9:25 a.m.
I'm gettign mail from logwatch as to the following:
root (en201247.uac63.hknet.com): 3 Time(s)
What's my best plan of action to respond to such? Yes I root logins via
sshd disabled.
Thanks for the advice.
9:35 a.m.
Arthur Pemberton wrote:
I'm gettign mail from logwatch as to the following:
root (en201247.uac63.hknet.com): 3 Time(s)
What's my best plan of action to respond to such? Yes I root logins
via sshd disabled.
Thanks for the advice.
Do you have a firewall on that machine? If you have , simply make a rule
blocking ssh access just to a few machines, specially if the machine in
question is a server...
I used to so something like that on the servers I managed. To access the
servers using SSH , you had to be in one machine that was on the admin
subnet.
--
Pedro Macedo
9:40 a.m.
Yesterday a single host out there made over 300 attempts to login to
sshd on my server. My feeling is that I can't stop people from trying,
so my only goal is to prevent them from succeeding. Use a firewall
and/or iptables or similar things, lock out unused logins, use good
passwords on active logins, kill unnecessary services, stay up to date
on security updates, etc. Someone once said that the only way to
absolutely guarantee a computer's security is to unplug it. Short of
that, approach computer security diligently, because people out there
will try to break in.
Arthur Pemberton wrote:
I'm gettign mail from logwatch as to the following:
root (en201247.uac63.hknet.com): 3 Time(s)
What's my best plan of action to respond to such? Yes I root logins via
sshd disabled.
Thanks for the advice.
6:39 p.m.
Jan Morales wrote:
Yesterday a single host out there made over 300 attempts to login to
sshd on my server. My feeling is that I can't stop people from trying,
so my only goal is to prevent them from succeeding. Use a firewall
and/or iptables or similar things, lock out unused logins, use good
passwords on active logins, kill unnecessary services, stay up to date
on security updates, etc. Someone once said that the only way to
absolutely guarantee a computer's security is to unplug it. Short of
that, approach computer security diligently, because people out there
will try to break in.
Arthur Pemberton wrote:
I edited the SSHd config file to listen on a port other than 22.
Alternatively, you could use IPTABLES to route some port (say 2022) to
port 22.
--
Steve
2:14 p.m.
----- Original Message -----
From: "Arthur Pemberton" <dalive(a)flashmail.com>
To: "For users of Fedora Core releases" <fedora-list(a)redhat.com>
Sent: Friday, April 08, 2005 9:25 AM
Subject: How should I react to break in attempts
I'm gettign mail from logwatch as to the following:
root (en201247.uac63.hknet.com): 3 Time(s)
What's my best plan of action to respond to such? Yes I root logins via
sshd disabled.
Thanks for the advice.
Since you have remote root access disabled, the only other thing you can do
is to just make sure that everyone uses strong passwords on the machine.
You can also limit users who can su to root following the instructions at
http://www.faqs.org/docs/securing/chap5sec43.html.
That way even if they do break in as user joe, if joe is not a part of the
wheel group he can never brute force or dictionary attack the root account.
Thomas
2:19 p.m.
You might look at this tool to help you with this issue:
http://denyhosts.sourceforge.net/
I haven't tried it myself yet, but after all the ssh attempts i've
been seeing in my daily emails I intend to.
Steve
On Apr 8, 2005 3:14 PM, Thomas Cameron <thomas.cameron(a)camerontech.com> wrote:
----- Original Message -----
From: "Arthur Pemberton" <dalive(a)flashmail.com>
To: "For users of Fedora Core releases" <fedora-list(a)redhat.com>
Sent: Friday, April 08, 2005 9:25 AM
Subject: How should I react to break in attempts
> I'm gettign mail from logwatch as to the following:
>
> root (en201247.uac63.hknet.com): 3 Time(s)
>
>
> What's my best plan of action to respond to such? Yes I root logins via
> sshd disabled.
>
> Thanks for the advice.
Since you have remote root access disabled, the only other thing you can do
is to just make sure that everyone uses strong passwords on the machine.
You can also limit users who can su to root following the instructions at
http://www.faqs.org/docs/securing/chap5sec43.html.
That way even if they do break in as user joe, if joe is not a part of the
wheel group he can never brute force or dictionary attack the root account.
Thomas
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
6:12 p.m.
Steven Joerger wrote:
You might look at this tool to help you with this issue:
http://denyhosts.sourceforge.net/
I haven't tried it myself yet, but after all the ssh attempts i've
been seeing in my daily emails I intend to.
Steve
This looks very very cool, I'll be tring it tonight.
On Apr 8, 2005 3:14 PM, Thomas Cameron <thomas.cameron(a)camerontech.com> wrote:
>----- Original Message -----
>From: "Arthur Pemberton" <dalive(a)flashmail.com>
>To: "For users of Fedora Core releases" <fedora-list(a)redhat.com>
>Sent: Friday, April 08, 2005 9:25 AM
>Subject: How should I react to break in attempts
>
>
>
>>I'm gettign mail from logwatch as to the following:
>>
>>root (en201247.uac63.hknet.com): 3 Time(s)
>>
>>
>>What's my best plan of action to respond to such? Yes I root logins via
>>sshd disabled.
>>
>>Thanks for the advice.
>>
>>
>Since you have remote root access disabled, the only other thing you can do
>is to just make sure that everyone uses strong passwords on the machine.
>You can also limit users who can su to root following the instructions at
>http://www.faqs.org/docs/securing/chap5sec43.html.
>
>That way even if they do break in as user joe, if joe is not a part of the
>wheel group he can never brute force or dictionary attack the root account.
>
>Thomas
>
>--
>fedora-list mailing list
>fedora-list(a)redhat.com
>To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
>
>
>
12:06 a.m.
Arthur Pemberton wrote:
Steven Joerger wrote:
> You might look at this tool to help you with this issue:
>
> http://denyhosts.sourceforge.net/
>
> I haven't tried it myself yet, but after all the ssh attempts i've
> been seeing in my daily emails I intend to.
>
> Steve
>
>
This looks very very cool, I'll be tring it tonight.
I am now a proud user of this.
>
> On Apr 8, 2005 3:14 PM, Thomas Cameron
> <thomas.cameron(a)camerontech.com> wrote:
>
>
>> ----- Original Message -----
>> From: "Arthur Pemberton" <dalive(a)flashmail.com>
>> To: "For users of Fedora Core releases" <fedora-list(a)redhat.com>
>> Sent: Friday, April 08, 2005 9:25 AM
>> Subject: How should I react to break in attempts
>>
>>
>>
>>> I'm gettign mail from logwatch as to the following:
>>>
>>> root (en201247.uac63.hknet.com): 3 Time(s)
>>>
>>>
>>> What's my best plan of action to respond to such? Yes I root logins
>>> via
>>> sshd disabled.
>>>
>>> Thanks for the advice.
>>>
>>
>> Since you have remote root access disabled, the only other thing you
>> can do
>> is to just make sure that everyone uses strong passwords on the
>> machine.
>> You can also limit users who can su to root following the
>> instructions at
>> http://www.faqs.org/docs/securing/chap5sec43.html.
>>
>> That way even if they do break in as user joe, if joe is not a part
>> of the
>> wheel group he can never brute force or dictionary attack the root
>> account.
>>
>> Thomas
>>
>> --
>> fedora-list mailing list
>> fedora-list(a)redhat.com
>> To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
>>
>>
>
>
>
>
1:13 p.m.
On Apr 9, 2005 12:06 AM, Arthur Pemberton <dalive(a)flashmail.com> wrote:
I am now a proud user of this.
I looked at it and opted for the auto-firewall option that I mentioned
earlier. In fact, I just enabled that option yesterday afternoon, and
it already blocked someone.
What kind of schedule are you running it on? Remember, that some of
these scripts that people run to try to hack into your system can make
upwards of 20-30 connections in just a minute, trying to guess account
names of users on your system. If you are running denyhosts every 10
minutes... or even every 5 minutes, that's a lot of time to let people
play before they get blocked.
The scripts I referred to block out connections from an IP address
that makes 5 unsuccessful SSH connections within 60 seconds... So on
the 5th connection, it just blocks them right away. I can live with
someone trying 5 connections and getting blocked, but letting them try
hundreds before they get blocked is something I'm not going to risk.
Just my advice, for what it's worth.
--
David
Registered Linux User 383030 (since everyone else was doing it 8-)
-----------------------------------------------------------------------
There are only 10 kinds of people in this world,
those who understand binary, and those who don't.
4:09 p.m.
On Apr 8, 2005 10:25 AM, Arthur Pemberton <dalive(a)flashmail.com> wrote:
I'm gettign mail from logwatch as to the following:
root (en201247.uac63.hknet.com): 3 Time(s)
What's my best plan of action to respond to such? Yes I root logins via
sshd disabled.
Thanks for the advice.
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
I like running sshd on a non-standard port. That stopped all bogus
attempts for me. It's easy to do this with the port setting in
sshd.conf.
The disadvantage is that many corporate firewalls restrict outgoing
traffic on funny ports, so if you're trying to connect from inside
such a firewall, you won't be able to use just any port.
6:09 p.m.
Arthur Pemberton wrote:
I'm gettign mail from logwatch as to the following:
root (en201247.uac63.hknet.com): 3 Time(s)
What's my best plan of action to respond to such? Yes I root logins
via sshd disabled.
Thanks for the advice.
This host is really tring it's best at sshd, there are many attempts to
my sshd. Is it a good idea to just block that ip via iptables?
6:15 p.m.
On Apr 8, 2005 6:09 PM, Arthur Pemberton <dalive(a)flashmail.com> wrote:
This host is really tring it's best at sshd, there are many
attempts to
my sshd. Is it a good idea to just block that ip via iptables?
Take a look at messages from earlier today (about 6 hours before I
posted this note) for messages with the subject line "Questions
concerning security log".
Brian Gaynor wrote a note with an excellent example of a way to
configure your firewall to automatically detect multiple SSH
connections, and automatically block them.
I also like the denyhosts application that Steve Joerger referred to
earlier, but since it has to run from cron, a lot of attempts can be
made to get into your SSH before the job runs and blocks the offender.
--
David
Registered Linux User 383030 (since everyone else was doing it 8-)
-----------------------------------------------------------------------
There are only 10 kinds of people in this world,
those who understand binary, and those who don't.
6955
days inactive
6956
days old
11 comments
8 participants
participants (8)
-
Arthur Pemberton -
David Hoffman -
Jan Morales -
Matt Morgan -
Pedro Fernandes Macedo -
SternData -
Steven Joerger -
thomas cameron