Dear sirs, i need help on people that every day try to hack our server for example this is just for to days log from fail2ban i made maximum try count 4 and 600 sec. than thay try later 600 sec again non stop please take control who they are and why they try endles, least 6 months our server IP 85.10.198.87 2012-03-08 11:40:24,591 fail2ban.actions: WARNING [ssh] Ban 61.188.179.27 2012-03-08 11:50:25,251 fail2ban.actions: WARNING [ssh] Unban 61.188.179.27 2012-03-08 12:24:17,438 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-08 12:34:18,155 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26 2012-03-08 16:05:56,897 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:15:56,881 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:18:51,182 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:28:51,845 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:31:53,052 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:41:53,736 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:44:58,987 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:48:46,242 fail2ban.actions: WARNING [ssh] Ban 123.200.5.67 2012-03-08 16:54:59,662 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:58:46,919 fail2ban.actions: WARNING [ssh] Unban 123.200.5.67 2012-03-08 17:07:23,488 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:17:24,140 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:19:59,319 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:29:59,976 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:36:36,416 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:44:06,913 fail2ban.actions: WARNING [ssh] Ban 108.15.99.40 2012-03-08 17:46:37,111 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:54:07,614 fail2ban.actions: WARNING [ssh] Unban 108.15.99.40 2012-03-08 18:14:54,932 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 18:24:55,634 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 18:32:08,092 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-08 18:41:24,809 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 18:42:08,870 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26 2012-03-08 18:51:25,466 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 22:45:58,511 fail2ban.actions: WARNING [ssh] Ban 113.108.103.11 2012-03-08 22:55:59,386 fail2ban.actions: WARNING [ssh] Unban 113.108.103.11 2012-03-09 01:03:14,565 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-09 01:13:15,311 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26
Dear anonymous Internet person, On Friday, 2012-03-09 03:44:45 +0200, <info@dhn.li> wrote:
i need help on people that every day try to hack our server for example this is just for to days log from fail2ban i made maximum try count 4 and 600 sec. than thay try later 600 sec again non stop please take control who they are and why they try endles, least 6 months our server IP 85.10.198.87
While it is possible that these are targeted attacks, most likely these are just automated systems doing scans of random systems on the Internet, looking for common vulnerabilities. Personally I use denyhosts on my machines, which puts the offenders in /etc/hosts.deny permanently. I just put up a machine 8 days ago, and it already has 32 entries. Basically this means that any host on the Internet that is listening on the SSH port is going to get constant attempts of someone to hack the machine. Question to the room - does anyone have a similar technology that works with IPv6? AFAIK both denyhosts and fail2ban only work for IPv4. :( Anyway, back to securing the boxes... You're already using fail2ban which makes brute force login attempts impractical, so you probably don't need to worry too much, unless you let users pick their own passwords in which case they may either pick very insecure passwords or use the same ones everywhere. Many web sites store their passwords unencrypted, and if they get hacked then your users' passwords can be compromised. If you control the passwords of all accounts, then you can pick practically safe ones, otherwise you may want to consider requiring public key authentication. If you're thinking about the larger issue of how to stop such attacks... I don't know. Surely some ISPs are better or worse than others, but in the end any compromised host on the Internet can be the source of such attacks. I kind of think it will require similar effort to anti-spam work, and it doesn't annoy people on a daily basis in the same way that spam does. Good luck sir, -- Shane
Dear all, On Fri, Mar 09, 2012 at 08:46:15AM +0100, Shane Kerr wrote:
Question to the room - does anyone have a similar technology that works with IPv6? AFAIK both denyhosts and fail2ban only work for IPv4. :(
We recently started using sshguard [1] that creates firewall (iptables) rules for offending IPv4 and IPv6 addresses. It's included in Debian (and probably other Linux distributions too). [1] http://www.sshguard.net/ Regards, j. -- j.hofmüller http://users.mur.at/thesix/
Also in BSD's pf there is such thing as synproxy state, which is very usable with mechanism of tables. 09.03.2012 11:01 пользователь "Jogi Hofmüller" <jogi@mur.at> написал:
Dear all,
On Fri, Mar 09, 2012 at 08:46:15AM +0100, Shane Kerr wrote:
Question to the room - does anyone have a similar technology that works with IPv6? AFAIK both denyhosts and fail2ban only work for IPv4. :(
We recently started using sshguard [1] that creates firewall (iptables) rules for offending IPv4 and IPv6 addresses. It's included in Debian (and probably other Linux distributions too).
Regards, j. -- j.hofmüller http://users.mur.at/thesix/
Dear anonymous Internet person,
Why do people on this list keep trying to ridicule people who don't give their full identity? Is there something wrong with anonymous comments? I know I brought up a number of issues and many spend their time diverting attention from the issues I raised by trying to attack me personally (a common tactic used in politics but should not be acceptable for technical discussions) instead of addressing the issues at hand. Maybe all comments should be anonymous so we don't have to put up with the people who post just to run their ads in the signature? Thank You
Rest of list, sorry for feeding the trolls! On 09/03/12 12:55, russ@consumer.net wrote:
Dear anonymous Internet person,
Why do people on this list keep trying to ridicule people who don't give their full identity? Is there something wrong with anonymous comments? Russ,
I think Penny Arcade says it best! http://www.penny-arcade.com/comic/2004/3/19/ When the commenter is anonymous, it's not possible to know what experience he or she may have. This means the comment is automatically rendered less authoritative than a comment from someone who's known to have enough experience to have a considered view of the subject at hand. You might not like this, but it is the way it works in a lot of walks of life, online and offline. Niall. -- Niall Donegan ---------------- http://www.blacknight.com Blacknight Internet Solutions Ltd, Unit 12A, Barrowside Business Park, Sleaty Road, Graiguecullen, Carlow, Ireland Company No.: 370845
When the commenter is anonymous, it's not possible to know what experience he or she may have. This means the comment is automatically rendered less authoritative than a comment from >someone who's known to have enough experience to have a considered view of the subject at hand.
What it means is that you look at the person rather than the comment. If Charles Manson were to wake up on Friday and say "it is Friday" some people would argue that is incorrect because it came from Charles Manson. For instance, from your use of the word "trolls" and your link to some childish cartoon that does not address the issue I can tell to disregard your comments without knowing anything more about you. Many of these abuse people have been acting that way for years and they would sit on a newsgroup all day and make these same stupid comments year after year after year.
Russ, Don't you see that you are diverting from the original question now? This is completely pointless, so please stop! Regards, j. -- j.hofmüller http://users.mur.at/thesix/
Many of these abuse people have been acting that way for years and they would sit on a newsgroup all day and make these same stupid comments year after year after year.
As with most of the abuse that is still discussed here, the same stupid people keep abusing it. Lots of the people here keep slapping abusers for the same things others do, over and over and over again. If that abusive behavior doesn't change, expect to be slapped. Don't expect different treatment for the same behavior on your end. So deal with it in the matter as it is (anonymously) or get on with the subject and participate on the list under your own name, Proby. Erik Bais
The original question was answered and the answered raised another issue. this is a discussion list and the point is to have a discussion and different issues often get raised along the way. As far as I can tell nobody on this list was anointed as the decider over what is abuse and what is not. Further, nobody has appointed a worldwide "spanking" authority as far as I know. Some people think otherwise and they go around (sometimes arbitrarily) disrupting Internet resources because of their own personal beliefs and point of view rather than the needs of the users of the system.
Uhmm. Would you please describe what RIPE can do on this particular issue? We are unable to control all the botnets. The only way to secure your network is to secure the boxes with technical, not administrative way. 09.03.2012 20:17 пользователь "russ@consumer.net" <russ@consumer.net> написал:
The original question was answered and the answered raised another issue. this is a discussion list and the point is to have a discussion and different issues often get raised along the way.
As far as I can tell nobody on this list was anointed as the decider over what is abuse and what is not. Further, nobody has appointed a worldwide "spanking" authority as far as I know. Some people think otherwise and they go around (sometimes arbitrarily) disrupting Internet resources because of their own personal beliefs and point of view rather than the needs of the users of the system.
The proposal about the 5 C's sounds good except you also have to include whois access policies. If you can't get to the data easily and be able to use it it is of no good. Right now there is a complicated patchwork of whois access policies. Most of them were made up by a small group of people who really don't consider all the issues. The biggest problem here is that RIPE claims to have a legal decision about whois access but they won't release it publicly. Nobody has provided a reason why this legal opinin has not been released to the community. People try to spend time attacking me and saying my comments are not constructive, etc. This is being done to divert attention from the fact that RIPE won't release the information to the community. RIPE needs to release this legal opinion to the community. There is no excuse for withholding it. Thnak You
There's rather a big difference between access to bulk whois data of any sort for security or other "internet community" related, NON COMMERCIAL purposes, versus bulk whois data to run a commercial service. On Thu, Mar 29, 2012 at 5:40 PM, russ@consumer.net <russ@consumer.net>wrote:
The proposal about the 5 C's sounds good except you also have to include whois access policies. If you can't get to the data easily and be able to use it it is of no good. Right now there is a complicated patchwork of whois access policies. Most of them were made up by a small group of people who really don't consider all the issues.
-- Suresh Ramasubramanian (ops.lists@gmail.com)
There's rather a big difference between access to bulk whois data of any sort for security or other "internet community" related, NON COMMERCIAL purposes, versus bulk whois data to run a >commercial service.
Once the information is publicly available you cannot control how it is used. Trying to control how it is used is a pointless exercise. Further, restricting the data for marketing purposes also restricts its use for security purposes as well. It boild down to restricting the data based on wheher you like what the person is doing and not whether it is legal or not. Commercial purposes are legal and without them people would not have jobs. Most security companies are also commercial. Something like Spamhaus sell services so are they a security purpose or commercial purposes? The problem is that people in the abuse community simply say the issue is black and white and they disregard the needs of users based on their own feelings about how the world should be. Their experience on the Internet is often limited to a small number of administrators and technical types and not the general user. In fact these type of people often have disdain for the average Internet user as can often be seen here by all the childish "attack" posts when someone posts something they don't like or when someone is uniformed. Most Internet users are uninformed about many issues but you cannot simply disregard them because of this. The abuse people often come off as a bunch of teenagers sitting around insulting everyone who walks by. I noticed you did not address RIPE releasing the legal opinions they have. Thank You
Russ First of all the SOCA 5 Cs document has absolutely nothing to do with WHOIS access or display. It's to with whois data validation and verification. It's also not even about IP address space and was actually aimed at domain names. With regard to your comments I have never had any issue accessing any whois data for the RIPE region (or any other region for that matter) If law enforcement or anyone else who was not using the data for commercial gain was having issues then I'm sure that it would be addressed. Regards Michele On 29 Mar 2012, at 13:10, russ@consumer.net wrote:
The proposal about the 5 C's sounds good except you also have to include whois access policies. If you can't get to the data easily and be able to use it it is of no good. Right now there is a complicated patchwork of whois access policies. Most of them were made up by a small group of people who really don't consider all the issues.
The biggest problem here is that RIPE claims to have a legal decision about whois access but they won't release it publicly. Nobody has provided a reason why this legal opinin has not been released to the community.
People try to spend time attacking me and saying my comments are not constructive, etc. This is being done to divert attention from the fact that RIPE won't release the information to the community.
RIPE needs to release this legal opinion to the community. There is no excuse for withholding it.
Thnak You
Mr Michele Neylon Blacknight Solutions ♞ Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.com/ http://blog.blacknight.com/ http://blacknight.biz http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 Locall: 1850 929 929 Facebook: http://fb.me/blacknight Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845
Russ First of all the SOCA 5 Cs document has absolutely nothing to do with WHOIS access or display. It's to with whois data validation and verification. It's also not even about IP address space and was actually aimed at domain names. With regard to your comments I have never had any issue accessing any whois data for the RIPE region (or any other region for that matter) If law enforcement or anyone else who was not using the data for commercial gain was having issues then I'm sure that it would be addressed.
The point is if you cannot access the data it does not matter if it is verified so it is interrelated. When you do a security check it is prudent to check the IP address as well as the domain so access to the vagarious whois databases (domains and IP's) is interrelated. May people are complaining about RIPE whois access as well as access to many domain registrars. You are not the only person using the Internet but your attitude is common among self-proclaimed abuse experts. The only thing that matters is their person experience and not the many millions of Internet users. You personally sit on some of these ICANN whois committees and it is clear you are not considering all the relevant issues (see my ICANN comments to the whois and fake renewal committees). The point is that a small group of people with limited experience sit on all these committees and most users are locked out of the process and people like you go around ridiculing people and trying to get them to drop out of the process. The issue has not fully been addressed because RIPE will not release the legal opinions related to whois access (something you go out of your way to avoid addressing). Thank You
Russ Reading your emails makes me think of this: "I learned long ago, never to wrestle with a pig. You get dirty, and besides, the pig likes it." (George Bernard Shaw) On 29 Mar 2012, at 13:38, russ@consumer.net wrote:
May people are complaining about RIPE whois access
Who?
as well as access to many domain registrars
Who? If you're going to make claims then you need to be able to back them up with evidence.
. You are not the only person using the Internet but your attitude is common among self-proclaimed abuse experts.
What exactly is my supposed attitude? And I've never proclaimed myself to be anything - at least I don't recall doing so
The only thing that matters is their person experience and not the many millions of Internet users.
There's nothing to stop you, or anyone else, from joining ICANN working groups
You personally sit on some of these ICANN whois committees
No I don't I'm involved in several ICANN working groups, but I'm not involved in any dealing with WHOIS.
and it is clear you are not considering all the relevant issues (see my ICANN comments to the whois and fake renewal committees
I did and they were completely irrelevant, as you used the ICANN public comments to complain about something related to your experiences with RIPE.
). The point is that a small group of people with limited experience sit on all these committees
Really? Is that based on fact or just your opinion?
and most users are locked out of the process
How are people "locked out"? When was the last time you tried to join an ICANN working group?
and people like you go around ridiculing people
That's borderline defamatory and if nothing else quite insulting
and trying to get them to drop out of the process.
Again - defamatory
The issue has not fully been addressed because RIPE will not release the legal opinions related to whois access (something you go out of your way to avoid addressing).
Last time I checked I don't work for RIPE
Thank You
Regards Michele Mr Michele Neylon Blacknight Solutions ♞ Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.com/ http://blog.blacknight.com/ http://blacknight.biz http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 Locall: 1850 929 929 Facebook: http://fb.me/blacknight Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845
Reading your emails makes me think ...
Wrong, you don't think. You just post childish remarks and your attitude is that of a know-nothing teenager. It is funny how you keep claiming you don't about things you already commented on and I already addressed. All you do is make childish comments and idiotic statements in order to try to ridicule me in front of your friends. This happens every day in high schools all around the world. You can just keep going on claiming everything you don't agree with is "unproven" while you repeat idiotic statements over and over again without ever addressing the relevant issues. BTW - the committee you were on about fake renewal notices is related to whois because that is where they get the data to send the notices. There were several deficiencies in the report of that group and I explained that in my comments. Maybe you should try getting some type of certification such as a CISSP before you get on these committees so you will have at least some idea of how to relate legal issues to technical issues. Thank You
BTW - I was on an ICANN committe some years ago. I was on the Intellectual Property Constituency for short time many years ago. I was the only non-lawyer (my degrees are in physics and com sci) in the group and I gave them some needed technical information and I saw intellectual property issues from a different perspective than what I had seen before. thank you
Hello, what you can do, besides such temporary banning, is generating an abuse report to the ISP of the said IP. But writing an AR manually takes much time, one must automate it. I have written a commercial software (ipb) which does the banning/unbanning and generating and posting the abuse report. If interested email me. Regards, U.Mutlu security@mutluit.com info@dhn.li wrote, On 2012-03-09 02:44:
Dear sirs, i need help on people that every day try to hack our server for example this is just for to days log from fail2ban i made maximum try count 4 and 600 sec. than thay try later 600 sec again non stop please take control who they are and why they try endles, least 6 months our server IP 85.10.198.87
2012-03-08 11:40:24,591 fail2ban.actions: WARNING [ssh] Ban 61.188.179.27 2012-03-08 11:50:25,251 fail2ban.actions: WARNING [ssh] Unban 61.188.179.27 2012-03-08 12:24:17,438 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-08 12:34:18,155 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26 2012-03-08 16:05:56,897 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:15:56,881 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:18:51,182 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:28:51,845 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:31:53,052 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:41:53,736 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:44:58,987 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:48:46,242 fail2ban.actions: WARNING [ssh] Ban 123.200.5.67 2012-03-08 16:54:59,662 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:58:46,919 fail2ban.actions: WARNING [ssh] Unban 123.200.5.67 2012-03-08 17:07:23,488 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:17:24,140 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:19:59,319 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:29:59,976 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:36:36,416 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:44:06,913 fail2ban.actions: WARNING [ssh] Ban 108.15.99.40 2012-03-08 17:46:37,111 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:54:07,614 fail2ban.actions: WARNING [ssh] Unban 108.15.99.40 2012-03-08 18:14:54,932 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 18:24:55,634 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 18:32:08,092 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-08 18:41:24,809 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 18:42:08,870 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26 2012-03-08 18:51:25,466 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 22:45:58,511 fail2ban.actions: WARNING [ssh] Ban 113.108.103.11 2012-03-08 22:55:59,386 fail2ban.actions: WARNING [ssh] Unban 113.108.103.11 2012-03-09 01:03:14,565 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-09 01:13:15,311 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26
participants (10)
-
Erik Bais -
info＠dhn.li -
Jogi Hofmüller -
Michele Neylon :: Blacknight -
Niall Donegan -
russ＠consumer.net -
Shane Kerr -
Suresh Ramasubramanian -
U.Mutlu -
Виталий Туровец