Re: [gentoo-user] Curious pattern in log files from ssh...

[Steve <Gentoo_sjh@shic.co.uk>]

Simon wrote:
> Since it is very unlikely that the attacker is targeting you
> specifically, changing the port number (and removing root access) will
> very likely stop the attack forever.  Though, if the attacker did
> target you, then you will need some more security tools (intrusion
> detection, etc...).

I recognise that this doesn't seem to be a targeted attack - but it is
still frustrating to find that someone has evaded my IP blocking
strategy... even though they pose only a slightly elevated risk by
having done so.  (Of course, I don't permit root login - that would be
madness... and, as far as I'm aware, no-one has guessed even a valid
user name... they're all obscure!)

The thing that strikes me is that, in evading my blocking strategy, they
clearly identified a bot-net of compromised hosts.  With this in mind,
ideally, I'd like to:

1. Automatically detect and block all future attacks on all ports from
all hosts which are involved in this coordinated attack.  These hosts
can't be trusted not to be malicious.
2. Somehow inform the administrator of the hosts attacking me (in a
respectful way) since, I presume, they are unaware that their host is
involved in the attack.
3. Ideally, share this kind of information so that myself and others are
better protected from bot-net attacks in future.

It's the sort of thing I imagine has already been done - and there's no
point in re-inventing the wheel.