If this doesn't get to install fail2ban don't know what will.
Brute.Fail: Watch brute force attacks fail in real time
21–30 of 268 posts
Re: Brute.Fail: Watch brute force attacks fail in real time
#22Man, that one Brazilian IP really going hard
Yes, someone got a word list.
Shame it's a Chinese one.
Re: Brute.Fail: Watch brute force attacks fail in real time
#23If this doesn't get to install fail2ban don't know what will.
And SSH key only login
Re: Brute.Fail: Watch brute force attacks fail in real time
#24For this reason I've put `endlessh` on port 22 and moved actual ssh elsewhere...
Also started using Crowdsec recently, but not sure about if it's worth it...
fail2ban out of the box works fine for SSH, but for dovecot and postfix it's somehow broken, and the configuration scripts are just too obtuse.
Re: Brute.Fail: Watch brute force attacks fail in real time
#25Its just stupid at this point. You can put up a wordpress site with 5 daily visitors, and you'll still get thousands of SSH / xmlrpc hits per day.
Re: Brute.Fail: Watch brute force attacks fail in real time
#26Oh that’s pretty fucking cool. Is code available anywhere? I run a slowly growing network of SSH honeypots that do central logging (Greylog), that I’ve been meaning to document the setup of for here somewhen. Bolting something like this onto that would be pretty funny.
No code yet, it was literally pieced together last night.
It is only processing SSH attempts from 3 hosts right now (one in colo, one EC2, one DigitalOcean) because when I pointed the full firehose at it the user experience of the website wasn't great.
Re: Brute.Fail: Watch brute force attacks fail in real time
#27If this doesn't get to install fail2ban don't know what will.
I was actually thinking about that: OT1H, fail2ban would really clean up the list, so it's not monopolized by the one joker, but OTOH given sufficient spans of time it would make the output go quiet, which for this specific case defeats the purpose
I actually much prefer the projects that give the caller a fake shell, and watch what they type after "breaking in." It'd be the Kitboga of ssh attacks :-D
Re: Brute.Fail: Watch brute force attacks fail in real time
#28Earlier quoted context omitted.
it bugs me that they're not trying the passwords in lexigraphical order :-D also, who has sshd without `PermitRootPassword=no`? they need to broaden their horizons and try `admin`, `ec2-user`, and `ubuntu` /s
Who still allows password-based login for any SSH account, root or not? Keys, certificates, or Kerberos for all users.
You'd think, but yet one still sees one or two posts a week to SO or whatever forum asking how to enable password-based login to AWS EC2 instances. Often with screenshots showing '0.0.0.0/0' as the allowed incoming range.
Re: Brute.Fail: Watch brute force attacks fail in real time
#29Man, that one Brazilian IP really going hard
it bugs me that they're not trying the passwords in lexigraphical order :-D also, who has sshd without `PermitRootPassword=no`? they need to broaden their horizons and try `admin`, `ec2-user`, and `ubuntu` /s
The people with PermitRootPassword=no are also the ones that’ll have weak default password. It’s probably actually saving the attackers time that allowing root password login and bad password choice occur together. If everyone with randomized high-entropy root passwords actually allowed root password logins that bruteforcers would have to spend so much more time!
Re: Brute.Fail: Watch brute force attacks fail in real time
#30Man, that one Brazilian IP really going hard
it bugs me that they're not trying the passwords in lexigraphical order :-D also, who has sshd without `PermitRootPassword=no`? they need to broaden their horizons and try `admin`, `ec2-user`, and `ubuntu` /s
Even if you disallow root login with a password, the user can still try to log in, and the attempt still gets logged
If you're asking why it would ever be worth it, there's always valuable stuff online with incompetent configuration. I don't know if shodan is still up, but I remember going on there in high school and getting access to random webcams (sometimes in peoples' homes)