Re: Detecting Brute-Force and Dictionary attacks

On 19-okt-2006, at 19:42, Cor Gest wrote:

>
> Some entity AKA "Shashi Kanth Boddula" <[email protected]>
>  wrote this mindboggling stuff, while thinking about the OS-BBQ.
>
> (selectively-snipped-or-not-p)
>> Hi All,
>>
>> I am looking for a good tool to detect brute-force and dictionary  
>> attacks on user accounts on a Linux system . The tool should also  
>> have the intelligence to differntiate between user mistakes and  
>> actual brute-force/dictionary attacks and reduce the false  
>> positives. SuSE/RedHat included security tools are not helping in  
>> this case .
>>
>> Please , anyone knows any third party security tool or any  
>> opensource security  tool which solves my problem ?
>
> A basic is allready in the  system in the config of /etc/login.defs
> login_delay 'nn sec' and max_retry 'nn' and log the fails.
> A delay of 5 minutes after 2 failed is annoying enoug to most.
>
> But how do you want to differentiate between "usert" and "uiser" ,
> wich can be honest typoos or part of the dictionary , since dicts
> trive on those 'typoos'.

I think the OP would like to detect common attacks like the ssh worms
running around in the wild. Maybe an oracle machine, no not a machine
running oracle,  should be available for dynamic locations.

I would suggest to log to a script before it gets written to the  
syslog. Within
the script (or daemon) it could be detected how fast a user is trying  
to log
on:


Oct 15 13:40:14 xxxxxi sshd[4885]: Could not reverse map address  
200.x.x.x.
Oct 15 13:40:17 xxxxxi sshd[4887]: Could not reverse map address  
200.x.x.x.
Oct 15 13:40:18 xxxxxi sshd[4889]: Could not reverse map address  
200.x.x.x.
Oct 15 13:40:20 xxxxxi sshd[4891]: Could not reverse map address  
200.x.x.x.
Oct 15 13:40:21 xxxxxi sshd[4893]: Could not reverse map address  
200.x.x.x.
Oct 15 13:40:23 xxxxxi sshd[4898]: Could not reverse map address  
200.x.x.x.

Any user that would type this fast would need to get a bonus or  
should be banned,
that could be arranged by the daemon/script.

It is nice to block these users on a firewall since they take up  
unwanted space
in your /var/adm/auth.log or simular logs...

Hans