On 04/04/11 11:18, Rainer Traut wrote:
to prevent scripted dictionary attacks to sshd I applied those iptables rules:
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --name SSH --rsource -j DROP -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -m recent --set --name SSH --rsource
And this is part of logwatch:
sshd: Authentication Failures: unknown (www.telkom.co.ke): 137 Time(s) unknown (mkongwe.jambo.co.ke): 130 Time(s) unknown (212.49.70.24): 107 Time(s) root (195.191.250.101): 8 Time(s)
How is it possible for an attacker to try to logon more then 4 times? Can the attacker do this with only one TCP/IP connection without establishing a new one? Or have the scripts been adapted to this?
i see similar results on some of my servers, eg:
% grep 'a.bad.ip.address' authpriv|grep 'authentication failure'|awk '{print $3}'|less 15:47:44 15:49:34 15:49:46 15:51:32 15:53:17 15:53:30 15:55:14 15:56:59 15:58:44 16:00:34 16:02:19 16:02:31 16:04:17 [...]
so i can see that yes, at least some automated scripts have been adapted to back off in an attempt not to trip my iptables rules. you can do a similar grep to see the times of your attempts, and that will tell you if they're running a softly-softly script, or if instead they have found a way to test many passwords without tripping the iptables rule.
On Mon, 4 Apr 2011, David Sommerseth wrote:
This is just a hunch, but --seconds 60 indicates that it will only look back one minute to check if it could find a hit. So if the attacker tries to connect again after 2 minutes or even 61 seconds, it won't trigger this rule. Try increasing this value to 3600 (1 hour). Maybe you want even longer.
i occasionally trip my iptables rule myself, for example if i scp a couple of files off a server and then go back for a third; i feel it would be a shame to lock myself out for an hour, by doing that.
the way i see it is that, even in the limiting case where an attacker can try two passwords every minute, she will be limited to just under 3,000 attempts a day, and that's not very many when you're trying to brute-force decent passwords. given that most of those are attempts to guess root's password, and i have "PermitRootLogin no" in sshd_config, the tiny additional load caused by an attempt every 30 seconds is something i can live with in exchange for not locking myself out for too long.
how long you set your lockout for is a call you must make for your server(s); i just wanted you to have more points of view about what people are doing out there in the wild.