<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head> <title></title> <meta http-equiv="content-type" content="text/html;charset=utf-8"/> <meta http-equiv="Content-Style-Type" content="text/css"/> </head> <body> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt">> From: "Steven J Lamb" <redhattedsheep@adiis.net></span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> >I am trying to create a script to block people using hosts.deny. I realize </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > that I should just block everyone and then open access for those whom I know </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > I trust but because of the nature of our network this is not possible. </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > basically I check log files for login attempts every five minutes and block </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > those that attempt to log in more than 3 times that day. this is all working </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > great but my problem is this. I sometimes get log entries with the symbolic </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > address instead of the ip. how do I convert these in a systematic way and </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > not have a problem when I run IPs through it. I'm sure this is an easy task </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > but I don't now what tool to use.</span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > thanks for your help</span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> > Steven Lamb</span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"><br /> </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt"> </span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt">Sounds like a job for the "recent" subcommand in iptables. There is a very good treatise on this at: </span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt"><br /> </span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt">http://la-samhna.de/library/brutessh.html</span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt"><br /> </span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt">He uses the following script</span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt"><br /> </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt">> iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set \ </span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt">> --name SSH -j ACCEPT</span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt">> iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4</span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt">> --rttl \</span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt">> --name SSH -j LOG --log-prefix "SSH_brute_force "</span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt">> iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 \</span></font></div> <div align="left"><font face="Arial" color="#7f0000" size="2"><span style="font-size:10pt">> --hitcount 4 --rttl --name SSH -j DROP</span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt"> </span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt">to drop those who try to log in four more times to his sshd server. His article explains the scripts.</span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt"><br /> </span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt">I use a similar script. The downside is that I can not enjoy reading some of the strange "usernames" made up by the current sshd brute force worms, since the worm gets cut off after only a few attempts to connect.</span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt"><br /> </span></font></div> <div align="left"><font face="Arial" size="2"><span style="font-size:10pt"><br /> </span></font></div> <div align="left"></div> </body> </html>