Action after a failed hack attempt

[Steven E. Protter]

Good thoughts Sir,

Sometimes that nasty lastb -R command returns truncated hostnames, which is why I had to resort to getting the information from syslog.

That part works right.

It would seem that the methodology is not as inefficient as I thought.

The other suggestions can be partially done. My user account with sudo should be sufficient for most common tasks, so long as I can unlock the root password for real systems administration.

About time I really learned sudo anyway. I could get my operators at work off the root account.

9 points. Still open to suggestions concerning daemonizing the script. Thats purely for the revenge factor. I like seeing the logs of hackers going bye bye.

SEP

[Biswajit Tripathy]

Let me answer (2) and (3).

Run the following command to make sure that IPFilter is actually working right.

$ ipfstat -ioh

This output will print out the rule that you configured with a number at the beginning. This number signifies how many times the rule is hit. For example, if you see the the output of the above command (after your rule is configured) as follows:

$ ipfstat -ioh
2 block in log quick from 210.159.198.1 to any

then it means that there are 2 log attempts from the IP address and they were blocked. If you don't have any log attempt, then the number at the left end would be zero, ofcourse. Also, as you are loging the connection attempt, you should see an entry in IPFilter log file (default being syslog).

To block entire range of addresses from
210.159.198.1 - 255, configure:
block in quick from 210.159.198.0/24 to any.

Note: Use "log" keyword carefully and too much loging could be very expensive. Also, if your system
does not expect any outside connections to come
in (i.e you don't provide a service to anyone), you
might consider blocking all incoming connections.

- Biswajit

[Steven E. Protter]

Better late than never.

I've developed a program called monbad. It works as a daemon. Since the hack attempts were all ssh it does the following things:

shuts down sshd while its building a new block entry on the firewall. Adds the new block address to the firewall and then brings sshd back up.

monbad is daemonized as well and I'm thinking of putting up a copy on my hpux website.

Thanks.

thread closed.

SEP