LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-24-2006, 10:04 PM   #1
matsko
Member
 
Registered: Dec 2005
Posts: 51

Rep: Reputation: Disabled
Configuring Login Logging


Ok lets say someone is trying to brute force login their way to your box.

How would you setup a log system that would log it down?
 
Old 03-24-2006, 11:39 PM   #2
gilead
Senior Member
 
Registered: Dec 2005
Location: Brisbane, Australia
Distribution: Slackware64 14.0
Posts: 4,141

Rep: Reputation: 168Reputation: 168
Have a look at the file /etc/syslog.conf and its man page with man syslog.conf. At default settings, my box here (Slackware) logs failed logins at the terminal to /var/log/secure:
Code:
Mar 25 15:34:44 fender login[5734]: invalid password for `oracle'  on `tty6'
It also logs failed ssh attempts to /var/log/messages:
Code:
Mar 24 10:05:50 fender sshd[18451]: Invalid user jabber from 217.23.151.106
Were you looking at ways of sending your log files to a remote server in case the attacker got in?
 
Old 03-25-2006, 11:14 PM   #3
matsko
Member
 
Registered: Dec 2005
Posts: 51

Original Poster
Rep: Reputation: Disabled
Well I was thinking about something like this.

It may sound a little complicated

ok so log information about failed logs into a log file. Then have a cron job to monitor that file (every 10 min or so) and then if that file exceeds a certain length (+5 lines) then it will shut off the sshd service for an hour or so. Then have a cron job (that runs every 6 hours) that checks to see if sshd is off and then turns it on.

That way it prevents a brute force attack by literally disabling ssh for a few hours.

Is this possbile?
 
Old 03-25-2006, 11:26 PM   #4
gilead
Senior Member
 
Registered: Dec 2005
Location: Brisbane, Australia
Distribution: Slackware64 14.0
Posts: 4,141

Rep: Reputation: 168Reputation: 168
It looks possible... But if you only allow logins that use public keys (no passwords) you don't have to worry about this. Well, not until the public key stuff is cracked and spotted in the wild
 
Old 03-26-2006, 08:17 AM   #5
matsko
Member
 
Registered: Dec 2005
Posts: 51

Original Poster
Rep: Reputation: Disabled
I have never actually understood the whole system behind public keys. How do you setup a public key automated login system between your computer and the server.

Also how would you be able to setup an automated login authentication system between two servers, so that they could exchange files for redundancy?
 
Old 03-26-2006, 01:21 PM   #6
gilead
Senior Member
 
Registered: Dec 2005
Location: Brisbane, Australia
Distribution: Slackware64 14.0
Posts: 4,141

Rep: Reputation: 168Reputation: 168
Once you have your keys generated with ssh-keygen (there's a howto at http://sial.org/howto/openssh/publickey-auth/ as well as man ssh-keygen), you can set up an ssh agent. The idea is that you provide your key's passphrase to the agent at the start of your session and it provides the passphrase for all ssh connections to the server. There's similar software for Windows clients - have a look at putty. For configuring the server, there needs to be a line in /etc/ssh/sshd_config that says PasswordAuthentication no

You could use ssh forwarding for a connection between two servers so that they pass data over the encrypted channel. It depends on what you need it to as to how much work is involved. There are plenty of examples via google for various setups. For example, I use ssh to encrypt my vnc session over the LAN at work.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Bad login logging luigi95 Linux - Security 2 07-07-2005 02:54 AM
Logging failed CDE login ]un]ie Solaris / OpenSolaris 5 12-19-2004 07:18 AM
login reprompts me instead of logging in spectrumver1 Linux - Newbie 1 06-01-2004 04:29 AM
Problems configuring login manager jbiccum Linux - General 1 12-19-2003 04:15 AM
Logging in and getting login prompt again dkaplowitz Red Hat 5 11-21-2003 03:43 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 11:05 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration