Reporting SSH break-in attempts

I recently started running a small linux webserver and I've noticed a lot of ips (mostly from China and Korea) connecting to the SSH daemon and bruteforcing passwords.
I have been looking up the ips in ARIN's database and sending reports of the break-in attempts along with the relevant parts of sshd's logfiles to the abuse address listed by ARIN. But it seems that all ISPs just ignore this because the same ip addresses just keeps hammering the server for months.
Am I doing something wrong, or is it just normal policy that ISPs ignore these kinds of reports?

On a side note; I'm not worried about someone actually managing to gain access to the server because I have disabled all password based authentication. But it is kinda annoying that noone seems to care about the people doing this.

If you are worried that someone may hack you on that port, either disable those services or REMAP the ones you need to some really ugly high port #. Running inetd, it is a simple as modifying the /etc/services database. If you are running sshd standalone, the listening port # is in the config file.

If a machine is on the net, it will be continuously probed. Just a fact of life. You could waste a month tracking one person down, and maybe even succeed... 1 down, 10 million to go.

Quote:

---

Originally Posted by _Mike

I have been looking up the ips in ARIN's database and sending reports of the break-in attempts along with the relevant parts of sshd's logfiles to the abuse address listed by ARIN. But it seems that all ISPs just ignore this because the same ip addresses just keeps hammering the server for months.

---

What do you expect them to do? They cannot just take your word for it and start blacklisting ip's because someone claims there is a problem. Should they launch an investigation? That maybe beyond the scope of the individual ISP.

Quote:

---

But it is kinda annoying that noone seems to care about the people doing this.

---

I imagine there is a lot of concern but obviously it is not an easy thing to stop. Since some of this is probably very elaborate, well funded and equipt military operations (they are wrangling bot nets for DoS attacks), just blacklisting ips is unlikely to solve the problem (and could easily create more).

Yarin had a sort of related thread here a while back that was unfortunately lost during one of the database crashes. He actually listed a bunch of ips and we were doing lookups on them. You can blacklist those IP's yourself if you want -- that's what Yarin was doing, I cannot remember the name of the software he was using to do it.

So if you can just blacklist them yourself, your problem is solved. Which individuals taking responsibility for themselves and setting their own policies here is probably the best solution.

Quote:

---

Originally Posted by MK27

You can blacklist those IP's yourself if you want -- that's what Yarin was doing, I cannot remember the name of the software he was using to do it.

---

Pretty sure this is it:
Welcome to DenyHosts

It would be simple to implement this with /etc/hosts.deny, using your sshd log, of course*. Probably easier than installing software.

* that's a long running normative practice, which might be why no one considers this their responsibility (it's yours).

Quote:

---

Originally Posted by MK27

You can blacklist those IP's yourself if you want -- that's what Yarin was doing, I cannot remember the name of the software he was using to do it.

---

There might be other ways, but you can do this in the firewall, if it permits you to add these kind of rules to your config file. ipfw allows this for example.

Quote:

---

Originally Posted by MK27

What do you expect them to do? They cannot just take your word for it and start blacklisting ip's because someone claims there is a problem. Should they launch an investigation? That maybe beyond the scope of the individual ISP.

---

I expected them to check their logs to verify that there's a ton of connections going from one of their ips to my ip address.

Quote:

---

It would be simple to implement this with /etc/hosts.deny, using your sshd log, of course*. Probably easier than installing software.

* that's a long running normative practice, which might be why no one considers this their responsibility (it's yours).

---

I agree that it is my responsibility to keep my server secure. And I'm pretty sure it is, barring OpenSSH having some unknown exploit.
It just that what's the point of listing an abuse address record in the whois database if they don't investigate incoming reports? If there had been none listed I would just have moved on without thought. But listing such as address is like saying "hey, if one of our customers misbehaves we want to know about it"

Or maybe I'm just overreacting :)

Quote:

---

Originally Posted by _Mike

It just that what's the point of listing an abuse address record in the whois database if they don't investigate incoming reports?

---

You might want to check out that DenyHosts thing, I believe they in fact do pool data from the user base. My worry about that would be users who maliciously spoof data into the database, just to get some ip's blocked, or whatever.

Quote:

---

But listing such as address is like saying "hey, if one of our customers misbehaves we want to know about it"

---

That won't make them any money.

Quote:

---

Or maybe I'm just overreacting :)

---

If it's any consolation, the reason I haven't taken an interest in this before is I do work on a couple of servers that have been around for more than a decade and have public profiles. We use ssh there, but no one bothers with this. And they are not an incompetent bunch IMO (one dude works for NASA doing programming, for what that is worth vis security*, etc). At one point I was writing some utilities for the server, and I had to be honest about my lack of experience and that I wanted to explicitly discuss security because it seemed to me there should be people around who would want to do bad things to the site.

What that came down to was no one had ever, to anyone's knowledge, breached the security. However, very important to note here that the ssh on those servers all use keys and not just passwords. But we still don't track break-in attempts (as you are aware, they are futile). I think this would be more of an issue where the added stress matters, but these are not very high traffic.

* maybe not much, I dunno, I just think it's cool dude works for NASA :p He could be a spy.