On Sunday 11 December 2005 3:27 pm, Jaime Santos wrote:

Hi again,

If someone is using a script to probe port 22 of random machines, probably it does make sense to attach the ssh server to some other port. But your users will have to be warned that they have to explicitly name such a port when trying to login remotely. Furthermore, a nmap search for open ports can always reveal the services which are available, but this is a directed attack. Given the nuisance (such strategy is essentially security via obscurity), I think it isn't worth doing it.

Yes, the script kiddies are a nuisance. I use login_sentry to send them on their way (it adds their IP address to hosts.deny). http://www.lumiere.net/~j/login_sentry/ Scott -- POPFile, the OpenSource EMail Classifier http://popfile.sourceforge.net/ Linux 2.6.11.4-21.9-default x86_64 SuSE Linux 9.3 (x86-64)

I believe there's a program called sentry tools (port sentry, logcheck and host sentry) that could do the job but I think this is obsolete and the version under sourceforge is old. Does anyone know where this can be found by these days? Or there's any substitute? I want not only to monitor sshd port put also others services running... Thanks, Bruno Scott Leighton wrote:

On Sunday 11 December 2005 3:27 pm, Jaime Santos wrote:

...

Hi again,

If someone is using a script to probe port 22 of random machines, probably it does make sense to attach the ssh server to some other port. But your users will have to be warned that they have to explicitly name such a port when trying to login remotely. Furthermore, a nmap search for open ports can always reveal the services which are available, but this is a directed attack. Given the nuisance (such strategy is essentially security via obscurity), I think it isn't worth doing it.

Yes, the script kiddies are a nuisance. I use login_sentry to send them on their way (it adds their IP address to hosts.deny).

http://www.lumiere.net/~j/login_sentry/

Scott

A more amusing alternative is to move SSH to another port, and put the LaBrea tarpit on port 22 and any other commonly attacked ports (firewall module). Amusing but probably a bit irresponsible towards people who get to that port on your machine by accident.

-----Original Message----- From: Jaime Santos [mailto:jesantos@alexandre-santos.com] Sent: Monday, December 12, 2005 5:17 PM To: suse-security@suse.com Subject: Re: [suse-security] Openssh + security

Hi Bruno,

That is correct, portsentry which drops any address from which a portscan is attempted into the hosts to be denied by the firewall, was, I believe, discontinued. This checked for portscans on all ports, not just port 22.

I would also be interested to know if there is an updated alternative tool.

Thanks. Best, Jaime.

Thanks for the reference. I'd forgotten about that small bit of panic. It's nice to live in a liberal democracy. I think that's an overstatement of the summary presented in the article referenced. "Possibly illegal" is the strongest you can get from it. Having said that, I'm fairly safe unless the CIA has taken to using extraordinary rendition for misdemeanours (fewer than 10 exposed gateways / firewalls) or to arresting relatives! It's not clear that LaBrea is any more active than portsentry. As I understand it, all it does is to not complete the connection set-up exchange, but keep sending "wait-a-bit" responses as it has no resources to respond properly. Sounds fair enough to me. I don't allocate resources to opening non-invited connections. It's no more offensive than trying to see how long you can keep politicians talking on the doorstep, keeping phone salesmen talking, or posting unrequested free offers back to the sender without postage attached. I do all of those as well. _____ From: Jaime Santos [mailto:jesantos@alexandre-santos.com] Sent: Monday, December 12, 2005 6:24 PM To: Admin; suse-security@suse.com Subject: Re: [suse-security] Openssh + security Hi, Hmm, not just irresponsible, but also illegal in the US, so watch out if you are travelling there ;-). I heard the conditions in US prisons are not particularly pleasant :-) ... Check this (somewhat outdated) article on the LaBrea tool: http://seclists.org/lists/isn/2003/Apr/0103.html I would tend to say that any passive countermeasures (such as a porsentry like tool) are okay, any active countermeasures are a bad idea, or at least you are in swampy territory here... Best, Jaime.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2005-12-11 at 15:46 -0800, Scott Leighton wrote:

Yes, the script kiddies are a nuisance. I use login_sentry to send them on their way (it adds their IP address to hosts.deny).

That list could grow very large. Also, if those attacks come from dynamic ips, you could have a deny line for an IP that has changed owner, and now is an honest person, while the attacker is using a new one you do not have listed yet. I think I read in passing somewhere about an iptables rule to deny temporarily access to a certain IP; the rule is temporary and disappears after some time, freeing resources. But I don't know what is it. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDndm7tTMYHG2NR9URApSmAJ0WuUjdVdPVlZM7RdnTys56dsO7qACghFtm QtqC1F5kXDtFZ8apoGySMzY= =fDVs -----END PGP SIGNATURE-----

On Mon, 12 Dec 2005, Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

The Sunday 2005-12-11 at 15:46 -0800, Scott Leighton wrote:

...

Yes, the script kiddies are a nuisance. I use login_sentry to send them on their way (it adds their IP address to hosts.deny).

That list could grow very large. Also, if those attacks come from dynamic ips, you could have a deny line for an IP that has changed owner, and now is an honest person, while the attacker is using a new one you do not have listed yet.

I think I read in passing somewhere about an iptables rule to deny temporarily access to a certain IP; the rule is temporary and disappears after some time, freeing resources.

But I don't know what is it.

I assume you're looking for the "recent" module for iptables. # Blocking ssh attacks /usr/sbin/iptables -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --set /usr/sbin/iptables -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack --update --seconds 60 --hitcount 6 -j LOG --log-prefix 'SSH attack: ' /usr/sbin/iptables -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack --update --seconds 60 --hitcount 6 -j REJECT This will block all further syns from an IP address starting on the sixth port 22 connection within 60 seconds. It takes 60 seconds of absolute quiet from that same ip address (or a reboot) to make the block go away. Kills a LOT of brute force ssh attacks. I've also used this both against web statistics spammers and email DOSers with good results. Bjørn -- Bjørn Tore Sund Phone: (+47) 555-84894 Stupidity is like a System administrator Fax: (+47) 555-89672 fractal; universal and Math. Department Mobile: (+47) 918 68075 infinitely repetitive. University of Bergen VIP: 81724 Support: http://bs.uib.no Contact: teknisk@mi.uib.no Direct: bjornts@mi.uib.no

Hi, This discussion has developed in two different directions, namely how SSH works and in particular how challenge-response is implemented and the use of different rules to block scan attempts, both to port 22 and also in general. Let me clarify that, although I do use challenge-response, I do not think it is a universal panacea. If your users are computer literate, then its is a good idea to implement it (it also works under Windows ssh-clients such as Putty, but I have no idea how to). If not, which is the most probable thing if you administer a network with hundreds of users, then you will have to keep password authentication and a blocking rule against password attacks is a good idea. It is in any case worth implementing, I think, specially if it is designed to block general port scans, rather than just single ports like port 22. You never know if your apache server, or mail server, or whatever is vulnerable. To repeat the mantra of security people, security is a layered process. Two locks are always better than one :-) ... Best, Jaime.

Jaime Santos wrote:

Hi again,

If someone is using a script to probe port 22 of random machines, I see half a dozen or more each day, on each machine. Believe it's happening.

probably it does make sense to attach the ssh server to some other port. But your users will have to be warned that they have to explicitly name such a port when trying to login remotely. Furthermore, a nmap search for open ports can always reveal the services which are available, but this is a directed attack. Given the nuisance (such strategy is essentially security via obscurity), I think it isn't worth doing it.

nmap or equivalent's always being run too. However, generally the assumption is that port 22 is ssh because that's where ssh is. What I've found works a treat is to use /etc/hosts.{allow,deny} to restrict connexions to my region, determined by networks from which known-good connexions come. Since I did that some months ago, over several machines I've had thousands of connexions rejected because they're from out of area, and maybe one that tried his dictionary. I also moved incoming connexions to a different machine where users who can't connect from remote can't authenticate. Another good idea, but one that requires more work to set up, is to set up a VPN: I use openvpn. The VPN authenticates, and yoiu can trust people with a VPN better than you would the average Joe, Guiseppe or Josephine. You still have to control the VPN keys as you would any password.

...

You will also see many people recommending you change the default port from 22 to some high port number, but I'm not so sure that makes much of a difference.

By changing the ports on some of my producton machines, I reduced the incorrect login attempts in my log down from circa 8-10 000 per day to only as often as I mistype my RSA passphrase :)

At least this way I can seriously view my logs with a view to noticing something sinister.

B

I´ve got the same number of incorrect login in my log... and so I´ve changed the ports, just like you, adn the attack stopped... And so, now I am a sada guy, with no IP´s to have some fun.. (yes, I do usually do something with who attacks me, have even made a software to serch the logs and log all unique IP´s, and login attempts into a mysql table...) If tou likes to have fun, let the port 22 ,if don´t like to have fun with the logged ip´s, change the port!

Thank you all for your responses... Bruno

Can we allow user @host with openssh? Not using tcpwrappers, I've a domain based on my ISP and if I let the domain in I open several chances... I read that we can put matching patterns under allowed users but can't seen to find that on man 5 sshd_config... David Bear wrote:

On Sun, Dec 11, 2005 at 02:56:50PM -0800, Scott Leighton wrote:

...

On Sunday 11 December 2005 2:41 pm, Bruno Cochofel wrote:

...

I need to install an ssh server and I need some information about security options. I know that has been some kind off "attacks" on port 22 on the internet so I want to know a little more about those options under /etc/ssh/sshd_config.

The options are pretty well documented in man 5 sshd_config

Most people seem to strongly recommend setting

Protocol 2

instead of

Protocol 1,2

and

PermitRootLogin no

instead of

PermitRootLogin yes

how about

DenyGroup DenyUsers AllowGroup AllowUsers

these seem usefull for preventing brute force attacks on accounts like www, postgres, uucp, etc.

...

You will also see many people recommending you change the default port from 22 to some high port number, but I'm not so sure that makes much of a difference.

Scott

-- POPFile, the OpenSource EMail Classifier http://popfile.sourceforge.net/ Linux 2.6.11.4-21.9-default x86_64 SuSE Linux 9.3 (x86-64)

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

I'm behind an ISP an I have always diferent IP's, so I can always guess my domain, the one that comes from ISP, but it's mine and about several people. Anyway, the option AllowUsers, under OpenSSH let's you define user@somehost.com and even let's you use wildcards, * ? John Summerfield wrote:

Bruno Cochofel wrote:

...

Can we allow user @host with openssh? Not using tcpwrappers, I've a domain based on my ISP and if I let the domain in I open several chances... I read that we can put matching patterns under allowed users but can't seen to find that on man 5 sshd_config...

What's the problem with tcpwrappers.

On Dec 14, Bruno Cochofel wrote:

Well I have a problem... After reconfigured my ssh server based on all your suggestions I've opened my firewall port so I can connect from anywhere in the Internet (this was last night).

Today my CPU was around 90% and above and the program that's consuming that it's X owned by root!!!

Please check if you are running X windows and if there is a screensaver active! Don't run X on servers!! Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

Hi *, Bruno Cochofel schrieb:

Well, I'm running X. I'm a home user and the "server" it's also my PC so I have to use it.

But you do not have to use a "screensaver".

I'm also running xscreensaver and aMule (this one all the time). Maybe this is bad!!!

Oh man, inviting a DOS and wondering, why the load is high. ;-( After plugging out a Mule-Client, my 2KBit DSL-Line was another 15 Minutes unusable. ;-( Don`t use that Monster, or live with a high load and full network lines. Just my 2ct/eur Dirk

On Wednesday 14 December 2005 12:09, Bruno Cochofel wrote:

Any suggestions on using other p2p client?

It could have been a security related question, but in the current context it is most certainly not. If you have content that you can legally distribute, I think apache web server would be the best choice. It also has third party tools that enable you to put limits on bandwidth and other usage, so your internet connection does not become saturated. -- Jure Koren, n.i.

On Wednesday 14 December 2005 12:23, Crispin Cowan wrote:

That is not always true. The BitTorrent capability to distribute workload is very useful for very heavy, bursty loads. For instance, when a new Linux kernel appears, everyone rushes all at once to get it, and the web servers sag. But the BT shares just chug away, because the people who have fetched even a partial copy start taking up some of the load to pass it on to others. The distributed P2P protocol helps to absorb the burst. But in general you are correct, sharing with Apache is more manageable than sharing with a P2P client.

Yes, and BitTorrent is generally not a "classic" p2p protocol. It just enables one to distribute content more efficiently, but you still need to distribute the torrent files and have a tracker up to delegate streams. Security-wise, this is probably the best solution, but obviously not the easiest to set up and use (and I think this is not a coincidence). Regards, -- Jure Koren, n.i.

-----Original Message----- From: Crispin Cowan [mailto:crispin@novell.com] Sent: 14 December 2005 11:16 To: Bruno Cochofel Cc: Markus Gaugusch; suse-security@suse.com Subject: Re: [suse-security] Re: Openssh + security

Bruno Cochofel wrote:

...

Well, I'm running X. I'm a home user and the "server" it's also my PC so I have to use it. I'm also running xscreensaver and aMule (this one all the time). Maybe this is bad!!!

Er, yeah, this is bad.

A firewall machine for a home really does not need much power. You can go buy a crappy old computer and make it be your firewall, and keep the good one for your workstation.

I actually do run X on my gateway, but only because I like the GUI tools like YaST. To make it safe(er), I have carefully ensured that all of X is not talking to the network. AppArmor makes this a bit easier :)

But but but... yast works really well in text mode! Me, I do without X entirely. Some of my boxes just won't like the exra load :-( Heh, why does it not surprise me that you are pro AppArmour? Tom. -- Thomas Knight System Administration Officer Arts and Humanities Data Service http://www.ahds.ac.uk

Hi,

Please check if you are running X windows and if there is a screensaver active! Don't run X on servers!!

Why not? This is, what is the problem to run a X server on a server machine? I understand that it may take lots of resources, so I wont run KDE to say. But some packages do require (as far as I know) a X server (Oracle does, if I remember correctly). Is there anything wrong to run windowmaker? (i mean, security issues, not just performance issues). Thanks in advance for your comments! -- Saludos, miguel

Well I use SuSEFirewall2 but my ADSL Router has one also and it's active, letting only the web port, ssh port and aMule port open and also noip... On 12/14/05, Crispin Cowan wrote:

miguel gmail wrote:

...

...

Please check if you are running X windows and if there is a screensaver active! Don't run X on servers!!

Why not? This is, what is the problem to run a X server on a server machine? I understand that it may take lots of resources, so I wont run KDE to say. But some packages do require (as far as I know) a X server (Oracle does, if I remember correctly).

Well, try not to run X on servers, because it is a memory and CPU hog, and you generally want your servers to have lots of memory and CPU available to serve clients.

But really REALLY don't run X on security-exposed servers, because X is very, very difficult to secure.

...

Is there anything wrong to run windowmaker? (i mean, security issues, not just performance issues).

It doesn't really matter which desktop or window manager you use. X and its raft of applications are fundamentally vulnerable, because a HUGE volume of code is running as root, and a lot of it connects to the network unless you actively configurate it not to. Another large problem with X on a security sensitive server is if you actually run desktop applications (mail clients, IM clients, P2P clients, OpenOffice, etc.) and they get compromised by some vulnerability in the application, then your server is compromised.

All of this is based on the premise that your server is far more important/valuable than just one desktop, because only one person depends on the desktop, while *everyone* in the organization depends on the server. But if we are just talking about the machines in your basement :) then you likely have one client and one server and they may be the same machine, in which case the "importance" argument is moot.

However, the security benefit of a hardened gateway machine (a firewall) is still strong, and it doesn't have to be a big machine. Either go buy a cheap, old, crappy i486 or something with 32MB of RAM and deploy it as a firewall, or go buy one of those $100 firewall appliances from Linksys or whatever. But get yourself a firewall, it is much better than hoping that Gaim has finally fixed all the vulnerabilities :)

Crispin -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/ Director of Software Engineering, Novell http://novell.com

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

Hi, Bruno Cochofel wrote:

Ok, let's say I'll put a firewall PC on my network...

I have to create a masquerade rule to let the internet access my intranet web server right?

If you are new to Firewalling try out rinetd. Makes Firewall rules by far easier. In fact you simply can use Yast Firewall configuration. (Simply handle the redirected external Port as if it was opend by the Server.)

(By the way, trying to find out how to do that under yast but don't get the diference between the option Source network and requested IP, so if someone help me on this I appreciate... There's several options to create a rule so please illucidate me)

Doesn't this rule opens a hole in my intranet security if, let's say, my web server get's compromised?

Yea. Put another 5.--EUR ethernet card into the Firewall. Declare it as DMZ and put the webserver there. (But then youre workstation cannot be the webserver ;-)) Greetings Dirk TRIA IT-consulting GmbH Joseph-Wild-Straße 20 81829 München Germany Tel: +49 (89) 92907-0 Fax: +49 (89) 92907-100 http://www.tria.de Registergericht München HRB 113466 USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 Geschäftsführer: Richard Hofbauer kaufm. Geschäftsleitung: Rosa Igl-------------------------------------------------------- Nachricht von: Dirk.Schreiner@tria.de Nachricht an: bruno.cochofel@gmail.com, suse-security@suse.com # Dateianhänge: 0

Hi Crispin, Crispin Cowan wrote:

Bruno Cochofel wrote:

...

Ok, let's say I'll put a firewall PC on my network...

[...]

on the gateway machine. The latter is just as horrible for the security of your firewall as is running X on your firewall. Unless you use AppArmor :)

Crispin

Oh, you can chroot apache fairly well. SCNR Crispn. Greetings Dirk TRIA IT-consulting GmbH Joseph-Wild-Straße 20 81829 München Germany Tel: +49 (89) 92907-0 Fax: +49 (89) 92907-100 http://www.tria.de Registergericht München HRB 113466 USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 Geschäftsführer: Richard Hofbauer kaufm. Geschäftsleitung: Rosa Igl-------------------------------------------------------- Nachricht von: Dirk.Schreiner@tria.de Nachricht an: crispin@novell.com, bruno.cochofel@gmail.com, suse-security@suse.com # Dateianhänge: 0

Hi, Crispin Cowan wrote:

Dirk Schreiner wrote:

...

Crispin Cowan wrote:

...

on the gateway machine. The latter is just as horrible for the security of your firewall as is running X on your firewall. Unless you use AppArmor :)

Oh, you can chroot apache fairly well.

True, if you use any of a variety of confinement mechanisms (chroot, virtual machines (Xen, VMware, UML), AppArmor, SELinux) then you can achieve sufficient confinement of the web server that your firewall could be safe enough. The issue is how easy or difficult it is to achieve that, and to achieve it correctly because if the confinement has holes, then your security is at risk again. Chroot, in particular, has issues with being escapable if it is not configured correctly, so be careful.

I am ;-) Btw. I don`t want to start another discussion thread about AppArmor. But if you have an configuration example handy for securing apache2 on SuSE 10 I would like give AppArmor a chance. Dirk TRIA IT-consulting GmbH Joseph-Wild-Straße 20 81829 München Germany Tel: +49 (89) 92907-0 Fax: +49 (89) 92907-100 http://www.tria.de Registergericht München HRB 113466 USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 Geschäftsführer: Richard Hofbauer kaufm. Geschäftsleitung: Rosa Igl-------------------------------------------------------- Nachricht von: Dirk.Schreiner@tria.de Nachricht an: crispin@novell.com, bruno.cochofel@gmail.com, suse-security@suse.com # Dateianhänge: 0

On Sun, 11 Dec 2005 14:56:50 -0800, Scott Leighton wrote:

suse-security@suse.com

-- Fling Officer D Chaturvedi Tel- 08482-228244 9448567754