Looking for automation scripts

Looking for automation scripts

[Tim Heagarty]

I've seen a few references here to scripts that monitor attacks and
dynamically update iptables rules to knock down the attacks. Can anyone
provide some good research starting points or sample scripts that they use?
I've found a few things with google but respect the collective out here much
more.


Thank you,

Tim Heagarty, CISSP, CISA, MCSE
http://www.TheaSecure.com/
(928) 533-9690
"There are 10 kinds of people in the world; those that understand binary,
and those that don't."

--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.5.432 / Virus Database: 268.16.5/616 - Release Date: 1/4/2007
1:34 PM

Re: Looking for automation scripts

[Dimitri Yioulos]

On Friday 05 January 2007 2:44 pm, Tim Heagarty wrote:
> I've seen a few references here to scripts that monitor attacks and
> dynamically update iptables rules to knock down the attacks. Can anyone
> provide some good research starting points or sample scripts that they use?
> I've found a few things with google but respect the collective out here
> much more.
>
>
> Thank you,
>
> Tim Heagarty, CISSP, CISA, MCSE
> http://www.TheaSecure.com/
> (928) 533-9690
> "There are 10 kinds of people in the world; those that understand binary,
> and those that don't."
>
> --
> No virus found in this outgoing message.
> Checked by AVG Free Edition.
> Version: 7.5.432 / Virus Database: 268.16.5/616 - Release Date: 1/4/2007
> 1:34 PM

Something like psad (www.cipherdyne.com/psad/)?

Dimitri

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Re: Looking for automation scripts

[Jan Engelhardt]

>On Friday 05 January 2007 2:44 pm, Tim Heagarty wrote:
>> I've seen a few references here to scripts that monitor attacks and
>> dynamically update iptables rules to knock down the attacks. Can anyone
>> provide some good research starting points or sample scripts that they use?
>> I've found a few things with google but respect the collective out here
>> much more.
>
>Something like psad (www.cipherdyne.com/psad/)?

Or
http://lkml.org/lkml/2006/12/31/127
http://lkml.org/lkml/2007/1/1/34
http://lists.netfilter.org/pipermail/netfilter/2005-June/061254.html
http://lists.netfilter.org/pipermail/netfilter/2005-June/061328.html


	-`J'
-- 

RE: Looking for automation scripts

[markee]

-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Tim Heagarty
Sent: Friday, January 05, 2007 11:45 AM
To: netfilter@lists.netfilter.org
Subject: Looking for automation scripts

I've seen a few references here to scripts that monitor attacks and
dynamically update iptables rules to knock down the attacks. Can anyone
provide some good research starting points or sample scripts that they use?
I've found a few things with google but respect the collective out here much
more.


Thank you,

Tim Heagarty, CISSP, CISA, MCSE
http://www.TheaSecure.com/
(928) 533-9690
"There are 10 kinds of people in the world; those that understand binary,
and those that don't."

--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.5.432 / Virus Database: 268.16.5/616 - Release Date: 1/4/2007
1:34 PM


Or . . . Something like dynfw: http://www.gentoo.org/proj/en/dynfw.xml



########################################################
This message has been scanned for viruses and dangerous 
content by MailScanner, and is believed to be clean.

postmaster@bandwidthco.com
MailScanner at Bandwidthco Computer Security is for your absolute protection.
########################################################

Re: Looking for automation scripts

[Andrew]

Have a look at http://www.ossec.net

it has just the features you are after, and can monitor a bunch of log 
types (auth logs to look for failed ssh log-ins, apache logs, mail logs, 
and even talks to snort so it can block upon portscans, etc).


Cheers,
Andrew
markee wrote:

>-----Original Message-----
>From: netfilter-bounces@lists.netfilter.org
>[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Tim Heagarty
>Sent: Friday, January 05, 2007 11:45 AM
>To: netfilter@lists.netfilter.org
>Subject: Looking for automation scripts
>
>I've seen a few references here to scripts that monitor attacks and
>dynamically update iptables rules to knock down the attacks. Can anyone
>provide some good research starting points or sample scripts that they use?
>I've found a few things with google but respect the collective out here much
>more.
>
>
>Thank you,
>
>Tim Heagarty, CISSP, CISA, MCSE
>http://www.TheaSecure.com/
>(928) 533-9690
>"There are 10 kinds of people in the world; those that understand binary,
>and those that don't."
>
>--
>No virus found in this outgoing message.
>Checked by AVG Free Edition.
>Version: 7.5.432 / Virus Database: 268.16.5/616 - Release Date: 1/4/2007
>1:34 PM
>
>
>Or . . . Something like dynfw: http://www.gentoo.org/proj/en/dynfw.xml
>
>
>
>########################################################
>This message has been scanned for viruses and dangerous 
>content by MailScanner, and is believed to be clean.
>
>postmaster@bandwidthco.com
>MailScanner at Bandwidthco Computer Security is for your absolute protection.
>########################################################
>
>
>  
>

RE: Looking for automation scripts

[Jan Engelhardt]

>
>I've seen a few references here to scripts that monitor attacks and
>dynamically update iptables rules to knock down the attacks. Can anyone
>provide some good research starting points or sample scripts that they use?

denyhosts.sf.net?

>I've found a few things with google but respect the collective out here much
>more.

	-`J'
-- 

Re: Looking for automation scripts

[Michael Rash]

On Jan 06, 2007, Jan Engelhardt wrote:

> >
> >I've seen a few references here to scripts that monitor attacks and
> >dynamically update iptables rules to knock down the attacks. Can anyone
> >provide some good research starting points or sample scripts that they use?
> 
> denyhosts.sf.net?

While denyhosts is a good concept, I question whether it provides a real
security benefit.  If a new remotely exploitable vulnerability is
discovered in OpenSSH (or other ssh implementation) it will most likely
have nothing to do with trying to brute force passwords.  Doing a quick
search through http://www.securityfocus.com/bid/ turns up recent SSH
security issues (not necessarily highly critical, but it is only a
matter of time).

A better strategy is to use iptables to maintain a default-drop stance
against all attempts to connect to the SSH daemon, but allow access via
Single Packet Authorization.  This way people can't even tell that you
are running an SSH server at all.  An nmap scan is completely useless
against this, and it doesn't matter even if someone has a zero-day
attack for your SSH daemon.  Here is an SPA implementation:

http://www.cipherdyne.org/fwknop/

(Disclaimer: I developed fwknop)

Here is a howto for using GPG keys with fwknop:

http://www.cipherdyne.org/fwknop/docs/gpghowto.html

--
Michael Rash
http://www.cipherdyne.org/
Key fingerprint = 53EA 13EA 472E 3771 894F  AC69 95D8 5D6B A742 839F

Re: Looking for automation scripts

[William Perry]

See http://fut.patch.com

I am planning and working on an extension to fut that will permit 
sysadmins to share the ip's of idiots.

William Perry


cm@afm-koeln.de wrote:
> Am 06.01.2007 um 16:27 schrieb Michael Rash:
>
>> On Jan 06, 2007, Jan Engelhardt wrote:
>>
>>>> I've seen a few references here to scripts that monitor attacks and
>>>> dynamically update iptables rules to knock down the attacks. Can 
>>>> anyone
>>>> provide some good research starting points or sample scripts that 
>>>> they use?
>>>
>>> denyhosts.sf.net?
>>
>> While denyhosts is a good concept, I question whether it provides a real
>> security benefit.  If a new remotely exploitable vulnerability is
>> discovered in OpenSSH (or other ssh implementation) it will most likely
>> have nothing to do with trying to brute force passwords.  Doing a quick
>> search through http://www.securityfocus.com/bid/ turns up recent SSH
>> security issues (not necessarily highly critical, but it is only a
>> matter of time).
>
> .. its recommendable as a second instance of a "firewall" framework.
>
> -- 
>
> This sounds also good: http://fail2ban.sourceforge.net
>
> Best Regards
>
> CM
>
>
>

RE: Looking for automation scripts

[Tim Evans]

>denyhosts.sf.net?

This is a great package, but it doesn't touch iptables rules.  Rather, it relies 
on tcp wrapper (ssh must be built with libwrap) and it dynamically adds IP's to 
/etc/hosts.deny
--
Tim Evans, TKEvans.com, Inc.	|    5 Chestnut Court
tkevans@tkevans.com		|    Owings Mills, MD 21117
http://www.tkevans.com/		|    443-394-3864
http://www.come-here.com/News/	|