Thanks Mike et al,
In summary this seems a most likely explanation given "root" is not one of
the attacked account names.
If it starts to get out of hand I will add some code to automatically add a
DROP iptables rule for the source IP just to quench the log entries.
At the moment the signature is so obvious and infrequent that I won't change
anything. But if it starts to pollute /var/log/secure to the point of
masking other possible hack attempts then it will cop a bullet!
Re the netblock abuse reporting it seems this is just a lip service feature
these days!
Cheers,
Frank.
-----Original Message-----
From: mike@genxweb.net [mailto:mike@genxweb.net]
Sent: Tuesday, 28 September 2004 9:54 PM
To: Frank Hamersley
Cc: Ssh List (E-mail)
Subject: Re: Illegal user ssh probes
I would say about two months ago there was a rumor of a new ssh xpl;oit that
was
in the wild. A few days after the rumor post I started seeing the same scans
come to all my servers. I searched around the net and found a new scanner
was
released for ssh.
Now as far as scanning for those user accounts I am a bit baffled, unless
these
scans are not made for linux but the windows ssh server.
On linux the admin account could possibly lead to access on the box. Many
hosting software like directadmin (www.directadmin.com) and a few others use
admin as the default master account with ssh enabled. Now if you combined
that
with a lazy user you can get the admin / admin combo.
As far as the other usernmae and pass combos it looks like basic windows
bruteforcing.
That is just my two cents take it or leave. If any one knows more I be
interested in hearing about it too.
Thanks
Mike
Quoting Frank Hamersley <terabite@bigpond.com>:
On examining /var/log/secure for several firewalls I manage remotely using
ssh I have observed a recurrent pattern of probing over the last several
that attempts to connect using user id's in the following order...
test / guest / admin / admin / user / test
We are using SSH 2 RSA key ONLY authentication ie. password based login is
not accepted, and none of these user profiles exist on the host so I am
not
too concerned.
However I am wondering if anyone has characterised the probe and/or
performed a risk assessment/analysis? The rate of probes is very low so I
don't think there is a DOS attack just yet!
Is it worth reporting the behaviour to the net block assignees in case
they
aren't aware their server might be compromised?
Is anybody else seeing this?
Regards, Frank.
