Subject: Re: NetBSD-3.1 was attacked: Bug of SSHD or cyrus-sasl?
To: David Sheryn <firstname.lastname@example.org>
From: Jasper Wallace <email@example.com>
Date: 01/12/2007 23:12:57
-----BEGIN PGP SIGNED MESSAGE-----
On Fri, 12 Jan 2007, David Sheryn wrote:
> On Fri, 12 Jan 2007, Eric Rudolph Pizzani wrote:
>> Date: Fri, 12 Jan 2007 22:20:12 +1100 (EST)
>> From: Eric Rudolph Pizzani <firstname.lastname@example.org>
>> To: Water NB <email@example.com>
>> Cc: pkgsrc-users@NetBSD.org, tech-net@NetBSD.org, tech-pkg@NetBSD.org,
>> Subject: Re: NetBSD-3.1 was attacked: Bug of SSHD or cyrus-sasl?
>> I've had someone do something similar on not only my NetBSD on Alpha, but also
>> Debian running on m68k. Although from what I could tell the guy couldn't get
>> in but same kind of thing, always tries stupid names like mgrt1 or something,
>> and just common first names, as well as account names like root and admin. All
>> night. It was coming from some place that had an empty website (that is, it
>> was running a web server). Can't remember where from now. He also tried to
>> break a friend's linux i386 box in much the same fasion. I'm kind of eager to
>> find out how he managed to break the cyrus account. I suppose the best
>> temporary solution is to change all non-user accounts to use nologin? Is there
>> a way of implementing a block on any IP addresses that try to login too much?
>> That would probably slow down the crackers ability to brute force a login, or
>> whatever it is that he does.
> http://fail2ban.sourceforge.net/ or similar ? (not tried it myself) Any
> other suggestions ?
I use blockhosts myself:
it uses the spawn feature of tcpwrappers so dosn't rely on log parseing.
do remember to whitelist ip's you frequently use in hosts.allow!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (NetBSD)
-----END PGP SIGNATURE-----