auto-blackholing/blacklisting on multiple hacking attempts

Hi,

I'm running freebsd 7-RELEASE

I see this, for example, in my auth log:

May 15 02:00:39 www sshd[9180]: Invalid user web from
201.18.232.30
May 15 02:00:41 www sshd[9182]: Invalid user web from
201.18.232.30
May 15 02:00:43 www sshd[9184]: Invalid user web from
201.18.232.30
May 15 02:00:45 www sshd[9186]: Invalid user web from
201.18.232.30
May 15 02:00:48 www sshd[9188]: Invalid user web from
201.18.232.30
May 15 02:00:50 www sshd[9190]: Invalid user web from
201.18.232.30
May 15 02:00:52 www sshd[9192]: Invalid user web from
201.18.232.30
May 15 02:00:54 www sshd[9194]: Invalid user web from
201.18.232.30
May 15 02:00:56 www sshd[9196]: Invalid user web from
201.18.232.30
May 15 02:00:58 www sshd[9198]: Invalid user web from
201.18.232.30
May 15 02:01:00 www sshd[9200]: Invalid user web from
201.18.232.30
May 15 02:01:02 www sshd[9205]: Invalid user web from
201.18.232.30
May 15 02:01:04 www sshd[9207]: Invalid user account from
201.18.232.30
May 15 02:01:06 www sshd[9209]: Invalid user account from
201.18.232.30
May 15 02:01:08 www sshd[9211]: Invalid user account from
201.18.232.30
May 15 02:01:10 www sshd[9213]: Invalid user account from
201.18.232.30
May 15 02:01:12 www sshd[9218]: Invalid user account from
201.18.232.30
May 15 02:01:14 www sshd[9220]: Invalid user account from
201.18.232.30
May 15 02:01:39 www sshd[9244]: Invalid user apache from
201.18.232.30
May 15 02:01:41 www sshd[9246]: Invalid user apache from
201.18.232.30
May 15 02:01:43 www sshd[9248]: Invalid user apache from
201.18.232.30
May 15 02:01:45 www sshd[9250]: Invalid user apache from
201.18.232.30
May 15 02:01:47 www sshd[9252]: Invalid user apache from
201.18.232.30

I'd like it to be so that if an IP tries to connect to sshd
more than
once in a 30 second period, that they are immediately
blackholed.
Should I be using pf for this or would it be done better in
some other
utility?

cheers

-- 
John
_______________________________________________
freebsd-pffreebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to
"freebsd-pf-unsubscribefreebsd.org"

On Mon, May 26, 2008 at 02:20:45AM +0100, John . wrote:
> I see this, for example, in my auth log:
> 
> May 15 02:00:39 www sshd[9180]: Invalid user web from
201.18.232.30
> 
> I'd like it to be so that if an IP tries to connect to
sshd more than
> once in a 30 second period, that they are immediately
blackholed.
> Should I be using pf for this or would it be done
better in some other
> utility?

ports/security/sshguard-pf
ports/security/blocksshd

-- 
| Jeremy Chadwick                                jdc at
parodius.com |
| Parodius Networking                       http://www.parodius.com/
|
| UNIX Systems Administrator                  Mountain View,
CA, USA |
| Making life hard for others since 1977.              PGP:
4BD6C0CB |

_______________________________________________
freebsd-pffreebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to
"freebsd-pf-unsubscribefreebsd.org"

>
> I'd like it to be so that if an IP tries to connect to
sshd more than
> once in a 30 second period, that they are immediately
blackholed.
> Should I be using pf for this or would it be done
better in some other
> utility?

/usr/ports/security/bruteforceblocker.

_______________________________________________
freebsd-pffreebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to
"freebsd-pf-unsubscribefreebsd.org"

On Mon, 2008-05-26 at 02:20 +0100, John . wrote:
> Hi,
> 
> I'm running freebsd 7-RELEASE
> 
> I see this, for example, in my auth log:
> 
> May 15 02:00:39 www sshd[9180]: Invalid user web from
201.18.232.30
> May 15 02:00:41 www sshd[9182]: Invalid user web from
201.18.232.30
> May 15 02:00:43 www sshd[9184]: Invalid user web from
201.18.232.30
> May 15 02:00:45 www sshd[9186]: Invalid user web from
201.18.232.30
> May 15 02:00:48 www sshd[9188]: Invalid user web from
201.18.232.30
> May 15 02:00:50 www sshd[9190]: Invalid user web from
201.18.232.30
> May 15 02:00:52 www sshd[9192]: Invalid user web from
201.18.232.30
> May 15 02:00:54 www sshd[9194]: Invalid user web from
201.18.232.30
> May 15 02:00:56 www sshd[9196]: Invalid user web from
201.18.232.30
> May 15 02:00:58 www sshd[9198]: Invalid user web from
201.18.232.30
> May 15 02:01:00 www sshd[9200]: Invalid user web from
201.18.232.30
> May 15 02:01:02 www sshd[9205]: Invalid user web from
201.18.232.30
> May 15 02:01:04 www sshd[9207]: Invalid user account
from 201.18.232.30
> May 15 02:01:06 www sshd[9209]: Invalid user account
from 201.18.232.30
> May 15 02:01:08 www sshd[9211]: Invalid user account
from 201.18.232.30
> May 15 02:01:10 www sshd[9213]: Invalid user account
from 201.18.232.30
> May 15 02:01:12 www sshd[9218]: Invalid user account
from 201.18.232.30
> May 15 02:01:14 www sshd[9220]: Invalid user account
from 201.18.232.30
> May 15 02:01:39 www sshd[9244]: Invalid user apache
from 201.18.232.30
> May 15 02:01:41 www sshd[9246]: Invalid user apache
from 201.18.232.30
> May 15 02:01:43 www sshd[9248]: Invalid user apache
from 201.18.232.30
> May 15 02:01:45 www sshd[9250]: Invalid user apache
from 201.18.232.30
> May 15 02:01:47 www sshd[9252]: Invalid user apache
from 201.18.232.30
> 
> I'd like it to be so that if an IP tries to connect to
sshd more than
> once in a 30 second period, that they are immediately
blackholed.
> Should I be using pf for this or would it be done
better in some other
> utility?
> 

In pf you could write a rule like 

pass in quick on $ext_if proto tcp from any to
$some_ip_address port 22
flags S/SAFR keep state (max-src-conn 1, max-src-conn-rate
1/30,
overload <ssh_hacks> flush global) 

you would have to have setup a table named <ssh_hacks>
in your
configuration and assign values to both $ext_if and
$some_ip_address or
replace them with whatever values work for you. 

This rule would track connections allowing a maximum of 1
connection per
source IP address and would allow 1 connection to be
initiated every 31
seconds or longer, otherwise it would add the offending IP
address to
the <ssh_hacks> table and flush the global state table
of all entries
from the same source IP. 

You would have to have a rule in your configuration prior to
this rule
that would block traffic from source IP addresses in the
ssh_hacks
table. Depending on your policies this could be a block of
all services
or just ssh. Personally I use a rule like

block drop log quick from <ssh_hacks> 

but 

block drop log in quick proto tcp from <ssh_hacks> to
any port 22 

would block ssh traffic from the offending IP to just ssh
services on
your network. 

Beware that you can lock yourself out of your servers very
quickly with
this if you do not have another rule allowing yourself
access to your
machines setup earlier in your configuration. 

Cheers,
~e

_______________________________________________
freebsd-pffreebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to
"freebsd-pf-unsubscribefreebsd.org"

Thanks everybody for their suggestions! As always, more than
one way
of doing this ;)
-- 
John
_______________________________________________
freebsd-pffreebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to
"freebsd-pf-unsubscribefreebsd.org"

"John ." <comp.johngooglemail.com> writes:

> I'd like it to be so that if an IP tries to connect to
sshd more than
> once in a 30 second period, that they are immediately
blackholed.
> Should I be using pf for this or would it be done
better in some other
> utility?

PF offers a very flexible mechanism for that, via state
tracking options.
See eg http
://home.nuug.no/~peter/pf/en/bruteforce.html for a
walkthrough.

- P
-- 
Peter N. M. Hansteen, member of the first RFC 1149
implementation team
http://bsdly.blogspot.com/
 http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network
traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after
42673 seconds.
_______________________________________________
freebsd-pffreebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to
"freebsd-pf-unsubscribefreebsd.org"

> > Hi,
> > 
> > I'm running freebsd 7-RELEASE
> > 
> > I see this, for example, in my auth log:
> > 
> > May 15 02:00:39 www sshd[9180]: Invalid user web
from 201.18.232.30
> > May 15 02:00:41 www sshd[9182]: Invalid user web
from 201.18.232.30
...
> > May 15 02:01:43 www sshd[9248]: Invalid user
apache from 201.18.232.30
> > May 15 02:01:45 www sshd[9250]: Invalid user
apache from 201.18.232.30
> > May 15 02:01:47 www sshd[9252]: Invalid user
apache from 201.18.232.30
> > 
> > I'd like it to be so that if an IP tries to
connect to sshd more than
> > once in a 30 second period, that they are
immediately blackholed.
> > Should I be using pf for this or would it be done
better in some other
> > utility?
> > 
> 
> In pf you could write a rule like 
> 
> pass in quick on $ext_if proto tcp from any to
$some_ip_address port 22
> flags S/SAFR keep state (max-src-conn 1,
max-src-conn-rate 1/30,
> overload <ssh_hacks> flush global) 
> 
> you would have to have setup a table named
<ssh_hacks> in your
> configuration and assign values to both $ext_if and
$some_ip_address or
> replace them with whatever values work for you. 
> 
> This rule would track connections allowing a maximum of
1 connection per
> source IP address and would allow 1 connection to be
initiated every 31
> seconds or longer, otherwise it would add the offending
IP address to
> the <ssh_hacks> table and flush the global state
table of all entries
> from the same source IP. 
> 
> You would have to have a rule in your configuration
prior to this rule
> that would block traffic from source IP addresses in
the ssh_hacks
> table. Depending on your policies this could be a block
of all services
> or just ssh. Personally I use a rule like
> 
> block drop log quick from <ssh_hacks> 
> 
> but 
> 
> block drop log in quick proto tcp from
<ssh_hacks> to any port 22 
> 
> would block ssh traffic from the offending IP to just
ssh services on
> your network. 
> 
> Beware that you can lock yourself out of your servers
very quickly with
> this if you do not have another rule allowing yourself
access to your
> machines setup earlier in your configuration. 
> 

I have a nice script for my OpenBSD machines aviable, with
some small changes it will work also on FreeBSD.

The script make usage of a special table <bf_ssh>
dumps and compare the addresses with a run some minutes ago
(cron job) and reports the ip's per mail with the help of
GeoIP.
This reports make it easy to block big network ranges where
you don't expect to travel ...

You can get the script here:
h
ttp://sorry.mine.nu/scripts/pftable_to_file.sh.txt

ps:
In the directoy is also an actual bf_ssh dump from one of my
machines

regards,
 olli
-- 
Super-Aktion nur in der GMX Spieleflat: 10 Tage für 1 Euro.
Über 180 Spiele downloaden und spiele: http://flat.games.gmx.de

_______________________________________________
freebsd-pffreebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to
"freebsd-pf-unsubscribefreebsd.org"