Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bug in widely used OpenSSH opens servers to password cracking

arstechnica.com

Post reply on HN
Print view View original

21–30 of 62 posts

Re: Bug in widely used OpenSSH opens servers to password cracking

#21

Post by gtaylor »

jasonjayr wrote: post #16
middleclick wrote: post #8

Earlier quoted context omitted.

I use key-based authentication and fail2ban. Since that won't fail like passwords, it works wonderfully and the chances of my being banned are nil.

* Until you have too may keys on your agent * Until you have a script repeatedly attempt w/o your keys unlocked * Until you try from a new computer on the same network and fail to setup your keys first. Ask me how I know :)

Important to note: You can whitelist IPs if you are worried about getting locked out from work/home. They may change periodically, but that's pretty easy to update as well.

Re: Bug in widely used OpenSSH opens servers to password cracking

#22

Post by marcosdumay »

currysausage wrote: post #13
DrTung wrote: post #3

Earlier quoted context omitted.

Have you tried fail2ban? It really helps to keep the hacking attempts down on your ssh-server(s), especially if you increase the bantime from the default 600 seconds to a couple of million...

Note that Fail2ban doesn't support IPv6 at all [1]. I'm currently using sshguard [2] instead. Edit: Thinking about it, I guess that blocking single IPv6 addresses, as sshguard does, doesn't really help at all, as it's easy to obtain huge subnets. (This might even open the door to an iptables DDoS?) Blocking whole subnets, on the other hand, doesn't sound clever either. (Who knows how many users are sharing the same s…

I'm very curious about IPv6 banning best practices.

I imagine banning /64 networks is completely harmless, but I'm not really confident on that. I'd be wary of banning anything bigger, but getting a bigger address range is very cheap, so that may be required.

I've recently written a banning layer over my email server, in case somebody tries to guess the computer's passwords. It's a certainty that an attack exploiting IPv6 will go through, so I'm interested on the subject. By the other side, no attack it received up to now cared enough to read the EHLO reply and see that the server does not support login authentication, so I'm not that concerned, I guess I'll fully migrate to public key before any brute-force attempt is successful.

Re: Bug in widely used OpenSSH opens servers to password cracking

#23

Post by stephen-mw »

Some quick tips for securing SSH:

1. Disable password authentication altogether

2. Create and use keypairs

3. Add an "AllowUsers foo" line to /etc/ssh/sshd_config so that only your user is allowed to SSH

4. Install sshguard or fail2ban and set the ban limit to a week

There are other things you can do, but I find this to be the lowest hanging fruit for the best security.

Re: Bug in widely used OpenSSH opens servers to password cracking

#24

Post by ForHackernews »

DrTung wrote: post #3
orf wrote: post #2

It's interesting to log failed SSH attempts, I normally get someone trying to brute force access within an hour or two of brining a server up. Changing to a non standard port doesn't deter them for long.

Have you tried fail2ban? It really helps to keep the hacking attempts down on your ssh-server(s), especially if you increase the bantime from the default 600 seconds to a couple of million...

I don't even think you need to pump the ban time up that high. Most of these driveby brute-force attacks are just a bot that will give up and move on to some other server as soon as it's banned.

Re: Bug in widely used OpenSSH opens servers to password cracking

#25

Post by noinsight »

Shouldn't effective brute forcing be prevented by the fact that this should be completely choking the server? I'm not completely sure what algorithms are currently used for password hashes in UNIX-likes but in any case, shouldn't this choke the server when it has to generate hashes for all those attempts at once (or consequently)? If you monitor loads at all this is very detectable. It's a good avenue for DDOS in that case though.

Re: Bug in widely used OpenSSH opens servers to password cracking

#26

Post by cillian64 »

w8rbt wrote: post #18
orf wrote: post #2

It's interesting to log failed SSH attempts, I normally get someone trying to brute force access within an hour or two of brining a server up. Changing to a non standard port doesn't deter them for long.

Here's a one-line patch that logs the passwords the bots are trying too. http://w8rbt.org/patches/sshlog.patch

As I understand it this will log all passwords anyone enters -- even correct ones. This seems like a terrible idea, or at the very least should be used only after careful consideration. Even logging incorrect passwords is a bad idea, due to slight typos by legitimate users.

Re: Bug in widely used OpenSSH opens servers to password cracking

#27

Post by w8rbt »

cillian64 wrote: post #26
w8rbt wrote: post #18

Earlier quoted context omitted.

Here's a one-line patch that logs the passwords the bots are trying too. http://w8rbt.org/patches/sshlog.patch

As I understand it this will log all passwords anyone enters -- even correct ones. This seems like a terrible idea, or at the very least should be used only after careful consideration. Even logging incorrect passwords is a bad idea, due to slight typos by legitimate users.

You are correct. The patch is meant for IT security research and honeypots. The purpose is to see what passwords the SSH brute-force bots are using. It should not be used on production systems where legit users are logging in via SSH. That would be unethical and possibly criminal (depending on location).

Also, with SSH, I use keys, not passwords. I encourage others to do that as well. You could have this patch on a honeypot and by using a SSH key, your account password would not be in play.

Re: Bug in widely used OpenSSH opens servers to password cracking

#28

Post by tedunangst »

noinsight wrote: post #25

Shouldn't effective brute forcing be prevented by the fact that this should be completely choking the server? I'm not completely sure what algorithms are currently used for password hashes in UNIX-likes but in any case, shouldn't this choke the server when it has to generate hashes for all those attempts at once (or consequently)? If you monitor loads at all this is very detectable. It's a good avenue for DDOS in tha…

Heh. I noticed a blistering two guess per second hacking attempt against my laptop because the fan went full jet engine.

Re: Bug in widely used OpenSSH opens servers to password cracking

#29

Post by angry_octet »

cillian64 wrote: post #26
w8rbt wrote: post #18

Earlier quoted context omitted.

Here's a one-line patch that logs the passwords the bots are trying too. http://w8rbt.org/patches/sshlog.patch

As I understand it this will log all passwords anyone enters -- even correct ones. This seems like a terrible idea, or at the very least should be used only after careful consideration. Even logging incorrect passwords is a bad idea, due to slight typos by legitimate users.

Agree 100%. While it might be interesting as an academic study it shouldn't be used on any system with actual users.

It is just the kind of thing I would expect dumb IT mgmt to require so they can ban swear words from passwords.

Re: Bug in widely used OpenSSH opens servers to password cracking

#30

Post by scintill76 »

stephen-mw wrote: post #23

Some quick tips for securing SSH: 1. Disable password authentication altogether 2. Create and use keypairs 3. Add an "AllowUsers foo" line to /etc/ssh/sshd_config so that only your user is allowed to SSH 4. Install sshguard or fail2ban and set the ban limit to a week There are other things you can do, but I find this to be the lowest hanging fruit for the best security.

I like to do "PermitRootLogin no" as well, but I guess it's not really necessary if one uses some of the other config you've given.
Post reply on HN