pavement

Block repeated illegal or failed SSH logins

From FreeBSDwiki
Revision as of 03:24, 6 November 2009 by 87.106.136.77 (Talk)
Jump to: navigation, search

comment3

comment3

Contents

Firewall repeated illegal or failed SSH logins attempts

To firewall failed login attemps, a simple script that will scan the log file for illegal or failed attempts and firewall repeated IP's will do the trick. It will slow down and stop a brute force dictionary login attack.

Using the examples below you can create a file called sshd-fwscan.sh, then use cron to run the file every x minutes and it will automatically firewall the IP once it detects 5 or more failed login attempts.

/etc/syslog.conf

You need an auth.* line in your syslog.conf file in order to log all authentications.

auth.*                                          /var/log/auth.log

Using IPFW

sshd-fwscan.sh

#!/bin/sh
if ipfw show | awk '{print $1}' | grep -q 20000 ; then
        ipfw delete 20000
fi
# This catches repeated attempts for both legal and illegal users
# No check for duplicate entries is performed, since the rule
# has been deleted.
awk '/sshd/ && (/Invalid user/ || /authentication error/) {try[$(NF)]++}
END {for (h in try) if (try[h] > 5) print h}' /var/log/auth.log |
while read ip
do
        ipfw -q add 20000 deny tcp from $ip to any in
done

Note: To make sure IP's expire we delete and add rule 20000 of the firewall each time, thus if the IP's are no longer duplicates in the auth.log they are no longer firewalled.

Using IPF

sshd-fwscan.sh

#!/bin/sh
IFS='
'
for rules in `ipfstat -i | grep "group 20000"` ; do
       echo "$rules" | ipf -r -f -
done
for ips in `cat /var/log/auth.log | grep sshd | grep "Illegal" | awk '{print $10}' | uniq -d` ; do
       echo "block in quick from $ips to any group 20000" | ipf -f -
done
cat /var/log/auth.log | grep sshd | grep "Failed" | rev  | cut -d\  -f 4 | rev | sort | uniq -c | \
( while read num ips; do
   if [ $num -gt 5 ]; then
        if ! ipfstat -i | grep $ips ; then
               echo "block in quick from $ips to any group 20000" | ipf -f -
       fi
    fi
 done
)


Note: 
To make sure IP's expire we delete and add group 20000 of the firewall each time, 
thus if the IP's are no longer duplicates in the auth.log they are no longer firewalled. 
You will need to add a rule like "block in on rl0 from any to any head 20000" to your ipf rule 
set (BEFORE your actual blocking group of rules) for this to work.

Using PF

sshd-fwscan.sh

#!/bin/sh
pfctl -t ssh-violations -T flush
for ips in `cat /var/log/authlog | grep sshd | grep "Illegal" | awk '{print $10}' | uniq -d` ; do
       pfctl -t ssh-violations -T add $ips 
done
cat /var/log/authlog | grep sshd | grep "Failed" | rev  | cut -d\  -f 4 | rev | sort | uniq -c | \
( while read num ips; do
    if [ $num -gt 5 ]; then
         if ! pfctl -s rules | grep -q $ips ; then
                pfctl -t ssh-violations -T add $ips 
        fi
    fi
  done
)

Note: To make sure IP's expire we delete and add a table called ssh-violations, thus if the IP's are no longer duplicates in the authlog they are no longer firewalled.

/etc/pf.conf

table <ssh-violations> persist file "/etc/ssh-violations"
...
block drop in from <ssh-violations> to any
Note: 
When using the OpenBSD Packet Filter (PF) you must also edit your pf.conf
file to add the above table and rule.
Important: 
If this rule is added before a "pass in" rule for port 22, use the "quick" option to ensure that
OpenBSD Packet Filter (PF) drops the packet immediately, without further inspection of the
ruleset. See the man 5 pf.conf for details.

Copyrights

sshd-fwscan.sh

# Copyright (c) 2004,2005 RPTN.Net,
# Copyright (c) 2005 DaveG.ca, 
# Copyright (c) 2006 Bob (kba at ats32.ru)
# You may use this code under the GPL, version 2 or newer.
# Updates for IPF by Sasha.by

Automatically firewall IP's

/etc/crontab

In order to have the script run every 10 minutes and firewall offenders you can use something like this in your crontab file:

*/10    *       *       *       *       root    /operator/sshd-fwscan.sh

Note: Some users might prefer a tailing method rather then a scanning/searching method, but all we really want is to slow down such attacks to reduce their chances of cracking a user account and not waste our resources. The odds that a password gets cracked under 10 minutes should be rare. (The longer the password is, mixed with letters numbers and symbols, the longer it takes to crack.)

External links

Personal tools