Re: Detecting Brute-Force and Dictionary attacks

On Wednesday 18 October 2006 03:01, Shashi Kanth Boddula wrote:
> Hi All,  
>
> I am looking for a good tool to detect brute-force and dictionary attacks
> on user accounts on a Linux system . The tool should also have the
> intelligence to differntiate between user mistakes and actual
> brute-force/dictionary attacks and reduce the false positives. SuSE/RedHat
> included security tools are not helping in this case .
>
You're going to need a modified login(1) which will record the passwords used. 
An obvious security risk, particularly as this binary is far more likely to 
be part of an attacker's kit. You'll definitely want to examine the source, 
and test it on a lab machine with at least a HIDS installed!

Then you're going to have to decide on a mechanism for detecting an actual 
dictionary attack, and periodically parse the resulting file. A simpler 
solution may lie in just counting failed logins per username.

Even that is complicated by SuSE (at least 10.0, which is the only version I 
have running here, has a broken lastb. The first time I ran it, it gave the 
standard message about /var/log/btmp possibly having been removed. So I did 
the following:

touch /var/log/btmp
chown root:tty /var/log/btmp
chmod 600 /var/log/btmp /var/log/btmp

Running lastb then gave me:

# lastbfermi:~ # lastb

btmp begins Fri Oct 20 09:49:00 2006

But it still doesn't record failed logins. You might try playing with 
ownership and permissions. I simply set it up to match a Fedora Core 4 
machine as closely as possible, given that under SuSE ownership is root:tty, 
and Fedora assigns root:utmp.

lastb was also broken from Red Hat 7 (at least) until, if my old system 
fingerprinting notes are reliable, Fedora Core 3. I won't have a RHEL server 
available until probably next week, so I can't any results for that.

> Please , anyone knows any third party security tool or any opensource
> security  tool which solves my problem ?

I very much doubt such a thing exists in a generic form--it's just such an 
obvious 'Bad Guy' sort of thing. I believe it does exist as a modified sshd, 
though, as part of a Honeypot project.

Regards,
 
Greg Metcalfe