LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 03-10-2006, 06:41 AM   #1
galle
Member
 
Registered: Sep 2003
Location: Bergen, Norway
Distribution: Debian testing
Posts: 69

Rep: Reputation: 16
ssh brute force, how do they work?


Could someone please explain me how the brute force attacks on my ssh server are supposed to work? Ssh still asks for a password even though the username is unknown. That would mean that the attacker, when going through his alphabetical list of usernames, won't know if any of the usernames was correct or not. That again would mean that to successfully gain access through a brute force attack he would need to go through all possible usernames combined with all possible passwords, wouldn't it?

That would take a zillion tries and a lot of time, so why are people still bothering to attack my box for ten minutes, going through the alphabetical list once, and then stop? Can they deduce usernames somehow or are they just plain stupid?
 
Old 03-10-2006, 06:49 AM   #2
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,790
Blog Entries: 1

Rep: Reputation: 414Reputation: 414Reputation: 414Reputation: 414Reputation: 414
These sorts of attacks don't really concern themselves with going through all possible combinations of usernames and passwords because that is just plain stupid. Instead, they tend to go for obvious combinations. Most machines are going to have a user root, so that is one to try along with obivious passwords like toor or password. These sorts of attacks really depend on the user being careless and not using strong passwords. The fact that these sorts of attacks persist suggest that such careless users are depressingly common.
 
Old 03-10-2006, 06:56 AM   #3
_KDF
Member
 
Registered: Oct 2003
Distribution: FC4/5 & RHEL4
Posts: 133

Rep: Reputation: 15
try fail2ban if they annoy you.. I love opening my email each day to see 10 more ip's banned
 
Old 03-10-2006, 06:58 AM   #4
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
That again would mean that to successfully gain access through a brute force attack he would need to go through all possible usernames combined with all possible passwords, wouldn't it?
Yes, for a true brute force,that's how it works. Which is why brute force attacks are not very effective against systems that have username/passwords that are reasonably random and include numbers and punctuation. However, if you allow "root" to login directly over ssh, then the attacker will know the most important username on the system...root.

That would take a zillion tries and a lot of time, so why are people still bothering to attack my box for ten minutes, going through the alphabetical list once, and then stop?
Exactly. Which is why these attacks are only effective against systems that have very poor passwords, like root/root, admin/admin, etc. Technically most of the attacks you'll see are called 'dictionary attacks' and use a list of words of phrases rather than iterating through letters like "aaaaaa" to "zzzzzz" (really it would be "a" to "zzzzzz").

Can they deduce usernames somehow or are they just plain stupid?
No, they can't deduce usernames (other than "root"), but what they *are* looking for are lazy or stupid administrators who use bad passwords.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Brute Force... Cottsay Linux - Software 1 03-02-2006 03:58 PM
someone trying to brute force me stitchman Slackware 8 12-16-2005 02:02 PM
SSH brute force.... compromised? heri0n Linux - Security 15 11-21-2004 05:51 PM
Brute force DHCP SSBN Linux - Networking 10 10-21-2003 10:34 AM
Brute Force kwigibo Linux - General 2 08-01-2002 12:42 AM


All times are GMT -5. The time now is 10:25 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration