[ILUG] sshd

[Niall O Broin]

On 23 Nov 2006, at 13:59, Keith Hyland wrote:

> the volumes are not large, but rather constant and its seems to be  
> evenly split incomming/outgoing.  It appears to be on port 22,  
> which, along with port 80, are the only two ports forwarded from  
> the firewall.
>
> I believe its on port 22 as when i close that port on the f/w the  
> activity stops.
>
> I have to allow ssh access to *one* remote user to admin the website.
>
> I've checked with the remote user and her activity pattern/timing  
> doesn't fit the traffic i'm seeing.

If you have 22 open to the world, you WILL get a large number of  
attempts to brute force the box, for varying values of large.

> the distro  is suse 9.3, patched monthly.
>
> With this in mind i had a look around the box, and found something  
> i think is odd:
>
> all the files in /etc/pam.d are dated back to 2005   except for / 
> etc/pam.d/sshd
>
>> #%PAM-1.0
>> auth     include        common-auth
>> auth     required       pam_nologin.so
>> account  include        common-account
>> password include        common-password
>> session  include        common-session
>> # Enable the following line to get resmgr support for
>> # ssh sessions (see /usr/share/doc/packages/resmgr/README.SuSE)
>> #session  optional      pam_resmgr.so fake_ttyname
>
> which is dated Nov. 10 2006
>
> I haven't been near that box since October.
>
> Is this likely to be caused by the regular automated online updates  
> or has someone been sneaking around in here?

Check the update records and see what was updated round then. You  
might also check your logs to see if any of the numerous ssh attempts  
succeeded (apart from the legitimate one, of course).

You can tighten up the box by restricting access by ssh key only,  
restricting access to certain IPs, using port knocking, or running  
ssh on a port other than 22 (yes, that's security through obscurity,  
but it will reduce the number of messages from failed attempts you  
have to look at in the logs).


Niall