Re: [gentoo-user] SSH authentication attempts - serious issue

["Leandro Melo de Sales" <leandroal@gmail.com>]

How can I recompiler openssh to support tcpwrapper? I can't find
/etc/hosts.allow neither /etc/hosts.deny. Is there something missing?
Is there a way to put tcpwrapper as a turned on option for all
programs that supports it?

Specifically for openssh I edit /etc/portage/package.use file and put:

net-misc/openssh tcpwrapper, but I got this:

# emerge --pretend openssh

These are the packages that I would merge, in order:

Calculating dependencies ...done!
[ebuild   R   ] net-misc/openssh-4.3_p2-r1

I want to see +tcpwrapper...

Leandro

2006/6/5, Oliver Schmidt <oli@kernelpanic.ch>:
> > Hi,
> >
> >    today when I was checking the server log I got many external
> > attempts to connect to my sshd service:
> >
> > ...
> > Jun  5 05:09:45 embedded sshd[4740]: Invalid user barbara from x.y.w.z
> > Jun  5 05:09:46 embedded sshd[4742]: Invalid user barb from x.y.w.z
> > Jun  5 05:09:48 embedded sshd[4744]: Invalid user barbie from x.y.w.z
> > Jun  5 05:09:50 embedded sshd[4746]: Invalid user barbra from x.y.w.z
> > Jun  5 05:09:51 embedded sshd[4748]: Invalid user barman from x.y.w.z
> > Jun  5 05:09:53 embedded sshd[4750]: Invalid user barney from x.y.w.z
> > ...
> >
> > this seems to be a brute force attack, but one thing that worried me
> > is why sshd didn't disconnect the remote host after 3 unsuccessful
> > attemps? If we see in the log, there are many attemps with time
> > interval between attemps of 2 or 3 seconds meaning that the sshd
> > didn't disconnect the remote host after 3 attempts.
> >  So, first, Am I thinking correct about the sshd attempts?
> >  Second, how can I setup sshd or the entire system to permit just 2 or
> > 3 attempts of authentication? I was checking the /etc/login.defs file
> > and I see the following option:
> >
>
> Try use Denyhosts ... no problem with bruteforce attacks anymore. Denyhosts
> add the IP of the attacker to the /etc/hosts.deny file.
> Install it with:
> ACCEPT_KEYWORDS="~x86" emerge denyhosts
> and add to your /etc/crontab
> */10 * * * * root python /usr/bin/denyhosts -c /etc/denyhosts.conf
>
> Use it now for more then a year... its perfect to block bruteforce attacks.
>
> cheers
> Oli
>
>
> --
> gentoo-user@gentoo.org mailing list
>
>
-- 
gentoo-user@gentoo.org mailing list