Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world).  I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.

I thought that the MAC address might be a good place to start looking,
but all of the packets I see are coming from the MAC address of my cable
modem.

 I'm not concerned about him getting in because he's attempting
root logins and I disabled root logins through ssh, but I want to drop
his nonsense traffic if I can, and also avoid any other attacks that
might be coming from him which may have escaped my notice.

Any ideas how I can dig deeper to find a common thread that I can use to
filter his traffic?

Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world). I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.

I thought that the MAC address might be a good place to start looking,
but all of the packets I see are coming from the MAC address of my cable
modem.

I'm not concerned about him getting in because he's attempting
root logins and I disabled root logins through ssh, but I want to drop
his nonsense traffic if I can, and also avoid any other attacks that
might be coming from him which may have escaped my notice.

Any ideas how I can dig deeper to find a common thread that I can use to
filter his traffic?

Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world). I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.

I thought that the MAC address might be a good place to start looking,
but all of the packets I see are coming from the MAC address of my cable
modem. I'm not concerned about him getting in because he's attempting
root logins and I disabled root logins through ssh, but I want to drop
his nonsense traffic if I can, and also avoid any other attacks that
might be coming from him which may have escaped my notice.

Any ideas how I can dig deeper to find a common thread that I can use to
filter his traffic?

On Sep 30, 5:41 pm, Marty <n... at (no spam) comcast.martyamodeo> wrote:

Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world).  I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.

[...]

Any ideas how I can dig deeper to find a common thread that I can use to
filter his traffic?

Filter all SSH from unknown IPs. Have a web page that allows you to
authorize an IP for SSH login.

Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world). I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.

I thought that the MAC address might be a good place to start looking,
but all of the packets I see are coming from the MAC address of my cable
modem. I'm not concerned about him getting in because he's attempting
root logins and I disabled root logins through ssh, but I want to drop
his nonsense traffic if I can, and also avoid any other attacks that
might be coming from him which may have escaped my notice.

Any ideas how I can dig deeper to find a common thread that I can use to
filter his traffic?

On Wed, 30 Sep 2009 17:41:28 -0700, Marty <net at (no spam) comcast.martyamodeo> wrote:

Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world). I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.

Do you need to?

I thought that the MAC address might be a good place to start looking,
but all of the packets I see are coming from the MAC address of my cable
modem.

There's no MAC addr for Internet packets, you may be able to correlate
TTL, but I don't see the point. I get SSH attempts quite frequently
from all over, but there's nothing listening on port 22 here.

I'm not concerned about him getting in because he's attempting
root logins and I disabled root logins through ssh, but I want to drop
his nonsense traffic if I can, and also avoid any other attacks that
might be coming from him which may have escaped my notice.

Do you need to allow _any_ SSH logins? If so why not bump them to
another port? That way you can leave 22 closed.

Any ideas how I can dig deeper to find a common thread that I can use to
filter his traffic?

I don't see the point in assuming it's just one clown out there

On Sep 30, 5:41 pm, Marty <n... at (no spam) comcast.martyamodeo> wrote:

Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world). I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.

Since he can't even establish a TCP connection (because he can't get
the replies), there's probably not much benefit to filtering them out.

I thought that the MAC address might be a good place to start looking,
but all of the packets I see are coming from the MAC address of my cable
modem.

Of course. MAC is an Ethernet thing, and those Ethernet packets
originate at your cable modem. Your modem is routing, not bridging.

I'm not concerned about him getting in because he's attempting
root logins and I disabled root logins through ssh, but I want to drop
his nonsense traffic if I can, and also avoid any other attacks that
might be coming from him which may have escaped my notice.

How can he attempt root logins? If he spoofs the source IP address, he
can't get the reply packet.

Any ideas how I can dig deeper to find a common thread that I can use to
filter his traffic?

Filter all SSH from unknown IPs. Have a web page that allows you to
authorize an IP for SSH login.

I doubt it's one person (or if it is, he's using a botnet or multiple
machines). Since the TCP connections are establishing (I think you at
least implied that), then he must be receiving the packets.

Marty wrote:
Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world). I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.

Welcome to the Internet. Lots of people are trying to get into
everybody else's ssh server.

Spoofing source addresses for TCP is mostly useless for anything other
than a DOS attack. The addresses you see are probably all real.

As for vocabulary, unless he's in your house, he's probably not on your
subnet.

I thought that the MAC address might be a good place to start looking,
but all of the packets I see are coming from the MAC address of my cable
modem. I'm not concerned about him getting in because he's attempting
root logins and I disabled root logins through ssh, but I want to drop
his nonsense traffic if I can, and also avoid any other attacks that
might be coming from him which may have escaped my notice.

The MAC address is always the last hop. That's how routing works.

I suggest using only public key authentication. Disable password
authentication. Some of the ssh attacks are distributed. It's harder
to guess an asymmetric key than any password you can dream up, no matter
how cool you think it is.

You can keep track of the IP addresses and block them. Or use a utility
to do it for you. I haven't needed to resort to things like fail2ban,
etc., but some people like them. I'll let them suggest their favorites.

Any ideas how I can dig deeper to find a common thread that I can use to
filter his traffic?

There is no common thread. It's not one person. It's every kid with a
script, plus every criminal organization, plus maybe every cyberspy in
China. They're evil, they're your neighbors, and you can't move away.
Different people figure out different ways to deal with it. Now you get
to pick yours.

Marty <net at (no spam) comcast.martyamodeo> writes:

Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world). I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.

Why are you guessing he's on your subnet?

I thought that the MAC address might be a good place to start looking,
but all of the packets I see are coming from the MAC address of my cable
modem. I'm not concerned about him getting in because he's attempting
root logins and I disabled root logins through ssh, but I want to drop
his nonsense traffic if I can, and also avoid any other attacks that
might be coming from him which may have escaped my notice.

Since they seem to be coming from your cable modem, why do you think
they're coming from somewhere other than the other side of your cable
modem?

Any ideas how I can dig deeper to find a common thread that I can use to
filter his traffic?

Allen Kistler wrote:
....
As for vocabulary, unless he's in your house, he's probably not on your
subnet.

I was thinking "subnet" in terms of the address that my cable modem
acquired.

I suggest using only public key authentication. Disable password
authentication. Some of the ssh attacks are distributed. It's harder
to guess an asymmetric key than any password you can dream up, no matter
how cool you think it is.

Really hard to enter your key through a corporate machine on someone
else's network, right? Or is there an easy way? I won't always have
access to the hardware to insert a USB stick or something.
....
Any sandbox I can bury my head in??

Joe Pfeiffer wrote:
Marty <net at (no spam) comcast.martyamodeo> writes:

Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world). I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.
Why are you guessing he's on your subnet?

The lease on my IP address changed recently. Before this happened, I
didn't notice this flavor of attacks. Purely a guess, and probably a
bad one, based on little or no evidence.

Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world). I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.

I thought that the MAC address might be a good place to start looking,
but all of the packets I see are coming from the MAC address of my cable
modem. I'm not concerned about him getting in because he's attempting
root logins and I disabled root logins through ssh, but I want to drop
his nonsense traffic if I can, and also avoid any other attacks that
might be coming from him which may have escaped my notice.

Any ideas how I can dig deeper to find a common thread that I can use to
filter his traffic?

--
Reverse the parts of the e-mail address to reply by mail.

Marty <net at (no spam) comcast.martyamodeo> writes:

Some clown (on my subnet, I would guess) thinks he's exceedingly clever
and is sending repeated SSH login attempts to my machine using spoofed
IP addresses (making the consolidated attack appear to be coming from
all over the world). I'm scrutinizing his packets, but I'm not sure how
to find the "fingerprints" I need to filter them out.

I thought that the MAC address might be a good place to start looking,
but all of the packets I see are coming from the MAC address of my cable
modem. I'm not concerned about him getting in because he's attempting
root logins and I disabled root logins through ssh, but I want to drop
his nonsense traffic if I can, and also avoid any other attacks that
might be coming from him which may have escaped my notice.

Any ideas how I can dig deeper to find a common thread that I can use to
filter his traffic?

It is not a "he" it is many many "hes". ssh attacks have become a fact
of life. They AR launched from many machines around the world ( remember
that something like 1% of all windows boxes are broken and owned by
spammers, etc. -- that is a lot of IP addresses. )
You can put ssh on a different port -- almost all attacks are on the
standard port. You could disable ssh entirely.

And you cannot "drop his traffic". His traffic has to be read by your
filtering software to drop it.

You can also put in a script to read the logs and if there is more than
say 5 unsucessful login attempts, put the address into /etc/hosts.allow
with a deny tag.

(but remember to keep the lines shorter than about 1000
bytes-- there is a bug in the hosts.allow software which crashes the
system if a line is longer, and Venema refuses to fix it).

Some clown (on my subnet, I would guess) thinks he's exceedingly
clever and is sending repeated SSH login attempts to my machine using
spoofed IP addresses (making the consolidated attack appear to be
coming from all over the world).