If you run a server with SSHD exposed to the internet, chances are that server is being scanned for common username and password combinations. These often appear in the authorization log (/var/log/auth.log) as entries like:

cr:code Jun 12 13:33:57 localhost sshd[18900]: Illegal user admin from
Jun 12 13:37:17 localhost sshd[18904]: Illegal user admin from
Jun 12 13:37:20 localhost sshd[18906]: Illegal user test from
Jun 12 13:37:22 localhost sshd[18908]: Illegal user guest from

Extend that for several hundred lines, and you’ll have an idea of what one scan looks like.

Being somewhat opposed to the idea of people clogging my logs with useless information, I wrote a small perl script to detect these entries in the log file and block the offending source address using iptables. It detects scans within a matter of seconds, and blocks the IP quickly to stop the attack. Blocks are only enabled for a short time–as little as 30 seconds is enough to discourage most automated scanners. SBLD limits the number of simultaneous bans to reduce iptables load and it’s own resource usage, and gradually decreases the alert level for hosts when no attack is taking place.

With SBLD, the scan is quickly detected and ended.

cr:code Jun 17 13:31:58 localhost sshd[3314]: Illegal user test from
Jun 17 13:31:59 localhost sshd[3316]: Illegal user test from
Jun 17 13:32:00 localhost sshd[3322]: Illegal user tester from
Jun 17 13:32:00 localhost sbld[3326]: Blocked
Jun 17 13:32:30 localhost sbld[3326]: Unblocked

The detection method itself is a simple regex applied to the log file, so it should be fairly easy to extend the daemon to block other kinds of attacks.

SBLD is still under development, but I’d like to encourage people to try it out and/or offer improvements. I make no guarantees as to the performance, safety, or security of this software. Contact me with feedback.


Post a Comment

Comments are moderated. Links have nofollow. Seriously, spammers, give it a rest.

Please avoid writing anything here unless you're a computer. This is also a trap:

Supports Github-flavored Markdown, including [links](http://foo.com/), *emphasis*, _underline_, `code`, and > blockquotes. Use ```clj on its own line to start an (e.g.) Clojure code block, and ``` to end the block.