<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='color:#1F497D'>I use IPTABLES mpt_recent to
handle brute force attacks on ssh, pop, and imap. ftp is a little more
problematic but can be tuned for most legitimate clients.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>This works really well and I’ve
not had a dovecot hang in years. Hope this is helpful. I suspect it’s
a lot less overhead than scanning logs all the time and catches attacks much
sooner. Tuning is in order for your environment for thresholds. Especially if
adapted for pop3 or imap from clients that have lots of users behind a firewall
(single IP).<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>One of the nice features is how
long the IP remains blocked – or rather how short. It automatically
unblocks. <o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>It’s not without problems –
I reload the firewall once a week to clear out the tables.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Hope this is helpful!<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>The snippets for ssh from my firewall
script are below. They are not a monolithic thing… they need to be
integrated into the existing IPTABLES.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># Uses the module ipt_recent
included in Centos on BQ/BX<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>#
http://snowman.net/projects/ipt_recent/<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># Create a chain for SSH brute
force detection<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -N ssh_limit<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># Create a chain for SSH
blacklisted IP's management<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -N blacklist_ssh<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>###############################################################################<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># ssh_limit Jump from the main
TCP input chain<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># Be sure to keep a ssh open to
an IP where you have access so you don't<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># ever get blocked...<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>#<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># This chain is used to allow
reasonable inbound connections<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A tcp_inbound -p TCP -s
$YOULANIPS --destination-port 22 -j ACCEPT<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A tcp_inbound -p TCP
-s 0/0 --destination-port 22 -m state --state NEW -j ssh_limit<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>###############################################################################<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># ssh_limit chain<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># This chain is used to allow
reasonable inbound connections<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># to the system/gateway. It will
throtle using the recent filter<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>echo "Process ssh_limit
chain"<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># if the ip is in the blacklist
drop it and make it wait another 60 seconds...<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -j LOG
--log-prefix "SSH Connect: "<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -m recent
--rcheck --name blacklist_ssh --seconds 60 --hitcount 1 -j LOG --log-prefix
"SSH Blacklisted:"<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -m recent
--update --name blacklist_ssh --seconds 60 --hitcount 1 -j DROP<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># sshd hit lists - update each
one<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -m recent
--set --name ssh_counting1<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -m recent
--set --name ssh_counting2<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -m recent
--set --name ssh_counting3<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -m recent
--set --name ssh_counting4<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># Our limits are no more than:<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># 3
in 30s ssh_counting1<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># 10
in 3m ssh_counting2<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># 60 in
30m ssh_counting3<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># 90 in
60m ssh_counting4<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># If a limit is exceeded,
blacklist the IP<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -m recent
--update --name ssh_counting1 --seconds 30 --hitcount 4
-j blacklist_ssh<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -m recent
--update --name ssh_counting2 --seconds 180 --hitcount 11 -j
blacklist_ssh<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -m recent
--update --name ssh_counting3 --seconds 1800 --hitcount 61 -j
blacklist_ssh<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -m recent
--update --name ssh_counting4 --seconds 3600 --hitcount 91 -j
blacklist_ssh<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># This is where we handle OK SSH
connections so accept the connecton if not rejected so far...<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -p TCP
--destination-port 22 -j ACCEPT<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># return now that we have
flagged a connection<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A ssh_limit -p TCP -j
RETURN<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>###############################################################################<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># ssh blacklist chain<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>#<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># This chain is used to allow
reasonable inbound connections<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'># to the system/gateway. It will
throtle using the recent filter<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>echo "Process ssh_blacklist
chain"<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>#just adds this IP to the
blacklist and then drops the connection<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A blacklist_ssh -m recent
--name ssh_blacklist --set<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A blacklist_ssh -j
LOG --log-prefix "Blacklisted Recent: "<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>$IPT -A blacklist_ssh -j DROP<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'>Stephanie Sullivan, President<br>
</span><b><i><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:teal'>AVIA</span></i></b><b><i><span style='font-size:10.0pt;font-family:
"Arial","sans-serif";color:#1F497D'> </span></i></b><span style='font-size:
10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>web development and
hosting<br>
a division of </span><b><i><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:teal'>AVIA</span></i></b><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'> Consulting, Inc.<br>
GSEC Certified IT Security Consultant<br>
Phone: 508-393-0750<br>
Mobile: 508-954-2842<br>
FAX: 508-975-0118</span><span style='color:#1F497D'><o:p></o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
blueonyx-bounces@blueonyx.it [mailto:blueonyx-bounces@blueonyx.it] <b>On Behalf
Of </b>Paul<br>
<b>Sent:</b> Wednesday, April 08, 2009 11:58 AM<br>
<b>To:</b> blueonyx@blueonyx.it<br>
<b>Subject:</b> [BlueOnyx:01023] Brute Force DOS attackes<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span lang=EN-GB>Please can anyone help with advice on
stopping brute force attacks and dos attacks on my home server?<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>