thelinuxlink.net

So I'm administering a server for the first time ever (I usually just code). I'm running ubuntu 6.06 fully up-to-date behind a firewall, running apache2 on port 80 and ssh on 22. I'm noticing what seems to be ssh brute force attacks in /var/log/auth.log... i say this b/c #1 i don't recognize the IP's, #2 it's trying numerous common user names (john, karl, bob, etc, not to mention root). I switched SSHD to run on a nonstandard port. But questions:
1) How common are such break in attempts?
2) Are there any other logs i should be paying particular attention to?
3) Where can I get a comprehensive list of know attacker-IP's?
4) Where can I report these IP's?

Good God, man, I think those are outrageously common. I switched to a non standard port because they filled up my log files with it so that it was hard to find anything else. Get port scanned constantly, too. Honestly, I've bothered trying to report IP addresses before, and always gotten nowhere. Either overseas or the people running the network just don't care. I imagine you could spend hours a day trying to report IP addresses and get nowhere, too. I'd just ignore it. Until blocking IP addresses becomes automated through some system like DCC or pyzor or Razor for spam, it's just not workable.

One nice tool to help manage this type of stuff is this:

http://denyhosts.sourceforge.net/

Be careful you configure it right. You can lock yourself out of your box. Nevertheless, I use it and it works really, really well.

Ahhh, should have known someone had already thought of synchronizing this sort of thing. Might have to try that myself.

I could give an example of one of my experiences trying to report this type of thing. I started doing a reverse DNS lookup on some of the addresses, and finally found one that was in the U.S. and it was some school in Georgia. I figured they either had a compromised box or some kid trying to mess around, and went to the website to see who to report to. I sent emails to all the "abuse@*" email addresses and others, trying to find someone who would do something. Didn't get a single response. After a couple of times of trying to do something about all the ssh attacks, mainly because I thought it was the right thing to do, I just got tired of wasting my time.

TankCatNinjaFish wrote:So I'm administering a server for the first time ever (I usually just code). I'm running ubuntu 6.06 fully up-to-date behind a firewall, running apache2 on port 80 and ssh on 22. I'm noticing what seems to be ssh brute force attacks in /var/log/auth.log... i say this b/c #1 i don't recognize the IP's, #2 it's trying numerous common user names (john, karl, bob, etc, not to mention root). I switched SSHD to run on a nonstandard port. But questions:

As long as you're the only one who needs access to ssh on this machine, switching to a non-standard port will probably help a lot. When you say "behind a firewall" do you mean a hardware firewall?

1) How common are such break in attempts?

Common and constant. If you have a box with open ports on the internet, listening, it will be hammered on, period. You can use firewall ACLs and/or tcp wrapers (/etc/hosts.allow) to greatly cut down on the namespace that has access to your ports, though.

2) Are there any other logs i should be paying particular attention to?

In theory, all of them. In practice, messages, secure, and auth are the most important, usually. It depends on what you're running and what you mean by "paying attention to." It's a good idea to install an IDS and something like rkhunter or chkrootkit, but these tend to be very chatty and will send up a lot of false positive flags. Just FYI.

3) Where can I get a comprehensive list of know attacker-IP's?

Well, you can block off all non-us IPs to begin with (or non-your-country IPs) - china, poland, and russia pound on our firewalls all day long where I work. There isn't a known-attacker database, per-se - it would be way, way, way huge if there were, and really 99%+ of all attacks are done via infected computers. The estimate is that there are at least as many infected hosts as there are non-infected hosts on the intarweb, and botnets grow all the time. That's what you're seeing FWIW, is random infected machines trying to infect yours so they can use yours to infect others.

4) Where can I report these IP's?

You can tell your ISP, and if they really care, they can contact the owner of the IP space in question, and if they can narrow down the time that IP was online and associate it with a host on their network shut that customer down until they disinfect. Basically it's a waste of time, though. Just harden your box and get on with life. Bots knocking on your doors is a fact of life, unfortunately.

On another note, I like to use logwatch. It checks for some suspicious activity, and reports back some stuff over email. Obviously not the same as scouring your logs yourself, but better than nothing, and sometimes just seeing it reminds me I need to take a look at my little server from time to time. The only problem is that I'm not a proper admin, and always worry that the attacker will be more clever than I am and be able to hide himself well enough that I don't know he's there.

It's also interesting to run something like iftop, to see how many connections you're making. Try visiting some sites without running something like noscript and watch those adservers just nail you...

Thanks for the responses Vogateer/Chess/Snarkout. Yea, I'm in a windows shop trying to move over PHP+mySQL/Oracle sites from IIS to windows. This is a good thing by itself, but unfortunately, it also means that all the users are windows users who can't understand that passwords shouldn't be transmitted in plain text over email. And apparently I'm the only one who has a clue about linux. *sigh*

Snarkout wrote:As long as you're the only one who needs access to ssh on this machine, switching to a non-standard port will probably help a lot. When you say "behind a firewall" do you mean a hardware firewall?

There's a cisco router (which I'm told is secure by the network admin) handling our network; I'm going to have to pester him.

Snarkout wrote:Common and constant. If you have a box with open ports on the internet, listening, it will be hammered on, period. You can use firewall ACLs and/or tcp wrapers (/etc/hosts.allow) to greatly cut down on the namespace that has access to your ports, though.

Yea, I think I'm going to block access from all but the three countries that need legitimate access to this machine. But question: are tcp wrappers as effective as firewall ACL's? What are the pros/cons?

Vogateer wrote:Good God, man, I think those are outrageously common. I switched to a non standard port because they filled up my log files with it so that it was hard to find anything else. Get port scanned constantly, too.

how can exactly tell I'm being port scanned?

Chess wrote:One nice tool to help manage this type of stuff is this:
http://denyhosts.sourceforge.net/

I'll definitely try that! thanks chess... i'll have to check linuxreality if you've done a show on something like..

One thing I wonder is if such lowlevel attacks are so common, how well do Windows servers handle it?

Since Windows doesn't come with SSH, I imagine they probably do fine with that specific attack. I really don't know much about Windows specific attacks, or what they go after. Isn't the RPC in Windows supposed to be poorly designed or built into the system too deeply?

Usually you'll see the portscan on a router facing the outside world. I don't ever see portscans on my own computers unless I do one myself, since they'd have to get through the firewall for that to happen. I just log onto my router, check out the logs, and I see portscans every few minutes, I think. Maybe a lot more often, though, it's hard to remember. I just remember it happening so often that I was glad I had a firewall on my router to block at least some of that junk.