An Inadvertent Denial of Service Attack

If you're wondering why this blog was down for the past few hours, here is the story. In an earlier blog post I listed a small script I'm using to lock-away door knockers who attempt to break into our group's computer by trying various passwords. If you like puzzles, read the script again and think how it could be used against us by isolating our computer from the entire world.

Here is what happened. A local user had trouble with his password, and was trying to login from within the computer into the same computer. These attempts got logged as breakin attempts, and my script duly installed an ipfw filter to cut-off the offending computer. Trouble was that the offending computer was ours.

Here is a revised script that fixes the problem.

#
# Scan sshd logs and add deny rules to the firewall
#
# Written by Diomidis Spinellis
# based on http://www.freebsdwiki.net/index.php/Block_repeated_illegal_or_failed_SSH_logins
#
#

# Set this to your hostname, or local users can launc a DoS attack
HOSTNAME=istlab.dmst.aueb.gr

if ipfw show | awk '{print $1}' | grep -q 20000 ; then
        ipfw delete 20000
fi

# This catches repeated attempts for both legal and illegal users
# No check for duplicate entries is performed, since the rule
# has been deleted.
awk '/sshd/ && (/Invalid user/ || /authentication error/) &&
    $(NF) != "'$HOSTNAME'" {try[$(NF)]++}
END {for (h in try) if (try[h] > 5) print h}' /var/log/auth.log |
while read ip
do
        ipfw -q add 20000 deny tcp from $ip to any  2>/dev/null
done

Acknowledgement: Many thanks to my colleague Markos Gogoulos who described to me the computer's problem in a clear way ("the computer is responding to pings but ssh and http appear to be filtered") that instantly led me to recognize the problem's cause. Had I found the problem myself or through a less precise description I would still be wondering why the computer was turining off most network connections every few minutes.

Comments   Toot! Tweet Share