67 lines
3.6 KiB
Text
67 lines
3.6 KiB
Text
################## ssh brute force attack blocker
|
|
# This sec ruleset monitors syslog messages for indications that an ssh brute-force
|
|
# login attack is underway. The trigger is an ssh login failure.
|
|
#
|
|
# If 4 additional syslog messages about ssh login failures from the same
|
|
# source address are received within next 1 minute, an iptables firewall
|
|
# rule is added to block access from the source IP.
|
|
#
|
|
# After that, the correlation operation waits until no ssh login failure
|
|
# syslog messages from the source IP have been received from the router
|
|
# during the last 2 hours, and then the iptables rule is removed. By
|
|
# definition, once the IP is blocked, there will be no more connection
|
|
# attempt failures logged by ssh (ie., packets will be dropped by the kernel
|
|
# before they reach the syslog daemon), so the rule will be flushed after
|
|
# 2 hours.
|
|
#
|
|
# Vulnerabilities of this ruleset are:
|
|
# DoS attack: if the attacker is aware of this ruleset, they could
|
|
# spoof a series of victim IP addresses (for example, the
|
|
# AOL proxy address), thus causing the server running sec
|
|
# to deny service to the victim.
|
|
#
|
|
# persistent firewall rules:
|
|
# if the sec daemon crashes or is restarted, any existing rules
|
|
# will not be removed after 2hours
|
|
#
|
|
# window=60 # sliding window (1 minute) for initial event match
|
|
# thresh=4 # number of events (ssh login failures from a given IP) that must
|
|
# # occur within the window period in order to trigger the action
|
|
#
|
|
# window2=7200 # sliding window (2 hours) for the second event match
|
|
# thresh2=0
|
|
###############
|
|
# RCSversion="$Header: /home/fedora/jkeating/pkgs/rpms/sec/devel/ssh-brute.sec,v 1.1 2006/09/01 20:54:01 xris Exp $"
|
|
#
|
|
# Representative log file entries:
|
|
# Aug 28 04:43:03 10.1.1.18 sshd(pam_unix)[22344]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=www.ace.ne.jp
|
|
# Aug 28 04:43:03 host sshd[22568]: Failed password for illegal user library from 210.230.187.218 port 55019 ssh2
|
|
# Aug 28 04:42:28 www.somehost.net sshd[9395]: Failed password for illegal user mysql from 210.230.187.218 port 52857 ssh2
|
|
# Aug 28 04:42:28 host sshd[22509]: Failed password for root from 210.230.187.218 port 52960 ssh2
|
|
# Aug 28 04:42:32 www.somehost.net sshd[9397]: Failed password for illegal user oracle from 210.230.187.218 port 53212 ssh2
|
|
# Aug 28 04:42:32 host sshd[22510]: Failed password for illegal user admin from 2 10.230.187.218 port 53243 ssh2
|
|
|
|
#
|
|
type=SingleWith2Thresholds
|
|
ptype=RegExp
|
|
pattern=sshd.*: authentication failure[ ;].* rhost=(\S+)
|
|
desc=Multiple failed ssh authentication attempts from $1
|
|
action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP )
|
|
window=60
|
|
thresh=4
|
|
desc2=Pruning iptables firewall rule blocking ssh from $1
|
|
action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP )
|
|
window2=7200
|
|
thresh2=0
|
|
|
|
type=SingleWith2Thresholds
|
|
ptype=RegExp
|
|
pattern=sshd.*: Failed password for.* user .* from (\S+)
|
|
desc=Multiple ssh password failures from $1
|
|
action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP )
|
|
window=60
|
|
thresh=4
|
|
desc2=Pruning iptables firewall rule blocking ssh from $1
|
|
action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; sleep 2; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP ; sleep 2)
|
|
window2=7200
|
|
thresh2=0
|