Automatically Report all SSH Brute Force Attacks to ISPs

Update 4th July: This plugin has now been in operation for about 12 hours and has sent a few notification emails overnight. So far I have had four replies from system admins confirming that these machines have been compromised. These machines have since been removed from the Internet.

SSH Brute Force Attacks on the Increase

The last few months and particularly in the last few days (beginning of July) saw a marked increase in global SSH brute force attacks.

What is SSH?

SSH is a common and secure method to remotely connect to Linux/Unix servers, be this for managing or uploading content (via SCP/SFTP for example).

Generally, system administrators configure a SSHD server to only allow a limited access by either disallowing certain users to logon (i.e. root) or by restricting from where remote connections can be made.

The Problem.

Sadly, there exists many Linux/Unix boxes with poorly configured SSHD servers. These typically have username/password combinations of test/test, web/web, john/john and so on.

It is these servers that are targeted by botnet operators. Once such a server is found, it is often compromised and itself becomes a zombie in the botnet. These servers, in turn, then go on and attempt to compromise other servers on the internet.

The Real Problem

It is fairly easy to hack proof your server. Brute force attacks can also be thwarted by running DenyHosts on your server. DenyHosts monitors all SSHD hack attempts and blacklists the attacker. DenyHosts can also be optionally configured to share your blacklist with other DenyHosts users. This sharing of blacklists can greatly reduce SSHD attempts.

The real problem still remains. SSHD attacks are now on the increase and it is no longer sufficient to blacklist offenders.

Ideally, any SSHD hack attempt should be blacklisted, logged and most importantly; the ISP of the attacker must be notified in order to disconnect the attacking machine from the internet.

The Solution - report-hack-isp Plugin

We have developed a DenyHosts plugin that will email an attacker’s ISP as soon as the attack is detected. DenyHosts supports plugins to perform extra commands when an attacker is blacklisted. This email also contains an excerpt of the SSHD logfile that provides details of the attempted attack.

DenyHosts is the first step in this pro-active approach. Download, install and enable DenyHosts to synchronise your blacklist with the DenyHosts central server.

Armed with this, an ISP has sufficient evidence to take appropriate action.

Requirements

This is applicable to Linux/Unix/BSD servers only. The plugin requires the following applications:

• DenyHosts
• report-hack-isp plugin
• Ruby 1.8.x
• grep
• cat
• whois
• host

Download

Instructions

I've posted a simple guide on how to configure and setup this plugin here.

Metalog Users

Please note that several system loggers compress output by default. This means that if a log entry is repeated, the logger caches and outputs "Last output repeated" x times to the log file.

Please note that such compression should be turned off otherwise the DenyHosts log scanner will miss several entries.

If using MetaLog, add showrepeats = 1 to your metalog.conf file.