shh bruteforce attacks

shh bruteforce attacks - Community & Forums Related Discussions

Users browsing this thread: 5 Guest(s)

	vompatti Offline \| 20-11-2012, 05:40 AM \| #1

As you have noticed, our IRC server was done for about on day. Before it went down (I dont know why it went), there were bruteforce attacks going on.

I noticed that my box has been under attack for couple days know but nobody hasnt gain any access.

Now, you should check your host(s) logs and see if all our servers is/were under attack.

Heres some of IPs where attack came from:

What's programmers favorite thing to do? DELETE CODE!
Git: https://github.com/vhakulinen

	Amzo Offline \| 20-11-2012, 05:46 AM \| #2

These attacks aren't targeted at anyone specifically, rather it's automated programs searching a range of IP addresses and brute forcing them.

However, if you use weak passwords, I would change them and add some Iptable rules to filter any bruteforcing.

The majority of these brute force attempts originate from china and have been caught by some honey pots.

Code:
ptables -A INPUT -p tcp --dport 22 -m recent --set --name ssh --rsource

iptables -A INPUT -p tcp --dport 22 -m recent ! --rcheck --seconds 60 --hitcount 4 --name ssh --rsource -j ACCEPT

	jmbi Offline \| 20-11-2012, 09:29 PM \| #3

Well, I hope they have fun trying to crack my 44 character password.

	venam Offline \| 21-11-2012, 04:59 AM \| #4

Isn't there a limit of attempt per minutes?
If not you should definetelly do it.
/etc/security/limits.conf

	Amzo Offline \| 21-11-2012, 10:58 AM \| #5

I already setup a firewall rules to limit the number of attempts to ssh per second. Then to block that Ip if 3 attempts have been made by the IP in 1 minute.

	jolia Offline \| 23-11-2012, 04:16 PM \| #6

Yeah IPTables would be nice.

By the way, you can use Fail2ban which is really izi and fast to set up!

Or just change the SSH listening port ;)

	jmbi Offline \| 03-12-2012, 07:54 PM \| #7

These ssh attacks just get better and better...

[![image](http://i.imgur.com/9KdeK.png)](http://i..../9KdeK.png)

	jmbi Offline \| 03-12-2012, 10:32 PM \| #8

i honestly have no fucking idea

	Dritz Offline \| 04-12-2012, 12:28 AM \| #9

Dude, your setup, it's so slick!

Have you posted the specs in the desktop pics thread?

LOL BTW.

(Sorry for being OT, but I had to ask. And I figured that PMing wouldn't stimulate anyone other than me.)

"Willful ignorance is a crime"

	venam Offline \| 04-12-2012, 03:40 AM \| #10

How comes all the requests comes from 1 single IP and it's not blocked. However, I see that there's at least 4s between each attempts.

	jmbi Offline \| 04-12-2012, 06:51 PM \| #11

There are small attacks that come in groups, each one coming from a new IP address (most of them reside in China somewhere). There are usually 3-4 different attacks each day, and each individual attack looks like the one in the screenshot.

	gurhush Offline \| 05-12-2012, 01:41 PM \| #12

Doubt it's Terminal. It's likely random people in China (most sensical candidate) or someone with an agenda against us AND random people in china.

View a Printable Version