23 May
2017
23 May
'17
1:23 a.m.
Hi
I was "playing" with my AMPR Router yesterday
I had a open user (on purpose) and saw that from that user few IP (not my ones) were
logged in
after some more research i have discovered that this users was opening connections to
other hosts ....
That made me suspicious on what going on ....
I have checked one of the IP that was connected and back resolve showed
customer.worldstream.nl comming via SSH
I understand something not good happening i have closed this user rebooted the router (to
clear the connection )
and then i started to get alot of connections to port 22 to my router from that host
I had to put Firewall rule (drop) for that address and destination port (22)(although im
against fire-walling)
After less then 24 hours the traffic stopped from that host the trafic (Via UCSD
(Encapped) went down from 19 KBytes/sec to less then 1 Kbyte/sec
now. I know how to deal with the technical aspects (firewall .etc)
What is not understand to me is what is the purpose ... If it is a robot what is the point
of fluddling SSH connections is it brute force ? or anything else ? and how come that
after 24 hours it stopped it supposed to be endless loop if it is an automated process
Please light my eyes on that if you have more experience then me
currently the router is "quiet" without non wanted users logged in and un
necessary connections
I see on the log here and there breake attempt mainly to Ports 23 22 and SIP from various
hosts but it is few in a minute
Regards
Ronen - 4Z4ZQ
http://www.ronen.org
Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/>
www.ronen.org
ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com
23 May
23 May
2:40 a.m.
Hey Ronen,
Unfortunately that is "normal" behaviour these days on the internet. Bots
scanning networks for ssh/telnet/sip to abuse and continue spreading.
It stops after a while from that particular IP when that IP gets blocked, but will then
continue from other IP's. That is how botnets workaround firewalls if one IP gets
blocked, they just retry from other hosts under their control..
It is best practice to firewall anything inbound that you don't need publicly
available from the internet..
Ruben - ON3RVH
> On 23 May 2017, at 07:24, R P <ronenp(a)hotmail.com> wrote:
>
> (Please trim inclusions from previous messages)
> _______________________________________________
> Hi
>
> I was "playing" with my AMPR Router yesterday
>
> I had a open user (on purpose) and saw that from that user few IP (not my ones)
were logged in
>
> after some more research i have discovered that this users was opening connections
to other hosts ....
>
> That made me suspicious on what going on ....
>
> I have checked one of the IP that was connected and back resolve showed
customer.worldstream.nl comming via SSH
>
> I understand something not good happening i have closed this user rebooted the router
(to clear the connection )
>
> and then i started to get alot of connections to port 22 to my router from that host
>
> I had to put Firewall rule (drop) for that address and destination port (22)(although
im against fire-walling)
>
> After less then 24 hours the traffic stopped from that host the trafic (Via UCSD
(Encapped) went down from 19 KBytes/sec to less then 1 Kbyte/sec
>
> now. I know how to deal with the technical aspects (firewall .etc)
>
> What is not understand to me is what is the purpose ... If it is a robot what is the
point of fluddling SSH connections is it brute force ? or anything else ? and how come
that after 24 hours it stopped it supposed to be endless loop if it is an automated
process
>
> Please light my eyes on that if you have more experience then me
>
>
> currently the router is "quiet" without non wanted users logged in and un
necessary connections
>
> I see on the log here and there breake attempt mainly to Ports 23 22 and SIP from
various hosts but it is few in a minute
>
> Regards
>
> Ronen - 4Z4ZQ
>
> http://www.ronen.org
>
> Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/>
> www.ronen.org
> ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com
>
>
>
>
>
6:51 a.m.
Several of the servers at work regularly see ping requests in the
hundred per second, and amprgw sees them as well. I have ping responses
throttled to 5 per second on most of my hosts in order to be a good
network neighbor. I log a lot of 'open port RST response' probes as well.
I assume these are partly just curious scanners looking for live hosts
in our network ranges, but a lot of them are probably requests with
forged/spoofed source addresses so as to attack other systems.
The thousands of failed attempts per day to log in as 'root' are also
annoying and pollute my log files. Many of these servers are used
legitimately by researchers all around the world, so it's not practical
to firewall them off from the outside world. I do have root logins
disabled, so even if the probers guess the right password, they can't
log in as root. And I use 'denyhosts' and 'fail2ban' to block the
probers, but there's always another one waiting to start.
During one hour yesterday that I looked at, according to the netflow data
for amprgw, as much as half of the inbound packets were DNS queries to
either of two hosts on the 44.44.7.224 subnet. There are up to hundreds of
these requests per second from many varied source addresses. Those two
hosts used to respond to the queries; they don't any more.
It's a hostile world out there.
- Brian
On Tue, May 23, 2017 at 06:40:54AM +0000, Ruben ON3RVH wrote:
Hey Ronen,
Unfortunately that is "normal" behaviour these days on the internet. Bots
scanning networks for ssh/telnet/sip to abuse and continue spreading.
It stops after a while from that particular IP when that IP gets blocked, but will then
continue from other IP's. That is how botnets workaround firewalls if one IP gets
blocked, they just retry from other hosts under their control..
It is best practice to firewall anything inbound that you don't need publicly
available from the internet..
Ruben - ON3RVH
6:57 a.m.
Brian,
For failed SSH login attempts, you might look at fail2ban , configure that one with 2 auth
faillures and repeat offenders and you'll be golden and rid of those thousands of
login attempts :)
73,
Ruben - ON3RVH
-----Original Message-----
From: 44Net [mailto:44net-bounces+on3rvh=on3rvh.be@hamradio.ucsd.edu] On Behalf Of Brian
Kantor
Sent: dinsdag 23 mei 2017 12:51
To: AMPRNet working group <44net(a)hamradio.ucsd.edu>
Subject: Re: [44net] probbing and attacks on my router
(Please trim inclusions from previous messages)
_______________________________________________
Several of the servers at work regularly see ping requests in the hundred per second, and
amprgw sees them as well. I have ping responses throttled to 5 per second on most of my
hosts in order to be a good network neighbor. I log a lot of 'open port RST
response' probes as well.
I assume these are partly just curious scanners looking for live hosts in our network
ranges, but a lot of them are probably requests with forged/spoofed source addresses so as
to attack other systems.
The thousands of failed attempts per day to log in as 'root' are also annoying and
pollute my log files. Many of these servers are used legitimately by researchers all
around the world, so it's not practical to firewall them off from the outside world.
I do have root logins disabled, so even if the probers guess the right password, they
can't log in as root. And I use 'denyhosts' and 'fail2ban' to block
the probers, but there's always another one waiting to start.
During one hour yesterday that I looked at, according to the netflow data for amprgw, as
much as half of the inbound packets were DNS queries to either of two hosts on the
44.44.7.224 subnet. There are up to hundreds of these requests per second from many
varied source addresses. Those two hosts used to respond to the queries; they don't
any more.
It's a hostile world out there.
- Brian
On Tue, May 23, 2017 at 06:40:54AM +0000, Ruben ON3RVH wrote:
Hey Ronen,
Unfortunately that is "normal" behaviour these days on the internet. Bots
scanning networks for ssh/telnet/sip to abuse and continue spreading.
It stops after a while from that particular IP when that IP gets blocked, but will then
continue from other IP's. That is how botnets workaround firewalls if one IP gets
blocked, they just retry from other hosts under their control..
It is best practice to firewall anything inbound that you don't need publicly
available from the internet..
Ruben - ON3RVH
_________________________________________
44Net mailing list
44Net(a)hamradio.ucsd.edu
http://hamradio.ucsd.edu/mailman/listinfo/44net
7:04 a.m.
Well, I use 'denyhosts' which works the same way as 'fail2ban'
and I have it set to allow 5 tries (at 2 tries max, I had too
many of my legitimate clients who flubbed their logins get
banned and had to contact me). I still get thousands of
login attempts per day because there are so many different
sources of the probes. Block one and two more spring up to
twist the doorknobs. Apparently we're a prime target.
- Brian
On Tue, May 23, 2017 at 10:57:47AM +0000, Ruben ON3RVH wrote:
For failed SSH login attempts, you might look at
fail2ban , configure that one with 2 auth faillures and repeat offenders and you'll be
golden and rid of those thousands of login attempts :)
7:06 a.m.
Everyone running a public ssh/ftp/whatever service is a prime target these days :/
73,
Ruben - ON3RVH
-----Original Message-----
From: 44Net [mailto:44net-bounces+on3rvh=on3rvh.be@hamradio.ucsd.edu] On Behalf Of Brian
Kantor
Sent: dinsdag 23 mei 2017 13:05
To: AMPRNet working group <44net(a)hamradio.ucsd.edu>
Subject: Re: [44net] probbing and attacks on my router
(Please trim inclusions from previous messages)
_______________________________________________
Well, I use 'denyhosts' which works the same way as 'fail2ban'
and I have it set to allow 5 tries (at 2 tries max, I had too many of my legitimate
clients who flubbed their logins get banned and had to contact me). I still get thousands
of login attempts per day because there are so many different sources of the probes.
Block one and two more spring up to twist the doorknobs. Apparently we're a prime
target.
- Brian
On Tue, May 23, 2017 at 10:57:47AM +0000, Ruben ON3RVH wrote:
For failed SSH login attempts, you might look at
fail2ban , configure
that one with 2 auth faillures and repeat offenders and you'll be
golden and rid of those thousands of login attempts :)
_________________________________________
44Net mailing list
44Net(a)hamradio.ucsd.edu
http://hamradio.ucsd.edu/mailman/listinfo/44net
7:11 a.m.
Yes, that's true. The one I'm thinking of in particular is
also a web server serving several dozen domains, so it's a
rather visible target.
- Brian
On Tue, May 23, 2017 at 11:06:32AM +0000, Ruben ON3RVH wrote:
Everyone running a public ssh/ftp/whatever service is
a prime target these days :/
73,
Ruben - ON3RVH
7:32 a.m.
New subject: probbing and attacks on my router
The bigger the wall is built, the taller the ladders get :-(
On 2017-05-23 08:04 AM, Brian Kantor wrote:
(Please trim inclusions from previous messages)
_______________________________________________
Well, I use 'denyhosts' which works the same way as 'fail2ban'
and I have it set to allow 5 tries (at 2 tries max, I had too
many of my legitimate clients who flubbed their logins get
banned and had to contact me). I still get thousands of
login attempts per day because there are so many different
sources of the probes. Block one and two more spring up to
twist the doorknobs. Apparently we're a prime target.
- Brian
On Tue, May 23, 2017 at 10:57:47AM +0000, Ruben ON3RVH wrote:
For failed SSH login attempts, you might look at
fail2ban , configure that one with 2 auth faillures and repeat offenders and you'll be
golden and rid of those thousands of login attempts :)
_________________________________________
44Net mailing list
44Net(a)hamradio.ucsd.edu
http://hamradio.ucsd.edu/mailman/listinfo/44net 
7:08 a.m.
New subject: probbing and attacks on my router
After I researched some of the options in the past (all of which
required installation of more software), I decided on an iptables
entries that 'flag' and DROP the IP for 5 minutes after 5 connection
attempts.
iptables -I FORWARD -p tcp --dport 22 -i eth0.2 -m
state --state NEW
-m recent --name ssh --update --seconds 300 --hitcount 5 -j DROP
iptables -I FORWARD -p tcp --dport 22 -i eth0.2 -m state --state NEW
-m recent --name ssh --set
This also covers scanning of the port if it takes more than 5 tries to
determine it's SSH. Configuring SSH or your port forward to connect to
the SSH on a non standard port reduced my scan attempts to 0%. Be
careful that you type your password correctly from now on...you only get
5 attempts...lol.
- Lynwood
KB3VWG
7:16 a.m.
New subject: probbing and attacks on my router
Alternate SSH ports are a good plan. Internally we use pubkey ssh mostly,
so flubbed passwords are much less common, but we have so many legitimate
'guest' users that password-enabled logins are still needed.
FreeBSD doesn't have 'iptables', that's mostly a Linux thing. It has
'ipfw', which I'm getting pretty good at. :-)
- Brian
On Tue, May 23, 2017 at 07:08:08AM -0400, lleachii--- via 44Net wrote:
After I researched some of the options in the past
(all of which required
installation of more software), I decided on an iptables entries that 'flag'
and DROP the IP for 5 minutes after 5 connection attempts.
This also covers scanning of the port if it takes more than 5 tries to
determine it's SSH. Configuring SSH or your port forward to connect to the
SSH on a non standard port reduced my scan attempts to 0%. Be careful that
you type your password correctly from now on...you only get 5
attempts...lol.
- Lynwood
KB3VWG
8:14 a.m.
New subject: probbing and attacks on my router
Hello Lynwood et al.
Amongst many other iptables rules I use the following:
-A INPUT -m recent --rcheck --seconds 86400 --name portscan --mask
255.255.255.255 --rsource -j DROP
-A INPUT -m recent --remove --name portscan --mask 255.255.255.255 --rsource
-A INPUT -p tcp -m tcp --dport 139 -m recent --set --name portscan --mask
255.255.255.255 --rsource -j LOG --log-prefix "[PORT SCAN BLOCK]:"
-A INPUT -p tcp -m tcp --dport 139 -m recent --set --name portscan --mask
255.255.255.255 --rsource -j DROP
...
-A FORWARD -m recent --rcheck --seconds 86400 --name portscan --mask
255.255.255.255 --rsource -j DROP
-A FORWARD -m recent --remove --name portscan --mask
255.255.255.255 --rsource
-A FORWARD -p tcp -m tcp --dport 139 -m recent --set --name portscan --mask
255.255.255.255 --rsource -j LOG --log-prefix "[PORT SCAN BLOCK]:"
-A FORWARD -p tcp -m tcp --dport 139 -m recent --set --name portscan --mask
255.255.255.255 --rsource -j DROP
Above rules together with fail2ban effectively block/unblock
portscan attempts for predefined period of time, here 86400 seconds.
Best regards.
Tom - SP2L
10:25 a.m.
New subject: probbing and attacks on my router
I'm just curious why you are against firewalling your hosts. If you don't
want someone connecting to your device over SSH, just setup a rule that
blocks it at the router level and be done with it. On my router, I only
allow SSH from a couple known hosts (my work subnets as an example). When
I opened up my firewall to allow SSH to itself, I got over 66,000 ssh login
attempts within a few hours.
Thanks
Craig
On Tue, May 23, 2017 at 8:14 AM, SP2L <SP2L(a)wp.pl> wrote:
(Please trim inclusions from previous messages)
_______________________________________________
Hello Lynwood et al.
Amongst many other iptables rules I use the following:
-A INPUT -m recent --rcheck --seconds 86400 --name portscan --mask
255.255.255.255 --rsource -j DROP
-A INPUT -m recent --remove --name portscan --mask 255.255.255.255
--rsource
-A INPUT -p tcp -m tcp --dport 139 -m recent --set --name portscan --mask
255.255.255.255 --rsource -j LOG --log-prefix "[PORT SCAN BLOCK]:"
-A INPUT -p tcp -m tcp --dport 139 -m recent --set --name portscan --mask
255.255.255.255 --rsource -j DROP
...
-A FORWARD -m recent --rcheck --seconds 86400 --name portscan --mask
255.255.255.255 --rsource -j DROP
-A FORWARD -m recent --remove --name portscan --mask
255.255.255.255 --rsource
-A FORWARD -p tcp -m tcp --dport 139 -m recent --set --name portscan --mask
255.255.255.255 --rsource -j LOG --log-prefix "[PORT SCAN BLOCK]:"
-A FORWARD -p tcp -m tcp --dport 139 -m recent --set --name portscan --mask
255.255.255.255 --rsource -j DROP
Above rules together with fail2ban effectively block/unblock
portscan attempts for predefined period of time, here 86400 seconds.
Best regards.
Tom - SP2L
_________________________________________
44Net mailing list
44Net(a)hamradio.ucsd.edu
http://hamradio.ucsd.edu/mailman/listinfo/44net
8:54 a.m.
You say "used legitimately"
Is opening 10th of connection to say to Port 22 in a second sound legitimate ? for me
no ... am i right ?
Maybe in a big university lot of students do SSH but in AmprNet certianly no .. its
ok to run probers lets say 1 connection a second ......
When I wanted to run Network monitor that do 5 pings every few minutes you all shouted
on me not to do it (and my intention was to provide real time network map accessible by
web to all the AMPRNET users to see which gateway is up and which no ... So how come that
10th of connection try in a second from same host to same destination consider
"legitimate" ?
and this lead me to the second issue question
I want to put a dynamic black list in my router to block this incidents (of lets say more
10 connection from same host to same target in a second) for lets say an hour
I have mikrotik
Are there any experts that can tell me if that cen be done with Mikrotik or i need Celever
firewall before it ?
Regared
Ronen - 4Z4ZQ
________________________________
From: 44Net <44net-bounces+ronenp=hotmail.com(a)hamradio.ucsd.edu> on behalf of Brian
Kantor <Brian(a)UCSD.Edu>
Sent: Tuesday, May 23, 2017 3:51 AM
To: AMPRNet working group
Subject: Re: [44net] probbing and attacks on my router
(Please trim inclusions from previous messages)
_______________________________________________
Many of these servers are used
legitimately by researchers all around the world, so it's not practical
to firewall them off from the outside world.
4:31 a.m.
New subject: probbing and attacks on my router
Ronen,
I agree with Ruben.
Regarding that connection, if it was inbound, they may have successfully
logged into a device. Its Command Server may simply be maintaining the
connection, testing SSH tunneling, seeing if it does X11, Secure Copy, etc.
*If it's a hosted VPS service and SSH Keys are allowed for login, make
sure YOU MADE FRESH KEYS for your VPS' SSH Server. If this is a state
actor (or even another customer in the same company), they may have your
private SSH key.*
*And in fact, if you determine you've been logged into, you may wish to
start with a fresh install/VM.
*
**
73,
- Lynwood
KB3VWG
What is not understand to me is what is the purpose
... If it is a
robot what is the point of fluddling SSH connections is it brute force
? or anything else ? and how come that after 24 hours it stopped it
supposed to be endless loop if it is an automated process
2740
days inactive
2740
days old
13 comments
7 participants
participants (7)
-
Brian Kantor -
Craig Brauckmiller -
lleachii＠aol.com -
R P -
Ruben ON3RVH -
SP2L -
ve1jot