Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Ubuntu Linux server that is web facing. Because of this I get a fair number of brute force SSH attempts (who doesn't). I'd like to display the last N failed login attempts at my login prompt. I've worked out the simple script:

grep "Failed" /var/log/auth.log | tail -5

but what I need to know is where do I put this line of script? Is there somewhere to put it that's shell agnostic?

share|improve this question
add comment

6 Answers 6

There are a couple of packages that you can use to help with brute force attacks.

  1. Denyhosts
  2. Fail2ban

To collect logs and send you a report you can use logwatch. It can send a summary of failed logons as well.

To answer your original question you can put your script in "/etc/profile.d/yourscript.sh" and it should be executed on login.

You might also consider setting up the arno-iptables-firewall package.

share|improve this answer
    
or, just add it to the bottom of your .profile, if you only want to do it for a single user. –  Cian Jul 11 '09 at 21:17
    
+1 for fail2ban –  theotherreceive Jul 11 '09 at 23:03
    
fail2ban is good to use. I've set on my latest vps my firewall to limit the number of ssh connections from a single ip within a time frame. So ufw limit ssh this means if someone tries to brute force ssh they have to slow down the attempt if not the firewall will ban them for a bit. –  Mark Davidson Jul 12 '09 at 14:05
    
+1 and thanks for fail2ban, using that in addition to my script now. –  C. Ross Jan 30 '10 at 17:48
add comment

It's really shell dependent. For bash, you should put it in .bash_login file.

Regarding brute force atack prevention, aside from what's already been sugested for blacklisting the attacker's IP, I usually tell sshd to listen on a nonstandard port and disable the password authentication. Of course, that might not always be possible, but it sure is effective.

share|improve this answer
    
your .profile should be sourced by almost every modern shell. –  Cian Jul 11 '09 at 23:18
    
+1 - the only response that I think answers the question :) –  GNUix Jul 12 '09 at 4:44
add comment

Put everything in /etc/profile.

It will run everything in /etc/profile before going to your shell startup file.

share|improve this answer
2  
I'm not familiar with Ubuntu, so I might be wrong, but wouldn't be better to create a script in the /etc/profile.d directory? –  Cristian Ciupitu Jul 12 '09 at 1:50
    
I use Fedora Linux and in my /etc/profile file, there is a loop that runs everything in the /etc/profile.d directory. You should check if your /etc/profile will process everything in this directory, otherwise you will have to declare directly in the file. –  setatakahashi Jul 12 '09 at 15:01
    
I used this for a while, but after adding non-admin users, it causes errors on their login, so I needed to move it somewhere local to my user. –  C. Ross Jan 30 '10 at 16:18
add comment
up vote 1 down vote accepted

What I finally ended up doing was creating a .profile.d directory in my home directory, and copying the execution loop from /etc/profile to my $HOME/.profile. I then placed my displayAttacks.sh script into my $HOME/.profile.d directory (as well as my other init scripts).

The addition to .profile follows.

if [ -d "${HOME}/.profile.d" ]; then
  for i in ${HOME}/.profile.d/*.sh; do
    if [ -r "$i" ]; then
      . "$i"
    fi
  done
  unset i
fi
share|improve this answer
add comment

There is a perl script, SSHBlock that can be used against brute forcing SSH.
It follows a frequent attempt from an IP address and slows down their attempts.

share|improve this answer
add comment

You have some issues in there. First, any non-root user should not be able to read the auth log file. If you are logging in as root, don't do it anymore :)

Second, use a proper tool for that. I like OSSEC's approach to email me for every X number of failed logins within a period of time. It also blocks the ip automatically, reducing the chance of a brute-force attack succeeding.

share|improve this answer
    
I'm not root, but I am in the admin group, which allows access. –  C. Ross Jan 30 '10 at 16:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.