A coworker (Matt) and I wanted a shorter name for ssh brute force password guessing and we combined ssh shell and phishing into SShellPhishing.
|
donald 206 Posts Sep 16th 2008 |
Thread locked Subscribe |
Sep 16th 2008 1 decade ago |
Security through obscurity is not necessarily a bad thing as long as it is not the only layer in your defense. The way I see it, password guessing, or forcing, are attempts to break your existing security through obscurity - the password itself.
|
Jerry 12 Posts |
Quote |
Sep 16th 2008 1 decade ago |
I've been using a script - log-guardian.pl - http://www.tifaware.com/perl/log-guardian/
for a couple of years now - one of my systems has over 191000 unique IPs it has identified over this time. You're right - now most of the scans are below the "3 strikes you're out" level I've set - am looking at ways to allow for my several systems to easily share real-time data on this. Have been considering something like the RBL for bad e-mail hosts |
Anonymous |
Quote |
Sep 16th 2008 1 decade ago |
add to previous - note that I also use the same script to guard against dictionary attacks on smtp and many of the recent additions to the IP list are for that reason. Same script can be made to watch for FTP and other ports with fairly minimal changes - uses iptables firewall rules but can be made to use something else
|
Anonymous |
Quote |
Sep 16th 2008 1 decade ago |
I actually pull out connection attempts from the syslog output from all my network equipment. I restrict access to their VTYs with a common ACL. Any connection attempts to the VTYs from anywhere not on the list gets logged. I don't wait for them to connect and guess userids & passwords. Merely connecting is enough for me to drop them in my RTBH. I also use fail2ban but like most of the other readers, it doesn't help mitigate abusers making only a single attempt. My ACLs don't have that problem.
|
Anonymous |
Quote |
Sep 16th 2008 1 decade ago |
I compared my list of bad hosts from my RTBH to the BruteForceBlocker list to see how many common entries we have between us. Most of my list about 90% hosts hitting us on tcp/22. However I didn't have a single match in common between my list and their list. I would have at least expected some reasonable percentage in common, say around 50%. Does anyone else find that odd?
|
Anonymous |
Quote |
Sep 17th 2008 1 decade ago |
Sign Up for Free or Log In to start participating in the conversation!