5

I have an Ubuntu Linux server that is web facing. Because of this I get a fair number of brute force SSH attempts (who doesn't). I'd like to display the last N failed login attempts at my login prompt. I've worked out the simple script:

grep "Failed" /var/log/auth.log | tail -5

but what I need to know is where do I put this line of script? Is there somewhere to put it that's shell agnostic?

6 Answers 6

7

There are a couple of packages that you can use to help with brute force attacks.

  1. Denyhosts
  2. Fail2ban

To collect logs and send you a report you can use logwatch. It can send a summary of failed logons as well.

To answer your original question you can put your script in "/etc/profile.d/yourscript.sh" and it should be executed on login.

You might also consider setting up the arno-iptables-firewall package.

3
  • or, just add it to the bottom of your .profile, if you only want to do it for a single user.
    – Cian
    Commented Jul 11, 2009 at 21:17
  • fail2ban is good to use. I've set on my latest vps my firewall to limit the number of ssh connections from a single ip within a time frame. So ufw limit ssh this means if someone tries to brute force ssh they have to slow down the attempt if not the firewall will ban them for a bit. Commented Jul 12, 2009 at 14:05
  • +1 and thanks for fail2ban, using that in addition to my script now.
    – C. Ross
    Commented Jan 30, 2010 at 17:48
2

It's really shell dependent. For bash, you should put it in .bash_login file.

Regarding brute force atack prevention, aside from what's already been sugested for blacklisting the attacker's IP, I usually tell sshd to listen on a nonstandard port and disable the password authentication. Of course, that might not always be possible, but it sure is effective.

2
  • your .profile should be sourced by almost every modern shell.
    – Cian
    Commented Jul 11, 2009 at 23:18
  • +1 - the only response that I think answers the question :)
    – GNUix
    Commented Jul 12, 2009 at 4:44
2

Put everything in /etc/profile.

It will run everything in /etc/profile before going to your shell startup file.

3
  • 2
    I'm not familiar with Ubuntu, so I might be wrong, but wouldn't be better to create a script in the /etc/profile.d directory? Commented Jul 12, 2009 at 1:50
  • I use Fedora Linux and in my /etc/profile file, there is a loop that runs everything in the /etc/profile.d directory. You should check if your /etc/profile will process everything in this directory, otherwise you will have to declare directly in the file. Commented Jul 12, 2009 at 15:01
  • I used this for a while, but after adding non-admin users, it causes errors on their login, so I needed to move it somewhere local to my user.
    – C. Ross
    Commented Jan 30, 2010 at 16:18
1

What I finally ended up doing was creating a .profile.d directory in my home directory, and copying the execution loop from /etc/profile to my $HOME/.profile. I then placed my displayAttacks.sh script into my $HOME/.profile.d directory (as well as my other init scripts).

The addition to .profile follows.

if [ -d "${HOME}/.profile.d" ]; then
  for i in ${HOME}/.profile.d/*.sh; do
    if [ -r "$i" ]; then
      . "$i"
    fi
  done
  unset i
fi
0

There is a perl script, SSHBlock that can be used against brute forcing SSH.
It follows a frequent attempt from an IP address and slows down their attempts.

0

You have some issues in there. First, any non-root user should not be able to read the auth log file. If you are logging in as root, don't do it anymore :)

Second, use a proper tool for that. I like OSSEC's approach to email me for every X number of failed logins within a period of time. It also blocks the ip automatically, reducing the chance of a brute-force attack succeeding.

1
  • I'm not root, but I am in the admin group, which allows access.
    – C. Ross
    Commented Jan 30, 2010 at 16:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .