Hack The Sec-Leading Resource Of Linux Tutorial: bruteforce

PREVENT BRUTE-FORCE SSH ATTACKS USING IPTABLES

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="entry-title" style="border: 0px; clear: both; font-family: Lato, sans-serif; font-size: 33px; line-height: 1.09091; margin: 0px 0px 12px; outline: 0px; padding: 0px; text-transform: uppercase; vertical-align: baseline;">
<u><span style="color: #990000;">PREVENT BRUTE-FORCE SSH ATTACKS</span></u></h1>
<div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Prevent (or at least slow down) a brute-force SSH attack.</span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgh-J9cWc4F81gJfxyBV0kwTGX_WGJaF-PkRl_ShpUwpMgojO-YgoJLWyh3G9EnoZpTc6Fyj_8sE7VFXiH7a3cDj42F43FMN8LNvhW6BT5c1x6U05CW7d7ZUZbkMaVoICEMeKqpgPTnXtgS/s1600/Brute_Force_Login_Protection_hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgh-J9cWc4F81gJfxyBV0kwTGX_WGJaF-PkRl_ShpUwpMgojO-YgoJLWyh3G9EnoZpTc6Fyj_8sE7VFXiH7a3cDj42F43FMN8LNvhW6BT5c1x6U05CW7d7ZUZbkMaVoICEMeKqpgPTnXtgS/s1600/Brute_Force_Login_Protection_hackthesec.co.in.jpg" /></a></div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">By default, iptables on a CentOS 6 SSH server allows all inbound SSH traffic on port 22. See /etc/sysconfig/iptables:</span></span></div>
</div>
<div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="line-height: 15.6px;">*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;">Modify /etc/sysconfig/iptables to the following in order to allow a particular IP to initiate 5 new SSH connections within a window of 60s. If additional new SSH connections are opened for that IP, then all packets from that IP will be dropped, and the incident will be logged to /var/log/messages. After 60s that IP will be able to open 5 new SSH connections, and so on. </span></span></div>
<div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="line-height: 15.6px;">*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT
-A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 5 --rttl --name SSH -j LOG --log-prefix "BRUTE_FORCE_SSH"
-A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 5 --rttl --name SSH -j DROP
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT</span></span></pre>
</div>
<div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="line-height: 15.6px;"># service iptables stop && service iptables start</span></span></pre>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="line-height: 15.6px;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></span></pre>
</div>
</div>

PREVENT BRUTE-FORCE SSH ATTACKS USING IPTABLES

PREVENT BRUTE-FORCE SSH ATTACKS Prevent (or at least slow down) a brute-force SSH attack. By default, iptables on a CentOS 6 SSH ...

Installing BDF For Bruteforce Prevention

<div dir="ltr" style="text-align: left;" trbidi="on">
<h2 style="background-color: white; box-sizing: border-box; font-family: Raleway, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 30px; line-height: 1.1; margin-bottom: 10px; margin-top: 20px;">
<u><span style="color: #990000;">BDF For Bruteforce Prevention</span></u></h2>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">BFD is a modular shell script for parsing application logs and checking for authentication failures. It does this using a rules system where application specific options are stored including regular expressions for each unique auth format.</span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAmCYSAhZM7Yul1Qvhurz5fmAo-Xc9ifqGBC3KsZfEt4obNujDrERENB2qG5hSMRhEZ7prkdXP4Z8UnPWZfipqHKjPeV-_QdErStz4IFr_uU9p2Kx20IH2b74Zg0GFcGAbidYDafsyVPkD/s1600/Brute_Force_Login_Protection_hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAmCYSAhZM7Yul1Qvhurz5fmAo-Xc9ifqGBC3KsZfEt4obNujDrERENB2qG5hSMRhEZ7prkdXP4Z8UnPWZfipqHKjPeV-_QdErStz4IFr_uU9p2Kx20IH2b74Zg0GFcGAbidYDafsyVPkD/s1600/Brute_Force_Login_Protection_hackthesec.co.in.jpg" /></a></div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"> The regular expressions are parsed against logs using the ‘sed’ tool (stream editor) which allows for excellent performance in all environments</span></span></div>
<div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="line-height: 15.6px;">wget http://www.rfxn.com/downloads/bfd-current.tar.gz
tar zxvf bfd-current.tar.gz
cd bfd-1.4
sh install.sh</span></span></pre>
</div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">After installing we have to edit configuration file which can be found here:-</span></span></div>
<div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="line-height: 15.6px;">/usr/local/bfd/conf.bfd</span></span></pre>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="line-height: 15.6px;">www.hackthesec.co.in</span></span></pre>
</div>
</div>

Installing BDF For Bruteforce Prevention

BDF For Bruteforce Prevention BFD is a modular shell script for parsing application logs and checking for authentication failures. It do...