Re: Block SSH brute force

[Aaron Bartell <aaronbartell@xxxxxxxxx>]

> Most of the attacks we get like this are from the benevolent hackers
working as a subsidiary of IBM.  Testing common passwords, etc.  You don't
contract to such a service, do you?

What's funny is I can't tell whether you are being facetious :-)  No, I
don't contract with IBM to pentest my systems.  Does such a service
actually exist?

Aaron Bartell
litmis.com - Services for open source on IBM i


On Thu, Feb 11, 2016 at 9:40 AM, <rob@xxxxxxxxx> wrote:

> Most of the attacks we get like this are from the benevolent hackers
> working as a subsidiary of IBM.  Testing common passwords, etc.  You don't
> contract to such a service, do you?
>
> IDK of any way to autoblacklist based on log in profile.
>
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>           6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
>
>
>
>
> From:   Aaron Bartell <aaronbartell@xxxxxxxxx>
> To:     Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
> Date:   02/11/2016 10:28 AM
> Subject:        Block SSH brute force
> Sent by:        "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
>
>
>
> I have a machine that consistently has high CPU for SSH jobs(n3) so I set
> up logging(n1) to find the culprit.  Turns out China is working overtime
> to
> get into this machine.  SSH is configured to require keys and disallow
> passwords (and other sshd_config settings) so I am not too concerned about
> a breach(n2), but the CPU consumption is annoying.
>
> I have a vCloud network appliance sitting in front of the IBM i and
> configured a DENY rule for the specific China IP address, but at the end
> of
> the day I still need to allow SSH from a variety of IP addresses.
>
> Are there ways, on IBM i, to automatically blacklist IP addresses that
> attempt to log in with "root"?
>
> What do others employ to stop this in a more automatic fashion?
>
>
> n1 - http://bit.ly/N1014301
> n2 - with the exception of the most recent vulnerabilities
>
> n3...
>                             Work with Active Jobs
>                                                             02/11/16
> CPU %:    16.6     Elapsed time:   00:00:00     Active jobs:   205
>                     Current
> Opt  Subsystem/Job  User        Type  CPU %  Function        Status
>        QP0ZSPWP     QSECOFR     BCI    13.8  PGM-sshd         RUN
>
>
> Aaron Bartell
> litmis.com - Services for open source on IBM i
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.