ConfigServer Community Forum

Hi Jonathan,

Back in the APF/BFD days, I had added an SSH block rule for /var/log/secure matching:-

eg:-
Nov 1 09:36:27 mail sshd[30573]: Did not receive identification string from 61.185.130.226

That was always followed by invalid login attempts.

More recently, I have noticed that the following short term repeated disconnects also appear to warn of impending attack:-

Nov 1 11:18:11 mail sshd[12900]: Received disconnect from 72.1.143.130: 11: Bye Bye
Nov 1 11:18:12 mail sshd[12904]: Received disconnect from 72.1.143.130: 11: Bye Bye
Nov 1 11:18:13 mail sshd[12906]: Received disconnect from 72.1.143.130: 11: Bye Bye
Nov 1 11:18:14 mail sshd[12909]: Received disconnect from 72.1.143.130: 11: Bye Bye
Nov 1 11:18:15 mail sshd[12917]: Received disconnect from 72.1.143.130: 11: Bye Bye
...
Nov 1 11:18:26 mail sshd[12965]: Invalid user PlcmSpIp from 72.1.143.130
Nov 1 11:18:26 mail sshd[12966]: input_userauth_request: invalid user PlcmSpIp
Nov 1 11:18:26 mail sshd[12966]: Received disconnect from 72.1.143.130: 11: Bye Bye
Nov 1 11:18:27 mail sshd[12972]: Invalid user PlcmSpIp from 72.1.143.130
Nov 1 11:18:27 mail sshd[12973]: input_userauth_request: invalid user PlcmSpIp
Nov 1 11:18:27 mail sshd[12973]: Received disconnect from 72.1.143.130: 11: Bye Bye
Nov 1 11:18:27 mail sshd[12975]: Invalid user abcs from 72.1.143.130
Nov 1 11:18:27 mail sshd[12976]: input_userauth_request: invalid user abcs
Nov 1 11:18:27 mail sshd[12976]: Received disconnect from 72.1.143.130: 11: Bye Bye
Nov 1 11:18:28 mail sshd[12983]: Invalid user cgi-bin from 72.1.143.130
Nov 1 11:18:28 mail sshd[12985]: input_userauth_request: invalid user cgi-bin


I like the idea of proactive blocking. Could they be added to regex.pm ?

(I would add them to regex.custom.pm) but (a) I admit to being regexpically challenged, (b) I think that would increase the load time parsing the same file again, and (c) I believe that others might benefit.

Cheers!
Marty

eta: cPanel 11.24.5-R38506 - WHM 11.24.2 - X 3.9
CENTOS 5.4 i686 standard on mail

The problem with the disconnects is that they could be valid, so you shouldn't really count them.

I'll look into adding a regex for the identification string failure, though.