Re: ssh brute force attacks

--===============1536292420==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="zx4FCpZtqtKETZ7O"
Content-Disposition: inline


--zx4FCpZtqtKETZ7O
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Jan 28, 2011 at 03:18:37PM -0700, Ed Heron wrote:
>=20
>   However, it makes me think about SSH.  It is a secure protocol but a
> bad password could open my system up to exploitation.  This isn't a SSH
> fault but a lack of confidence in my users.  And we don't even use SSH
> from outside the private network that often (just me for maintenance).
>=20
>   We recently started using OpenVPN with certificates.  I'm working on
> adding a password so it takes both a certificate and a password to
> connect a remote machine to the private network.
>=20
>   I'm thinking that OpenVPN makes external SSH obsolete.  I could turn
> it off forcing me to start a whole VPN in order to get access to the
> internal interface.
>=20
>   Has everybody else already gotten to this conclusion or are there lots
> of people still allowing remote SSH access?
>=20
>   I'm also thinking of setting up a honey pot on my external SSH port.
> Are there any pre-configured honeypot distributions?  Would a honeypot
> that never lets anybody in because it doesn't have any valid login
> combinations be good or should it let them in and let them waste their
> time installing root kits then when they logout reset the machine.

If you don't use SSH from outside the network, don't allow access from the
outside.  Many of my boxes need remote login.  Consequently, they're often
being probed by the many botnets out there.  At one point, it got so bad
that sshd was being overwhelmed and wouldn't accept further connections.

I've been using Fail2ban (http://bit.ly/bFSCku) for sometime now.  This
stops most attacks, but when the storm gets heavy, even Fail2ban can falter.
Not too long ago, I enhanced sshd's security further with knockd
(http://bit.ly/Z7wWM).  The amount of attacks I see on a daily basis is now
near zero.  If you use a fairly complicated knock sequence, I bet you'll see
straight zeroes.  (I use only two ports that are ascendingly apart from each
other for simplicity.  This makes it easy, but it also opens things to the
occasional rapid port scanning bot(s) - that's where Fail2ban comes in).

I've also seen a lot of success from running sshd on an alternate port
(e.g., 443).  You could probably do this if you still wanted to allow for
"maintenance" access.  Almost all the SSH probing bots I've seen only look
on port 22 for the daemon.

If you want to setup a honey pot for SSH, look at Kojoney:
http://kojoney.sourceforge.net/

OpenVPN is great.  Just make sure you maintain your CRL to account for
stolen, "lost," and other misplaced equipment that was assigned a cert.

Hope this helps,

--
Matt Rechkemmer
nmlug-list-9d2Zkzbd0mmzjR9+/[email protected]

"All that is necessary for evil to succeed is for good men to do nothing."
- Edmund Burke

--zx4FCpZtqtKETZ7O
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: PK available at: http://mattrechkemmer.com/pgp.php

iQIcBAEBAgAGBQJNRJZ+AAoJEN2lFNZGIWQr8OwQAJXUGeEiFsRKIHhqhK5TsAHG
hh8zZSC22kA/fucUhv8uVs7CkiqnlOFYeJ5EtEb32P9SDlnxntVo230vc1hNOaGT
rGloeXd7189Y/Don+k8R4rGxhuYKCjpxfByB4ZCKEbfXVS2qWQFWDQOEVUAakIbg
p6Va0fnriCwPZ84NlFJjf49O7rt5qby8tKZLEtzQDNUHOcq0vYG/8xAI6ZDbKSS7
RkQd7+g7FXjNnRFqL1XerAXlzjmbnCkV59enser9yIVOFUrWHvVQlQXlRlEXdJf6
qA0l1oZm3yFOvp/EMC9aV8hoL7CN64DbxSPYDk/vjuNGD97KqRv8e9iNRngqJK3t
to5sqJ5yHVx9WM7n8NgbHlW7TltHgR+s01W8PwUuOXEaRNVPmyRYDP5cpUVdD3NV
qCKrzLvDVIYxvXTaUaRfEkrJSoPQxn9J4a+6sm5rNq0b188mr/j79f7PJ29eN7pg
3n3yWF50g7LY2SO4xCQi8pQyruuXgrM+yF2Rzbo13yzo4keSgLqfPa8x8HWhdUDO
gNIufeDohoLi2/3wlM9GqnjYwpXtq2qG5uJ0zGpuR8S6s1hgu/GSzh0/MkfvS95f
eP2WdfUbeAupA4tDLa9qqSbhJ2D9XP7TrHHU88g+v1v/p/3PlxG5N1bIxJ37zI1Y
bRbnXEhn9zAH/JOZ3ra5
=R38z
-----END PGP SIGNATURE-----

--zx4FCpZtqtKETZ7O--

--===============1536292420==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
NMLUG mailing list
[email protected]
http://lists.b9.com/cgi-bin/mailman/listinfo/nmlug

--===============1536292420==--