a mention and short walkthrough of the port knocking package would've been a nice addition to this article. I once installed the port knocking package, but couldn't figure out how to perform the actual "knock". Working through the configuration file was simple enough because it was sufficiently co...

[ more ]  [ reply ]

A nice article overall, but at least some firewalls offer some flexibility with respect to dynamically blocking traffic from hosts which behave in some undesirable fashion. OpenBSD's PF has 'overload' rules for this and similar purposes.

I have included an example of this with some discussion ...

[ more ]  [ reply ]

Great article!

One 'trick' that I implement on my own hosts is using the following daemon:

http://denyhosts.sourceforge.net/

It processes the system syslog files, and modifies /etc/hosts.deny on the fly to block abusive IP addresses....

[ more ]  [ reply ]

This really isn't anything new at all. These types of attacks and their subsequent analysis have been around for quite awhile. We didn't learn anything new from this honeypot research. This is just the standard scan, crack, and bot attack that happens all the time....

[ more ]  [ reply ]

Job well done. Thanks for the info....

[ more ]  [ reply ]

Another defence is to restrict logins from the same IP to X unsuccessful attempts per Y days (I use 3 for both).

http://www.csc.liv.ac.uk/~greg/sshdfilter/ is one such tool....

[ more ]  [ reply ]

The DenyHosts "trick" is quite useful, and the distributed attacks database makes it even more useful with each new user. Quite a nifty piece of software....

[ more ]  [ reply ]

A useful tool for detecting and blocking SSH login attacks, which also shares data in a centralised DB so you can pre-emptively block IPs that have attacked other systems: http://denyhosts.sourceforge.net/

Also, a source of stats that may be helpful in analysing probabilities of success: the Linu...

[ more ]  [ reply ]

This has been an annoyance for me for quite a while.

My home firewall host has the following rules added to the iptables ruleset to discourage such attacks:

-A INPUT -i eth1 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --rcheck --seconds 180 --name sshrecent --rsource -j DROP

-A ...

[ more ]  [ reply ]

use the timelox patch for ssh......

[ more ]  [ reply ]

Great article. I enjoyed reading it. I'll have to try a honeypot, just for yucks :)

For prevention, I'd add a few things, which should ALWAYS be done on your firewall:

1. ALWAYS the first thing is to disable root login via ssh.

2. You should at least add port knocking. It is incredibly...

[ more ]  [ reply ]

http://www.aczoom.com/cms/blockhosts is another great tool for automatically blocking malicious attempts. I've been using it for years....

[ more ]  [ reply ]