Finding the attack source

trickypicky75 · Posted: Fri Jul 08, 2005 1:42 pm Post subject: Finding the attack source

All. I'm running a gentoo server, running samba, setup to authenticate via Active Directory (to allow SSO), for the last few weeks I've been seeing "Dictonary" style attempts at logging in in /var/log/samba3/log.winbindd Here's an example:

techjedi · n00b Joined: 07 Jul 2005 Posts: 6 Location: Connecticut

Unless access is actually required, block access into your network from the outside world to the SSH and SMB ports... well anything really. If your network is connected up to the Internet without some kind of a firewall, then there would be the first step you should be taking. If there already is a firewall, make sure all the ports are closed off, or perhaps set up some allow from (list valid IPs) and deny all type rules.. But in all honesty I can't think of any reason that you would need 100% wide open access to SSH and SMB from outside your own network - so cut them off before they get in.

Hope this helps!
_________________
Want an iPod? Get one free at http://www.freeipods.com/?r=20012025

Praxxus · Posted: Fri Jul 08, 2005 6:15 pm Post subject: Re: Finding the attack source

trickypicky75 · Posted: Fri Jul 08, 2005 6:58 pm Post subject:

I'm sorry, I should have given a little more information. It made me sound like a bit of a "dummyhead"

I am using the "hosts allow" and have it restricted to 127. my local subnet and the subnets of my remote office.

Both offices are firewalled by cisco routers w/ reflexive access lists, with only a few specific openings on each.

I am intending to block that specific IP alltogether.

However I can't limit port 22 to only a few IP's. Myself and a few others use ssh to get into our network from remote locations that do not have static IP addressess (often we tunnel termial services thru ssh to manage our Win. Servers)

Basically is what I would like to do is beef up logging so that I can get more information about where these attacks are coming from, I'm not exactly sure how to do that. Or come up with some other way that I can Identify where this is coming from... Even if I could just shut off samba forever I would still feel uneasy knowing that someone has gotten through my perimiter and has the ability to attack one of my other machines. Heck one of my machines could possibly be compromised right now, and I wouldn't be able to figure out which one (especially if it's in our remote office)

I will do a little reading on iptables, unless someone can direct me to some documentation and/or a quick how-to.

Thanks again....

techjedi · n00b Joined: 07 Jul 2005 Posts: 6 Location: Connecticut

I googled iptables guide and came up with the following:
http://www.iptablesrocks.org/

Looked promising... enjoy

PS - i would agree, crank up debugging on samba, get the IP (or list of IPs) and block them entirely.

And as another tricky little monkey, you could always try setting up some port forwarding, random port numbers to the outside world -> ssh and whatnot on the inside. Won't keep everyone out, but will fool most of the riff-raff.
_________________
Want an iPod? Get one free at http://www.freeipods.com/?r=20012025