If you run a server with SSHD exposed to the internet, chances are that server is being scanned for common username and password combinations. These often appear in the authorization log (/var/log/auth.log) as entries like:
cr:code
Jun 12 13:33:57 localhost sshd[18900]: Illegal user admin from 219.254.25.100
Jun 12 13:37:17 localhost sshd[18904]: Illegal user admin from 219.254.25.100
Jun 12 13:37:20 localhost sshd[18906]: Illegal user test from 219.254.25.100
Jun 12 13:37:22 localhost sshd[18908]: Illegal user guest from 219.254.25.100
</cr:code>
Extend that for several hundred lines, and you’ll have an idea of what one scan looks like.
Being somewhat opposed to the idea of people clogging my logs with useless information, I wrote a small perl script to detect these entries in the log file and block the offending source address using iptables. It detects scans within a matter of seconds, and blocks the IP quickly to stop the attack. Blocks are only enabled for a short time–as little as 30 seconds is enough to discourage most automated scanners. SBLD limits the number of simultaneous bans to reduce iptables load and it’s own resource usage, and gradually decreases the alert level for hosts when no attack is taking place.
With SBLD, the scan is quickly detected and ended.
cr:code
Jun 17 13:31:58 localhost sshd[3314]: Illegal user test from 209.76.72.12
Jun 17 13:31:59 localhost sshd[3316]: Illegal user test from 209.76.72.12
Jun 17 13:32:00 localhost sshd[3322]: Illegal user tester from 209.76.72.12
Jun 17 13:32:00 localhost sbld[3326]: Blocked 209.76.72.12
Jun 17 13:32:30 localhost sbld[3326]: Unblocked 209.76.72.12
</cr:code>
The detection method itself is a simple regex applied to the log file, so it should be fairly easy to extend the daemon to block other kinds of attacks.
SBLD is still under development, but I’d like to encourage people to try it out and/or offer improvements. I make no guarantees as to the performance, safety, or security of this software. Contact me with feedback.
Post a Comment