RE: [Full-disclosure] SSH Scans - Homebrew dictionary

["Michael L. Benjamin" <mike.benjamin@xxxxxxxxxxxxxxx>]

-----Original Message-----
From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx 
[mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Michel Pereira
Sent: Friday, March 17, 2006 10:44 AM
To: full-disclosure@xxxxxxxxxxxxxxxxx
Subject: [Full-disclosure] SSH Scans - Homebrew dictionary

   After of seeing a lot of ssh scans on my firewalls and home PC, I made a 
script that filters out the "Invalid User" entry inside /var/log/messages and 
do some cleaning process, the result is a dictionary (homebrew) of users that 
tried to login into my hosts.
   Into the dictionary I saw english and Brazilian Portuguese words, maybe we 
have Brazilian hackers running scan bots too.
   This work is only for experiment and curiosity to see what is happening with 
Internet today, you can get the script and dictionary in 
http://www.michel.eti.br/2006/03/ssh-scans.html

   If you have a better idea of sugestion, please mail me:
"michel@xxxxxxxxxxxxx"

Bye
--
Só Jesus salva,o homem faz backups.
http://www.michel.eti.br

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



-----------------------------------------------------------

Although not perfect... I like mine better.

(Debugging lines left in)

Of course you can apply it to anything, not just SSH and /var/log/secure. Say 
/var/log/maillog, or /var/log/httpd/access_log and make it do any sort of task, 
not just block hosts. If anyone has suggestions to improve the code in the 
script, optimise it etc. I'm all ears...

Launch on boot in /etc/rc.local as follows:

Of course the best thing to do is to block SSH at your iptables and only let in 
the addresses/networks you trust, or utilise port knocking or somesuch equally 
nerdy approach :) Moving SSH off port 22 is a pain, and I don't like 
non-standard port numbering if I can avoid it. Logging into port 31337 is not 
going to be intuitive for another administrator simply trying to start an SSH 
session. :-)

Redhat /etc/sysconfig/iptables entries:-

-A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xxx.xx.xx -m tcp -p tcp 
--dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xx.xxx.x/255.255.255.0 -m 
tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -s xxx.xxx.xxx.x/255.255.255.0 -m 
tcp -p tcp --dport 22 -j ACCEPT

I have run this script successfully for a number of months (about 6) and it 
works very well. It is structured for
expected output from /var/log/secure on a Redhat server, so you might need to 
massage it for your own needs.

----------------------------------------------------------------------------------------------------------------
#/etc/rc.local:

# Fire up ssh_brute_blocker security script
/usr/local/scripts/ssh_brute_blocker &

----------------------------------------------------------------------------------------------------------------
#!/bin/ksh
#
# ssh_brute_blocker
#
# xx/xx/2005 xx:xx - Michael L. Benjamin
#

LOG_FILE="/var/log/secure"
DENY_FILE="/etc/hosts.deny"
TMP_FILE=$(mktemp)
INBOUND_IP=""
INLINE=""
GUESS_COUNT=0
PERMIT_GUESS=4

while :
do

tail -10000 ${LOG_FILE} | grep "Failed password for illegal user" | awk 
-F"from" {'print $2'} | awk {'print $1'} | uniq > ${TMP_FILE}

while read -r INBOUND_IP
do
  GUESS_COUNT=0
#  GUESS_COUNT=$(grep ${INBOUND_IP} ${LOG_FILE} | wc -l)
  GUESS_COUNT=$(grep "from ${INBOUND_IP}" /var/log/secure | grep "Failed 
password for" | wc -l | awk {'print $1'})

#  echo IP: ${INBOUND_IP} made ${GUESS_COUNT} guesses against our server

  if [ ${GUESS_COUNT} -ge ${PERMIT_GUESS} ]
  then
      if grep ${INBOUND_IP} ${DENY_FILE} > /dev/null
      then
#          echo ${INBOUND_IP} is already listed in ${DENY_FILE} ; echo
           echo > /dev/null
      else
#          echo ${INBOUND_IP} is not listed. Adding host ${INBOUND_IP} to 
${DENY_FILE} ; echo
          echo "ALL: ${INBOUND_IP}" >> ${DENY_FILE}
          /usr/bin/logger -t ssh_brute_blocker -is Added SSH attacking host 
${INBOUND_IP} to ${DENY_FILE} [${GUESS_COUNT} attempts].
  fi
  else
#     echo Ignoring host ${INBOUND_IP} less than ${PERMIT_GUESS} wrong guesses.
      echo > /dev/null
  fi

done < ${TMP_FILE}

sleep 30

rm -f ${TMP_FILE}

done

exit 0


-----------------------------------------------------------------------------------------------------------------


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/