RE: Detecting Brute-Force and Dictionary attacks

Using System Watcher (Swatch) is very easy.  Set the swatchrc file to watch the /var/log/messages file and trigger on a keyword (incorrect, unauthorized, failed, etc), and email you when it happens.  Or set it to log to a file that emails you every hour/5 hours/day.

You can even set Swatch to execute an NMAP command then write to a file, so you have the login they were trying to use and where it came from.

 
 
 
 
John Forristel | SunGard Bi-Tech LLC | Network Security Analyst | UNIX and Linux Administration | (w) 530-879-2897 | 6:00am to 3:00pm
 

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Shashi Kanth Boddula
Sent: Wednesday, October 18, 2006 3:02 AM
To: [email protected]
Cc: [email protected]
Subject: Detecting Brute-Force and Dictionary attacks

Hi All,  

I am looking for a good tool to detect brute-force and dictionary attacks on user accounts on a Linux system . The tool should also have the intelligence to differntiate between user mistakes and actual brute-force/dictionary attacks and reduce the false positives. SuSE/RedHat included security tools are not helping in this case . 

Please , anyone knows any third party security tool or any opensource security  tool which solves my problem ?

Thanks & Regards,
Shashi Kanth,CISSP