Hi,

I didn't read the whole discussion about this issue but I came up with
an idea which might be usefull to detect brute force attempt. By
storing the passwords a certain user has used in the past along with
the current password you could be able to compare to password (by
pattern matching) used a

[ more ]  [ reply ]

I guess what everyone is trying to says is that just because a device /
OS combination has been tested to EAL4 doesn't mean your version is
configured as such.

-----Original Message-----
From: Takayama Kawika (DTI) [mailto:Kawika.Takayama (at) state.de (dot) us [email concealed]]
Sent: 02 November 2006 09:44
To: focus-linu

[ more ]  [ reply ]

I am looking at a Linux server which has been
accredited as a EAL4 system by IBM. During the
assessment, I was looking for standard Linux
protections like iptables, ssh etc. On this server,
there is no iptables.

Regardless, I would like to know how to evaluate a EAL
4 system. What do you need to

[ more ]  [ reply ]

> I am looking for a good tool to detect brute-force and dictionary attacks on
> user >accounts on a Linux system . The tool should also have the intelligence
> to differntiate >between user mistakes and actual brute-force/dictionary
> attacks and reduce the >false positives. SuSE/RedHat included s

[ more ]  [ reply ]

I wrote a script to detect brute force attacks by watching log files.

If you want to try it it is here:
http://www.ducksfeet.com/nic2/secwatch/index.html

--
Rock is dead! Long live paper and scissors!
Nic Stevens (nic dot stevens at gee mail daught com) -- http://www.ducksfeet.com/nic

[ more ]  [ reply ]

You may have a look to denyhosts :
http://denyhosts.sourceforge.net/

Shortly, it is a python script that reads /var/log/secure and puts agressive hosts in /etc/hosts.deny

[ more ]  [ reply ]

>The tool should also have the intelligence to >differntiate between user mistakes and actual >brute-force/dictionary attacks and reduce the >false positives. SuSE/RedHat included security >tools are not helping in this case .

Hello Shashi Kanth,

I dont think there is any intelligent tool that can

[ more ]  [ reply ]

> I am looking for a good tool to detect brute-force and dictionary attacks o=
> n user accounts on a Linux system . The tool should also have the intellig=
> ence to differntiate between user mistakes and actual brute-force/dictiona=
> ry attacks and reduce the false positives. SuSE/RedHat included

[ more ]  [ reply ]