Botnet Survey

[elfs]

So, this morning, now that Pendorwright has come back up, I did a survey of my box, scanning for rootkits and basically doing the monthly security sweep. The machine looks okay but there were a lot of breakin attempts recorded by auth.log, brute-force dictionary attacks on the SSH server mostly. I decided to do something about by putting up a self-protecting firewall, one that uses various TCP/IP controls to block users before they even get to the "enter a password" phase.

When I first started up the program, DenyHosts, it immediately found 165 different hosts out there that were systematically trying to script-kiddie my box, throwing over 11,000 user names at it. So far, nobody but me has been able to get in, but grief, how ugly and annoying. Next thing you know, I'll have to reconfigure the secure login server to use an obscure port just to keep the log files from growing absurdly large.

Comments

[tamsinj.livejournal.com]

they'll find ssh by port scanning though. if you want real overkill, you could set it up so you need to port-knock just to get a connection.

[tehrasha.livejournal.com]

I wrote an incredibly inefficient and horribly implemented shell script to monitor auth.log for failed SSH attempts. After 5 fails, the IP address is added to the iptables DROP, and to my homepage for amusement.

[ewhac.livejournal.com]

I use bruteblockd, which is written in C and therefore not a resource hog (unlike other examples of the genre, which are very tiny programs, not including the Perl interpreter and a couple CPAN libraries).

bruteblockd stares at the syslogs looking for SSH login failures. If the same IP address fails to login X times within Y minutes, that address gets plonked into the firewall, and all packets are blocked for Z minutes (where the values of X, Y, and Z are configurable). The result is that you see the bruteforce attacks in the logs, but they don't fill your disk.

In reality, though, my gateway isn't very secure. I don't know very much about writing firewall rules. The NAT daemon seems to keep most of the nasties from pwn1ng the Windoze boxen here.