SSH login attempts

Gibsonist · 04-02-2005, 04:15 PM

You can do this by defining a new separate config file for one of the services on a new port (perhaps 222) and run a second sshd with this config file

Code:

sshd -f 'new_config'

Gibsonist · 04-02-2005, 04:33 PM

Quote:

Originally posted by johnnydangerous
well if you may pls tell about ssh-agent and ssh-add

the ssh-agent takes care of your keys for you once you add it and if necessary entered the pass phrase. after this you only need to connect via ssh and no further pass phrase is asked.

you can run the agent by

Code:

ssh-agent /bin/bash

(could be ssh-agent2)
instead of /bin/bash you can use your shell you feel comfortable with,
personally I invoke bash with a different .bashrc so I know when I am in a shell running the agent

after the agent is running you run ssh-add

Code:

ssh-add

(ssh-add2) to add the keys to the agent, it will ask you the pass phrase for any key loaded, there is a way to specify which key (identity) you want to load, but lets keep things simple.

if you now establish a ssh connection you should connect without any further authentication.

to be on the secure side you can unload the keys out of the agent by running

Code:

ssh-add -D

also it is possible to lock the agent by running

Code:

ssh-add -L

it can be unlocked using

Code:

ssh-add -U

I hope this helps.

Code:

ssh-add -l

lists all loaded keys.

It is good practice to unload the keys before quiting the agent with exit.
Here is my .bashrc which I use with ssh-agent

Code:

export PS1="SSH-\u:\w>"
alias keys='ssh-add2 -l'
alias keysOn='ssh-add2'
alias keysOff='ssh-add2 -D"
alias quit='ssh-add2 -D;exit'

I simply invoke it by running

Code:

ssh-agent /bin/bash -rcfile .bashsshrc

Please note that the use of ssh-agent(2),ssh-add(2) and ssh(2) depends of your version of ssh (OpenSSH or SSH2)

johnnydangerous · 04-03-2005, 04:01 AM

thanks for info, I think it's very useful

ERBRMN · 04-17-2005, 10:02 PM

Quote:

Originally posted by johnnydangerous
thanks for info, I think it's very useful

johnnydangerous :

Have you completed SSH config with RSA authentication ?

If you had , plaese help me my problem which is following URL

http://www.linuxquestions.org/questi...hreadid=314332

Or

If you send me you config of SSH comment or sshd_config , I will glad ...... please.

damicatz · 04-26-2005, 06:29 PM

I should set up an OpenBSD Honeypot. I doubt the script kiddies would even realize it's not Linux and then try to fumble their way around trying to install Linux root kits.

johnnydangerous · 04-27-2005, 01:19 AM

how could they even reach the step to install rootkit? if you have military style authentication it's quite impossible to reach your machine maybe just through some software vulnerabilities only which is hmm... quite rare if u're up-to-date

johnnydangerous · 04-27-2005, 01:19 AM

Quote:

Originally posted by damicatz
I should set up an OpenBSD Honeypot. I doubt the script kiddies would even realize it's not Linux and then try to fumble their way around trying to install Linux root kits.

what do you mean to use such honeypot on linux? or on BSD?

damicatz · 04-27-2005, 04:54 PM

Quote:

Originally posted by johnnydangerous
how could they even reach the step to install rootkit? if you have military style authentication it's quite impossible to reach your machine maybe just through some software vulnerabilities only which is hmm... quite rare if u're up-to-date

Making a honeypot implies setting the system up in such a way that it is easy to compromise and gain root access. I'm saying though that once they do log in through SSH I doubt they would be able to do much as OpenBSD is different enough from Linux.

johnnydangerous · 04-27-2005, 11:29 PM

btw: there are numerous ways to identify you have logged on a honeypot, and once you know that the host is not considered safe - reference security focus

but do you mean having a BSDhopeypot on Linux? I actually havent seen BSD honeypots any URL?

FiveFlat · 04-29-2005, 11:25 AM

my log files show these sshd login attempts recently. Since Apr18 up to present. I traced the IP to Amsterdam. Any rate - It made me think about improving security on my home server machine (Fedora Core 3).

It's been said that telnet should *never* be enabled on Linux? Could anyone explain to me why? I can ssh but perhaps I should setup authentication for that? Unfortunately alot of this thread is not straight forward to me - so please be patient with what may seem as some ignorant responses/questions.

Thanks much!

FiveFlat · 04-29-2005, 11:26 AM

btw - how would I disable FTP in command line (ssh session). I am presently at work and if it is strongly engcourage to disable it, I would like to do it right away.

Thanks!

raxxal · 04-29-2005, 04:25 PM

Quote:

Originally posted by FiveFlat
btw - how would I disable FTP in command line (ssh session). I am presently at work and if it is strongly engcourage to disable it, I would like to do it right away.

Thanks!

As a root just do:

chkconfig --list to find the fpt deamon, then:
chkconfig --level 345 ftp_deamon off

emetib · 04-29-2005, 07:09 PM

telnet, plain text
ssh, encrypted everything

it's pretty much that simple.

jludwig · 04-30-2005, 06:48 PM

Quote:

Originally posted by Capt_Caveman
There appears to be some form of automated malware circulating around the internet in the last 2 weeks. It attempts sshd logins using simple username-password combinations. A sample scan looks like:

Jul 19 21:04:33 server sshd[28379]: Illegal user test from XXX.XXX.XXX.XXX
Jul 19 21:04:34 server sshd[28381]: Illegal user guest from XXX.XXX.XXX.XXX
Jul 19 21:04:36 server sshd[28383]: Illegal user admin from XXX.XXX.XXX.XXX
Jul 19 21:04:37 server sshd[28385]: Illegal user admin from XXX.XXX.XXX.XXX
Jul 19 21:04:38 server sshd[28387]: Illegal user user from XXX.XXX.XXX.XXX

Several reports indicate that the malicious code is a scanner designed to identify systems with weak username/passwords. Once a weak system is identified, its IP address is appended to a list for manually exploitation later on. However, the possibility of a unknown exploit has not been ruled-out.

All Linux users are recommended to implement a sensible username and password policy in order to avoid being compromised by this tool. An example of a sensible policy would be at least the use of non-dictionary, alpha-numeric+punctuation characters. Restricting sshd access to only those systems necessary will further reduce the possiblity of compromise. Access restriction can be done using iptables or tcp_wrappers (hosts.allow/deny)

Further information about this tool and failed sshd logins can be found here:
http://lists.netsys.com/pipermail/fu...ly/024612.html
http://dev.gentoo.org/~krispykringle/sshnotes.txt
http://isc.sans.org/diary.php?date=2004-08-04

There are other postings on fedora that indicate that several sites have been hit by ssh brute force attacks

dsschanze · 04-30-2005, 09:10 PM

Quote:

Originally posted by jludwig
There are other postings on fedora that indicate that several sites have been hit by ssh brute force attacks

My rh9 server has been getting hit by this junk, too! Luckily it is nothing that is causing much harm, except filling up logs with junk!