Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does anyone maintain lists of the most frequently guessed account names that are used by attackers brute-forcing ssh?

For your amusement, from my main server's logs over the last month (43 313 failed ssh attempts), with root not getting as far as sshd:

cas@txtproof:~$ grep -e sshd /var/log/auth* | awk ' { print $8 }' | sort | uniq -c | sort | tail -n 13
     32 administrator
     32 stephen
     34 administration
     34 sales
     34 user
     35 matt
     35 postgres
     38 mysql
     42 oracle
     44 guest
     86 test
     90 admin
share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

I suppose you could look through a database of exploit scripts from security sites and compile a list, or you could probably derive them from your own logs of data and use another script to periodically check for outliers to see when they change, but you might reduce your attack surface just a little bit if you put Denyhosts on the system to block IP's automatically after a set of bad credentials (and auto-blocking what other denyhost sites have blocked periodically) and/or put sshd on another port and have your authorized users shift to that port (non-standard ports will make your automated attacks drop to practically nothing).

Don't know if you're looking for these names for a set purpose or if you're interested in reducing your script attack attempts...But it sounds like you're already getting a decent size sample from which to get usernames from scripted attacks.

share|improve this answer
    
I've had an increase in brute force attacks, and while, for now, I'm happy enough with an increased retry delay, I'm thinking about other strategies. I don't want to block IPs that ssh to the wrong username, because of typos, but blocking IPs that ssh to blacklisted usernames, well... –  Charles Stewart Apr 6 '10 at 10:20
    
denyhosts can be configured for blocking the IP for specific periods as well as a certain number of tries. For example, if the person tries logging in from the same ip incorrectly five times, they're blocked for 1/2 an hour. Or a day. Or forever. Whatever you want. Denyhosts also can collect from other denyhosts users who have blocked attempts from bad IP's. If you have known-good IP's people ssh in from, you can whitelist them to permanently be allowed. I'd recommend you try it out and see what you think. –  Bart Silverstrim Apr 6 '10 at 12:39
add comment

These are Top 10 from lastb at my box, couple of monts ago:

[contact] => 25
[support] => 28
[info] => 35
[user] => 36
[mysql] => 43
[postgres] => 45
[guest] => 62
[test] => 104
[admin] => 106
[root] => 581
share|improve this answer
    
I did not know about lastb. Very interesting command. +1 –  Puddingfox Jun 2 '11 at 15:13
add comment

I would start with a web search: http://google.com/?q=common+usernames+used+in+ssh+attacks

Of particular note, this document seems to have a list that at least seems possible: http://people.clarkson.edu/~jmatthew/publications/leet08.pdf

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.