Re: Uptick in SSH scanning?

jp wrote:
> We block ssh,telnet,ftp except for IP ranges we or our customers use. 
> hosts.allow/deny is used on the servers, and firewall rules are used on 
> the mikrotiks. At least for the past couple of years, there has been a 
> steady occurence of ssh attempts on devices that allow it. Lots of 
> automated attempts of common sounding usernames and presumably 
> passwords. After seeing so much of it, I'm suprised most other people 
> don't block everything 
IMHO throttling is alot cooler than outright blocking. If you can tell
your edge firewall/router to permanently (or for an interval of time)
block an ip that connects to your ssh port more than 10 times a minute
or something, you can protect your customers, and build a list of
compromised machines.
This wont really save you of course if admin/admin password combination
was guessed after first tcp handshake, but does provide more
"sophisticated" protection to your more "sophisticated" clients.

Forcing people to use passworded public keys is also good. Another trick
I've used is set up ldap auth across a cloud of servers, and explicitly
allow only people in say "ssh" group to ssh in - this would never
include root, and builds an explicit whitelist.

some 2c



> (with allowed exceptions) as a general principal.
> If I need to access things traveling, I will use a VPN to "phone home", 
> then I will have access via internal IPs.
>
> On Wed, Sep 03, 2008 at 09:42:23PM -0500, Chris Adams wrote:
>   
>> Has anyone else seen a significant rise in SSH scanning in the last day
>> or two?  Rather than my usual short list of blocked hosts (usually under
>> 10), I've got several hundred blocked right now, and virtually all for
>> SSH login attempts with invalid users.
>>
>> In a handful of tests, I see most running OpenSSH 3.8p1 and 3.8.1p1
>> (although I've also seen newer versions, as new as 4.7).  A number (but
>> not all) also seem to be running Debian sarge.  Were there some
>> vulnerabilities in those versions that are being exploited, or are these
>> just systems with simple usernames and bad passwords?
>>
>> -- 
>> Chris Adams <[email protected]>
>> Systems and Network Administrator - HiWAAY Internet Services
>> I don't speak for anybody but myself - that's enough trouble.
>> -- 
>> Eat sushi frequently. - Avi
>> [email protected] is the human contact address.
>> [email protected] is the list posting address.
>> See below URL for subscribe/unsubscribe and list options:
>> http://inet-access.net/mailman/listinfo/list
>>     
>
>   

-- 
Eat sushi frequently. - Avi
[email protected] is the human contact address.
[email protected] is the list posting address.
See below URL for subscribe/unsubscribe and list options:
http://inet-access.net/mailman/listinfo/list