The Optimum Attack Rate For SSH Bruteforce? Once Every Ten Seconds 167
badger.foo writes "Remember the glacially slow Hail Mary Cloud SSH bruteforcers? They're doing speedup tweaks and are preparing a comeback, some preliminary data reported by Peter Hansteen appear to indicate. The optimum rate of connections seems to be 1 per ten seconds, smack in the middle of the 'probably human' interval."
Passwords are for philistines (Score:5, Informative)
Or never... (Score:5, Informative)
Hence their most optimal rate for my system would be never, because they won't get in that way. Not that my system is impenetrable - I'm sure an intelligent hacker could compromise it - but they will never get in trying to ssh in as root.
If they're doing white pages username + dictionary password - or white pages username + blank password (I've seen both, from botnet attacks), they still won't get in on my system as none of the common user names are used there.
Re:Passwords are for philistines (Score:4, Informative)
[1] For example, if you already have to expose https to the world you could have a web app that triggers the opening of ssh access for the web client's current IP.
Re:Passwords are for philistines (Score:5, Informative)
Good point. My standard setup is to move SSHD to a non-standard port, and to turn off PasswordAuthentication completely in favour of RSA key-pairs.
Just checking my SSHD logs, it looks like I've had exactly one rejected attempt on a busy public-facing web server (which may in fact have been me, connecting from a machine that I hadn't set up a key for) in the past month... so in my experience, no, they're not trying too hard off of port 22.
But it still would not work. (Score:4, Informative)
Who cares about blocking them? They're not getting in anyway. Blocking is just additional work that may cause problems.
That's the reason that they're not going to get in. They're using usernames that don't exist (unless the sysadmin is an idiot in which case you have the regular idiot problems and it's probably been cracked already through one of those).
If you're using JUST first names or last names as usernames then you have a bigger problem.
Instead use something like one of the following:
FIrstnameLastname
Firstname.Lastname
FirstnameMiddleinitialLastname
You should be able to easily distinguish the potential threats from the random script-kiddies. That being a REAL username on your system with hundreds of login attempts.
And then you deal with that issue by changing the username. Then investigate how that username leaked.
Re:Details? (Score:5, Informative)
knockd on Linux. Apt-get should find it for you. It will execute a specified shell script when it receives a specified knock (default one is specified). That shell script can be passed the IP that knocked (so you can include it in an iptables opening within the script).
There are also implementations for Windows, should you need that.
Comment removed (Score:5, Informative)
Re:Passwords are for philistines (Score:5, Informative)
I double that up. sshd to a nonstandard port, and firewall rules to only allow access in from very specific IPs and networks.
You really shouldn't be able to ssh in from just anywhere. Even if that means throwing a copy of OpenVPN up at a static location, to ssh to the second.
I can get to most of my stuff directly from home. At a hotel, airport, or coffee shop, I am on a hostile network, and shouldn't even be able to see that the port is open.
But, most people scanning for machines with SSH on them to hit are blindly scanning port 22. It's people interested in your specific network will scan every port on every machine. Someone determined to hit your machine specifically will try every trick they can, and having SSH on port 2222, 9222, or 64222 won't help, if you have a weak password or an exploitable version.
Re:WTF, Editors? (Score:5, Informative)
Re:OpenSSH should block these (Score:4, Informative)
Why roll your own firewalling script? fail2ban works great.
In my experience fail2ban alone gets the attack rate down so low that they'll never succeed. They can scale the attack with more IPs, but large botnets aren't free and the price is apparently high enough for them to never bother any of my exposed machines.