[lug] Cracking attempts via SSH

[Dan Ferris]

That is some new Linux worm going around.

Have some fun with it:

# useradd test
#passwd test
Enter Password for user test: <pass>
Enter Password again: <pass>

vi /etc/passwd

Change the test login shell to /usr/local/bin/test

vi /usr/local/bin/test

#!/bin/bash

echo "you are a 31337 hax0r"
exit

:wq

chmod 700 /usr/local/bin/test
chown test.test /usr/local/bin/test

:-)

Dan


Bill Thoen wrote:
> Back around July 26, I first started seeing unauthorized attempts to gain
> access to my server via ssh. The pattern was to try accessing an account
> named 'test', then 2 seconds later to try the account 'guest.' The
> originating IPs were from Korea and China (of course) Italy, Russia, and
> other european sources. Even one from the class B network I'm on.
> 
> Then starting Aug 9, a second pattern appeared. These attempts now look
> like this (from /var/log/secure):
> 
> Aug 18 09:32:27 gisnet sshd[31737]: Illegal user test from 65.37.37.15
> Aug 18 09:32:29 gisnet sshd[31739]: Illegal user guest from 65.37.37.15
> Aug 18 09:32:31 gisnet sshd[31741]: Illegal user admin from 65.37.37.15
> Aug 18 09:32:33 gisnet sshd[31743]: Illegal user admin from 65.37.37.15
> Aug 18 09:32:36 gisnet sshd[31745]: Illegal user user from 65.37.37.15
> Aug 18 09:32:46 gisnet sshd[31747]: Failed password for root from 
> 65.37.37.15 port 4496 ssh2
> Aug 18 09:32:50 gisnet sshd[31749]: Failed password for root from 
> 65.37.37.15 port 4710 ssh2
> Aug 18 09:32:55 gisnet sshd[31751]: Failed password for root from 
> 65.37.37.15 port 4809 ssh2
> Aug 18 09:32:57 gisnet sshd[31753]: Illegal user test from 65.37.37.15
> 
> So what's going on? Are script kiddies trying out something new that I
> should be concerned about? What bothers me is the three tries on 'root'.  
> I think I've got a decent password, but I don't know much about cracking,
> so I don't know what they're capable of.
> 
> Any recommendations as to what I ought to do, or is openssh 3.5p1-6 secure 
> enough?
> 
> - Bill Thoen
> 
> 
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> Join us on IRC: lug.boulder.co.us port=6667 channel=#colug
>