Dirs anyone know why the automated blocks aren't getting triggered on these? -- Craig (mobile) -----Original Message----- From: Ti Leggett [[email protected]] Received: Sunday, 30 Dec 2012, 11:06PM To: [email protected] Admins [[email protected]] CC: Tisha Stacey [[email protected]]; William E. Allcock [[email protected]]; [email protected] Rackow [[email protected]] Subject: Re: crypto auth So lots of places - LCRC, kBt, Magellan, ALCF, among others - are getting brute force attempts from 60.166.48.158 and the sheer number of attempts for invalid users is overwhelming the Crypto servers causing them to fall over. I've put in a request to cyber (and cyber911) as well as called Gene to put a block on that IP, but so far I haven't gotten a hold of anyone. My fear is that unless a block goes in soon-ish, the servers will fall over again in an hour or so. If anyone has any other ideas I'm open to them. On Dec 30, 2012, at 10:33 PM, Ti Leggett <[email protected]> wrote:
Dan and I got auth 'working' but there are some SQL things afoot that Dan's looking in to right now.
On Dec 30, 2012, at 10:12 PM, Ti Leggett <[email protected]> wrote:
I just got a page about crypto auth. I can't get in to auth or auth2. I rebooted auth2 and got a recovery message but I still can't ssh in with CC though I can't rule out if my token is out of sync. If auth needs to be physically booted I don't think I have access to 221 to do so. Can someone take a look and give me a call at 630-854-9335? Thanks.
On Mon, Dec 31, 2012 at 12:18:36AM -0600, Craig Stacey wrote:
Dirs anyone know why the automated blocks aren't getting triggered on these?
My knowledge of the SSH IDS is very likely out of date, but from what I remember, a block is only triggered if the same user fails to ssh N number of times within a short time period, where N ~ 5 for non-root users and N = 1 or 2 for root. During this attack, the attacker was trying a different, non-root username only once, and so it wasn't triggering the IDS based on this criteria. All the attempts were coming from the same IP however, so if the IDS can trigger based on N failed attempts from the same IP regardless of username tried, that should have created a block. John
I had spoofed logger events for this ip using root to try to get a block inserted, which also failed. According to Corby something fell over preventing new blocks. --- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055
Hm. I thought there was yet another layer of N failures (regardless of username) from the same IP in a short time span. On Dec 31, 2012, at 3:28 PM, John Valdes wrote:
On Mon, Dec 31, 2012 at 12:18:36AM -0600, Craig Stacey wrote:
Dirs anyone know why the automated blocks aren't getting triggered on these?
My knowledge of the SSH IDS is very likely out of date, but from what I remember, a block is only triggered if the same user fails to ssh N number of times within a short time period, where N ~ 5 for non-root users and N = 1 or 2 for root. During this attack, the attacker was trying a different, non-root username only once, and so it wasn't triggering the IDS based on this criteria. All the attempts were coming from the same IP however, so if the IDS can trigger based on N failed attempts from the same IP regardless of username tried, that should have created a block.
John
-- Craig
participants (3)
-
Craig Stacey -
Dan Olson -
John Valdes