.g.: scp the list of ip's from the logger to
the router, then ban the ip from the list on the router pc?

Or is there any "offical" method for this?

I'm just asking for docs/howtos.. :\ to get started..

Thank you!

[Craig White]

On Sat, 2010-03-20 at 23:17 +0100, Vadkan Jozsef wrote:
> Two pc's:
>
> 1 - router
> 2 - logger
>
> Situation: someone tries to bruteforce into a server, and the logger
> get's a log about it [e.g.: ssh login failed].
>
> What's the best method to ban that ip [what is bruteforcig a server]
> what was logged on the logger?
> I need to ban the ip on the router pc.
>
> How can i send the bad ip to the router, to ban it?
>
> Just run a cronjob, and e.g.: scp the list of ip's from the logger to
> the router, then ban the ip from the list on the router pc?
>
> Or is there any "offical" method for this?
>
> I'm just asking for docs/howtos.. :\ to get started..

----
personally, I always use 'denyhosts' package which can be either single
system or can share data with other systems.

yum search denyhosts

Craig

[Bruno Wolff III]

On Sat, Mar 20, 2010 at 23:17:27 +0100,
  Vadkan Jozsef  wrote:
> What's the best method to ban that ip [what is bruteforcig a server]
> what was logged on the logger?

What are you trying to accomplish?

The best thing to do may be nothing. If the attempts are on a scale that
is not a denial of service and you have strong passwords or use certs, then
the attack isn't doing significant damage and it may not be worth your time to
manually react.

[Fred Williams]

On 21 March 2010 00:25, Craig White  wrote:
> On Sat, 2010-03-20 at 23:17 +0100, Vadkan Jozsef wrote:
> > Two pc's:
> >
> > 1 - router
> > 2 - logger
> >
> > Situation: someone tries to bruteforce into a server, and the logger
> > get's a log about it [e.g.: ssh login failed].
> >
> > What's the best method to ban that ip [what is bruteforcig a server]
> > what was logged on the logger?
> > I need to ban the ip on the router pc.
> >
> > How can i send the bad ip to the router, to ban it?
> >
> > Just run a cronjob, and e.g.: scp the list of ip's from the logger to
> > the router, then ban the ip from the list on the router pc?
> >
> > Or is there any "offical" method for this?
> >
> > I'm just asking for docs/howtos.. :\ to get started..
>
> personally, I always use 'denyhosts' package which can be either single
> system or can share data with other systems.
>
> yum search denyhosts
>
> Craig
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> --
> users mailing list
> [e-mail]
> To unsubscribe or change subscription options:
> https://admin.fedoraproject.org/mailman/listinfo/users
> Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Does not 'fail2ban' work for bruteforce attacks?

[Cameron Simpson]

On 20Mar2010 17:25, Craig White  wrote:
| On Sat, 2010-03-20 at 23:17 +0100, Vadkan Jozsef wrote:
| > Two pc's:
| > 
| > 1 - router
| > 2 - logger
| > 
| > Situation: someone tries to bruteforce into a server, and the logger
| > get's a log about it [e.g.: ssh login failed].
| > 
| > What's the best method to ban that ip [what is bruteforcig a server]
| > what was logged on the logger?
| > I need to ban the ip on the router pc.
| > 
| > How can i send the bad ip to the router, to ban it?
| > 
| > Just run a cronjob, and e.g.: scp the list of ip's from the logger to
| > the router, then ban the ip from the list on the router pc?
| > 
| > Or is there any "offical" method for this?
| > 
| > I'm just asking for docs/howtos.. :\ to get started..
| ----
| personally, I always use 'denyhosts' package which can be either single
| system or can share data with other systems.
| 
| yum search denyhosts

I block this stuff with a firewall rule limiting the number of inbound
ssh connections in a period of time. It usually cuts this kind of thing
off fairly promptly. I'm using pf on an openbsd firewall:

# let admin sites in anyway
  pass log quick proto tcp from <admins> to any port 22 flags S/SA keep state

# discard already blocked IPs
  block drop quick proto tcp from <evil> to any port 22

# allow ssh in unless an IP connects too often, adding it to the
  # <evil> table used above
  pass log   quick proto tcp from any    to any port 22 flags S/SA keep state (max-src-conn-rate 20/60, overload <evil> flush)

I believe you can do the same kind of thing in iptables these days if
that's what you've got.

Cheers,