is this a Dos Attack??

xtremeclones · 09-26-2006, 02:47 PM

Hey guys,

one of my linux boxes went offline yesterday, and i had to go reset, it. under /var/log/messages i see this.

Sep 25 12:41:56 Host sshd[14191]: reverse mapping checking getaddrinfo for static-ip-.cable.net.co failed - POSSIBLE BREAKIN ATTEMPT!

Every 7 - 10 seconds i see one of these.

What can i do to stop this??

Is there any other log that i can look at to tell me what processes went down or anything else. I do not see that they got in though.

thanks for the help

Nathanael · 09-26-2006, 03:42 PM

auth.log is good too on some distries.

you can check on www.ripe.net who the isp is of the ip / subdomain attacking you and you report it to the admin-c and tech-c (that is what ripe tells you to do)

xtremeclones · 09-26-2006, 03:46 PM

there is no auth.log in that system.

thanks for the info.

win32sux · 09-26-2006, 04:31 PM

it's not a symptom of a DoS attack... it's more like a brute-force attack (if you're seeing tons of these)... keep in mind also that when you have tons of users logging into your box via SSH it's not strange for many of them to get failed reverse DNS lookups (reverse DNS lookups can be easily disabled in your sshd_config file IIRC)... about how many (legitimate) users are accessing your box via ssh??

xtremeclones · 09-26-2006, 05:46 PM

Ok, so its a bruteforse attack. Yeah no one is supposed to ssh into this system other than me and another guy and this happens maybe twice a day.

what preventive steps can i do so that this does not happen again?

Im running FC3.

win32sux · 09-26-2006, 06:48 PM

Quote:

Originally Posted by xtremeclones

Ok, so its a bruteforse attack. Yeah no one is supposed to ssh into this system other than me and another guy and this happens maybe twice a day.

what preventive steps can i do so that this does not happen again?

Im running FC3.

for starters, see the sticky at the top of the security forum...

here's a direct link: http://www.linuxquestions.org/questi...d.php?t=340366

having your SSH daemon listen on a non-standard port will help keep the brute-force attacks down - maybe enough for your satisfaction, and maybe not... the ideal seems to be to install a solution that scans your log and then runs an IPtables command to the block IPs of obviously bogus connection attempts... more info in the sticky...

filex · 09-27-2006, 12:16 AM

Try DENYHOSTS http://denyhosts.sourceforge.net/

jschiwal · 09-27-2006, 12:30 AM

With only two authorized ssh users, it may be easier adding these two names to the AllowUsers entry of the /etc/ssh/sshd_config configuration file. All other users will be denied access. The brute force attacks will use system user names, root, common names and dictionary names. Denying root and system users access is the first step to reduce the chance of compromise.

There is a "man 5 sshd_config" manpage which will list all of the options.

Nathanael · 09-27-2006, 02:40 AM

you could also setup rsa keys with a passhprase and force the daemon to only accept keys as a authentication method