[ILUG] Breakins attempted - advice please
ivan at skynet.ie
Wed Aug 27 13:14:01 IST 2008
All externally visible internet hosts are subject to port scans and
automated brute-force login attempts via SSH/HTTPS/other common services,
via bots - especially in the wake of the Debian OpenSSL weak key issue.
Restricting logins via IP is a very powerful means of protecting yourself
- and probably second on the priority list after only running
secure, encrypted services. The 3-way TCP handshake makes it very
difficult for people to reliably spoof an IP address within a TCP
connection - unless they have infiltrated an ISP somewhere.
Third would be to change off the default ports - I'm pretty sure port 22
receives more than its fair share of automated SSH cracks - likewise with
443 for HTTPS.
Obviously, the fewer services that are running the better, particularly
the fewer that are exposed (via firewall rules or otherwise) externally.
The American spooks have some reasonable basic security guidelines
(They have an extended list, which covers other OSes also:
A product which may be of interest is
It is a USB key that acts as a keyboard HID device - you select your
password field, then press a button on the key, and voila - a one-time
password is used to authenticate you.
My understanding is that there is an open-source PAM module available
for it for use with Linux.
On Wed, 27 Aug 2008, John Kinsella wrote:
> no flames please!
> I'm being regularly subjected to what appear to auth.log (and me) to be
> attempted breakins on my office desktop machine (Ubuntu Hearty Heron with
> Firestarter firewall)
> Aug 27 11:56:18 jkcray sshd: pam_unix(sshd:auth): authentication
> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=126.96.36.199 user=root
> Aug 27 11:56:20 jkcray sshd: Failed password for root from
> 188.8.131.52 port 34256 ssh2
> Aug 27 11:56:22 jkcray sshd: reverse mapping checking getaddrinfo for
> na-200-78-212-68.na.avantel.net.mx [184.108.40.206] failed - POSSIBLE BREAK-IN
> Aug 27 11:56:22 jkcray sshd: Invalid user magazine from 220.127.116.11
> Aug 27 11:56:22 jkcray sshd: pam_unix(sshd:auth): check pass; user
> Aug 27 11:56:22 jkcray sshd: pam_unix(sshd:auth): authentication
> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.104.22.168
> Aug 27 11:56:24 jkcray sshd: Failed password for invalid user magazine
> from 22.214.171.124 port 34486 ssh2
> I'd like to keep sshd running so I can log in from home.
> Other than changine firewall settings to block all but my ISP's IP addresses
> for access via ssh is there anything else that I should be looking at?
> John A. Kinsella Ph: +353-61-202148 (Direct)
> +353-61-333644 x 2148 (Switch)
> Mathematics Dept. e-mail: John.Kinsella at ul.ie
> University of Limerick FAX: +353-61-334927
> IRELAND Web: http://jkcray.maths.ul.ie
> Irish Linux Users' Group mailing list
> About this list : http://mail.linux.ie/mailman/listinfo/ilug
> Who we are : http://www.linux.ie/
> Where we are : http://www.linux.ie/map/
More information about the ILUG