[solved] Mitigate/prevent local brute force attack

jrussell · 2013-03-20 06:30:29

Hi, recently someone got into my server by logging on as a standard user which was not too serious, but I only noticed this because I got suspicious when I saw that user running httpd. So in the bash_history file for that user, I saw that they downloaded a brute force program and were using cron to schedule this program, I didn't have cronie running so that was fine.

But my question is, how can I prevent someone from just trying su $username a million times locally? I read up in a wiki somewhere how to ban a user for X minutes after Y failed login attempts with Pam, but su is not effected by this, any help?

So far I have that user ban inplace (I think the conf is in /etc/pam/system-login), plus some iptables rules to prevent ssh brute force attacks.

Thanks

Last edited by jrussell (2013-05-12 18:43:07)

progandy · 2013-03-20 06:40:55

su uses the settings from /etc/pam.d/su. You'll have to add the references to your security modules there.
PS: You should at least add the login delay for su, su-l and sudo.

Last edited by progandy (2013-03-20 06:48:10)

jrussell · 2013-03-20 09:29:44

progandy wrote:

su uses the settings from /etc/pam.d/su. You'll have to add the references to your security modules there.
PS: You should at least add the login delay for su, su-l and sudo.

Thanks, I still cant find anything which shows me how to do it, will continue to google

progandy · 2013-03-20 10:10:15

You could add pam_warn (log access), pam_faildelay (longer delay after failure), pam_abl (from AUR, for brute force block)
http://www.ducea.com/2006/06/29/using-p … e-attacks/

jrussell · 2013-05-12 18:42:56

Found a solution, I edited the wiki:
Just created some iptable rules to watch ssh port fro new connections from IPs.
https://wiki.archlinux.org/index.php/Si … ce_attacks

Last edited by jrussell (2013-05-12 18:43:38)

Arch Linux

#1 2013-03-20 06:30:29

[solved] Mitigate/prevent local brute force attack

#2 2013-03-20 06:40:55

Re: [solved] Mitigate/prevent local brute force attack

#3 2013-03-20 09:29:44

Re: [solved] Mitigate/prevent local brute force attack

#4 2013-03-20 10:10:15

Re: [solved] Mitigate/prevent local brute force attack

#5 2013-05-12 18:42:56

Re: [solved] Mitigate/prevent local brute force attack

Board footer