Along the lines of sshguard is fail2ban -- http://www.fail2ban.org/wiki/index.php/Main_Page Regex based, Pythonic, .deb packages... What's not to like? -- Rhett Bassett English Agency, Postfix Coder Hunter Communications (541)734.2800 x2117 http://www.coreds.net
On Wed, 5 Aug 2009, Rhett Bassett wrote:
Along the lines of sshguard is fail2ban -- http://www.fail2ban.org/wiki/index.php/Main_Page
Regex based, Pythonic, .deb packages... What's not to like?
The Pythonic part, the lack of a whitelist, the 10-20 or so configuration files... While it works just fine, sshguard: * is natively compiled code, optimized for speed and low cpu/memory usage * supports whitelisting * supports IPv6 (which nobody cares about, yet) * does not require filters (though doesn't always work with all log files) * recognizes hostnames I hope to get a bit more involved in sshguard development to include HTTP and Asterisk log support. Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com http://www.angryox.com/ ---------------------------------------------------------------------------
Fail2ban also supports whitelisting FYI. I don't know about IPv6. On Wed, Aug 5, 2009 at 12:11 PM, Peter Beckman<beckman at angryox.com> wrote:
On Wed, 5 Aug 2009, Rhett Bassett wrote:
Along the lines of sshguard is fail2ban -- http://www.fail2ban.org/wiki/index.php/Main_Page
Regex based, Pythonic, .deb packages... ?What's not to like?
?The Pythonic part, the lack of a whitelist, the 10-20 or so configuration ?files...
?While it works just fine, sshguard: ? ?* is natively compiled code, optimized for speed and low cpu/memory usage ? ?* supports whitelisting ? ?* supports IPv6 (which nobody cares about, yet) ? ?* does not require filters (though doesn't always work with all log files) ? ?* recognizes hostnames
?I hope to get a bit more involved in sshguard development to include HTTP ?and Asterisk log support.
Beckman --------------------------------------------------------------------------- Peter Beckman ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?Internet Guy beckman at angryox.com ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? http://www.angryox.com/ --------------------------------------------------------------------------- _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
On Wed, 5 Aug 2009, Antoine Reversat wrote:
Fail2ban also supports whitelisting FYI. I don't know about IPv6.
Whoops, my bad, didn't see it mentioned in my scan of the web-based documentation. --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com http://www.angryox.com/ ---------------------------------------------------------------------------
Rhett Bassett wrote:
What's not to like?
The fact that if you used fail2ban, I can insert whatever network I like via packetcrafting and give you headaches for days. Imagine that for a moment - blocking I don't know say... 0.0.0.0 or better yet, if someone has an axe to grind with you and is capable (not difficult) of tracking down your address ranges. They could do some really cruddy stuff like have your own servers/netblocks block themselves out, have your servers block out your default route and the list goes on and on. This was a huge issue a few years ago when I wrote my own customized ssh brute force blocker... "How to check and make sure no one can inject garbage in the mix, e.g., in ssh" awk 'NF<=10&&($6=="nvalid"||$7=="user")&&$9=="from"{print $10}' /var/log/secure|sort If you wanted to parse out valid networks before they're blocked then what? awk 'NF<=10&&($6=="nvalid"||$7=="user")&&$9=="from"{print $10}' /var/log/secure|\ sort|grep -v "192.168.x.x\|172.16.x.x\|10.x.x.x" Multiple that by all of your netblocks, clients' static netblocks, etc. It would be a horrible thing to maintain. I discussed this (injection) at length with Tavis Ormandy at Gentoo some years back who whipped me into shape over this same thing (injection) in which I actually understood what he was saying and what I overlooked. The same thing I overlooked (packetcrafting) is what fail2ban and others do. But anyhow, getting *back* to Voice matters, fail2ban is not feasible in a managed environment at all. Think about the tinkerers. Those who fiddle with their Snoms, Polycoms, etc., those who travel and fire up softphones. They'd instantly get banned if they fat-fingered a password. Now you have a pretty ticked off, paying client, banned from using something they've payed for. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E
On Wed, 5 Aug 2009, J. Oquendo wrote:
The fact that if you used fail2ban, I can insert whatever network I like via packetcrafting and give you headaches for days. Imagine that for a moment - blocking I don't know say... 0.0.0.0 or better yet, if someone has an axe to grind with you and is capable (not difficult) of tracking down your address ranges. They could do some really cruddy stuff like have your own servers/netblocks block themselves out, have your servers block out your default route and the list goes on and on.
Absolutely. Use of such a tool has to be with the realization that the tool can be used against you, and that you need to really know your network, and how your firewall works.
Multiple that by all of your netblocks, clients' static netblocks, etc. It would be a horrible thing to maintain.
I disagree. A single file with a mix of netblocks, static and dynamic DNS, and customer IP addresses that allows for inline comments can be used in multiple applications. For the most part, most of your production IP services are already firewalled with an explicit whitelist. When you need production IP services available to the world (HTTP, SIP if you are handling NAT'ed customer devices), a tool that supports whitelisting and dynamically blocks for Z seconds non-whitelisted IPs and hosts that fail to authenticate (or do something) X times in Y seconds is valuable. The shell script examples you posted are bad for production, because they block on the first failed attempt, and have no method for unblocking. The tools being discussed (sshguard, fail2ban, others) block hosts for Z seconds only after X failures in Y seconds. This is useful to proactively protect the availability of your services in the following instances: * This means a tinkerer who screws up their Asterisk config and blasts you with 150 registration requests a minute would get blocked for 15 minutes before being able to try again, forcing the customer to maybe realize something isn't right, and for you to optionally be notified of the block, and maybe call the person proactively to help, AND proactively protecting your SIP registration server from being DOS'ed by a newbie. * Drive-by brute force. 150 failed auths in 1 minute indicate an attempted brute force attack. * Packetcrafting usefulness is diminished by your whitelist. While packetcrafting could be used to temporarily disconnect one of your non-whitelisted customers, at least you'd know about the block and could make an informed decision to either whitelist the client temporarily or permanently. Sometimes it will have a previously unthought of bad result on your services, which you then consider and fix. It may not be perfect, but neither is getting brute forced and having thousands of dollars of calls made on your dime, or having your customers offline because of one bad tinkerer DOSing your services at 2am while you sleep. Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com http://www.angryox.com/ ---------------------------------------------------------------------------
participants (4)
-
a.reversat＠gmail.com -
beckman＠angryox.com -
rbassett＠hunterfiber.com -
sil＠infiltrated.net