7 ms·

Patch to Log SSH Passwords – One Year Results

81 points by w8rbt 12y ago

ryan-c 12y ago
I wonder what's up with all the super long entries in there. Bugs in the bots?
- pdoconnell 12y ago
  I'd guess that they're unique passwords taken from plain text password dumps that ended up in dictionaries.
- korzun 12y ago
  It looks like ever wrote the scanner (that hit this honeypot) thought it would be a great idea to count on instances where terminal becomes laggy/crashes during a password change. Adminstrator would then set a new password by an accident. My theory anyways.
tedunangst 12y ago
Damn! I was certain nobody would guess my password of eight commas.
- byuu 12y ago
  Shit!! Someone guessed my password as well, on line 1120! 000000.000000000**0000000000000000000ooooo000111222333000OOO00OO0O0O0011447700384zxh.007Martin00idc805188..e0102030114110123.01234.01234.*012345601234567.*0123456789!@0123lhb0123014785236901601hr0205\\023022-58810235025516700270301fjfzw1=-03110368350037804047 I thought for sure a 260-character password with 1,560 bits of entropy would be sufficient. I better go change it right away :O
jamiesonbecker 12y ago
I just don't know why people still use passwords with SSH anyway! (ie userify and stuff)
- imron 12y ago
  Not sure why you're getting downvotes. I use key authentication for all my SSH needs. If it's important enough to still need a password on top of that, the password can go on the key.
  - deleted 12y ago
    [deleted]
  - e12e 12y ago
    Huh? Always encrypt the ssh-key, and use ssh-agent for convenience. That said it is now quite easy to set up proper two-factor authentication: eg key and otp.
    - lobster_johnson 12y ago
      On OS X, the keychain app caches the private key password forever. Even after a reboot. Any idea how to fix this? Ideally Keychain should ask me again (say) an hour after my last login with the same key.
      - cflee 12y ago
        I don't think you can set this at a key-specific level, but in Keychain Access, you can ctrl-click on the keychain and set it to lock after x min of inactivity / when sleeping. I'm not sure if you can put your ssh keys on a specific (non-login) keychain. If you want those, you may want to go to Keychain Access > Preferences > First Aid > uncheck "Keep login keychain unlocked".
        rectang 12y ago
        You can drag-and-drop items between keychains -- you just need to enter the passwords for both keychains when doing so. This makes it possible to keep valuable items in one or more auxiliary keychains set to always prompt (lock after 0 minutes). (This technique isn't a panacea but it contributes to defense in depth.)
jijji 12y ago
use ssh keys or use iptables whitelisting on all your boxes
- byuu 12y ago
  Alternatively or in addition, add a firewall rule to permanently ban any IPs after too many failed attempts or simultaneous connections, make sure root login is disabled, and/or put sshd on a non-standard port (I find the last one a bit of security theater, but it will reduce some wasted traffic if nothing else.) Here's my pf rule for ssh (brute force filter): table <sshbans> persist block quick from <sshbans> pass quick proto tcp from any to any port ssh \ flags S/SA keep state \ (max-src-conn 15, max-src-conn-rate 5/3, \ overload <sshbans> flush global) Raise the values a bit if you have other SSH users on your box. I get about 50 new bans a day. It's pretty much guaranteed if you have a server on the web with port 22 open, that bots will be attempting to brute-force it.
dsl 12y ago
I'll save you the time of downloading the full results. 'hunter2' is in the list.
- VonGuard 12y ago
  How come when I type "hunter2" it comes up "*"?
gburt 12y ago
Wait, who is logging SSH passwords? Is this an intentional attack on OpenSSH Portable or is it a honeypot?
- w8rbt 12y ago
  Sheep dogs and wolves. The sheep have no idea. If you are asking the question, take a deep breath and say, "bah".
  - Thimothy 12y ago
    Yeah. Bah at you all day long. http://dilbert.com/strips/comic/1996-07-27/ http://dilbert.com/strips/comic/1996-07-27/
    - w8rbt 12y ago
      I thought people would understand the reference I was making, but it totally failed... my apologies. It's a good read. http://mwkworks.com/onsheepwolvesandsheepdogs.html http://mwkworks.com/onsheepwolvesandsheepdogs.html
- wglb 12y ago
  Hang any SSHD on the internet, and within minutes you get these attempts. You can choose to log the passwords if you like and this is what you would see.
  - xtrumanx 12y ago
    Wow you're right. I just setup my own VPS yesterday. Decided to check the auth logs and the first invalid user attempt occurred less than 3 hours from my first login. The "POSSIBLE BREAK-IN ATTEMPT!" message worried me for a bit but a little googling and the fact I've disabled password login calmed me down. Presumably, changing my sshd port will drastically reduce these attempts right? Or do attackers routinely port scan servers?
    - 12y ago
ryan-c 12y ago
So, some stats: There's 350,032 unique passwords in there. * 122,094 (~35%) are in the rockyou dump (which has 14,344,391 unique entries) * 2898 passwords in my list of cracked linkedin passwords, excluding those in the rockyou dump (2,002,484 unique entries) * 27,639 are in the phpbb dump i have (184,344 unique entries)
- anonfunction 12y ago
  I also detected 1893 palindromes out of 350064 total lines. Finally a (laughable) real-world use for my palindrome detection project[1]. [1] https://github.com/montanaflynn/palindromes/ https://github.com/montanaflynn/palindromes/ Edit: I also pulled some more stats out of just the passwords: Total characters: 2938676 Average character count: 8.39544955889747 Median character count: 6 Maximum character count: 294
- ryan-c 12y ago
  Sorry about the formatting there sucking. :-(
deleted 12y ago
[deleted]
machrider 12y ago
If you're running an ssh server that allows password authentication, make sure you're also running fail2ban.[1] Too many failed login attempts will block the IP (at an iptables level) for a configurable time period. [1]: http://www.fail2ban.org/wiki/index.php/Main_Page http://www.fail2ban.org/wiki/index.php/Main_Page
- hoers 12y ago
  You also might want to consider changing your SSH Port http://danielmiessler.com/blog/security-and-obscurity-does-changing-your-ssh-port-lower-your-risk/ http://danielmiessler.com/blog/security-and-obscurity-does-c...
  - sireat 12y ago
    As the author of that post says it greatly reduces the login attempts. It has been my experience as well. An analogy with a house it would be like making a brick wall behind your front door and making a new door on the side of the house. Sure, it would not change significantly the time for a determined thief wanting your house specifically,. However moving the door would do wonders against some punk with a bunch of keys who runs around trying them on all neighborhood doors. You still have to make sure you have a good lock and door.
- ryan-c 12y ago
  I like pam_shield, personally. https://github.com/jtniehof/pam_shield https://github.com/jtniehof/pam_shield Back in the day, disabling password auth but leaving keyboard_interactive on would stop a lot of these things, but I don't think that's true any more.
- joshavant 12y ago
  If you're going for a security plan of obscurity (which, IMO, is what fail2ban is), I'd just change the SSH port, instead.
  - darklajid 12y ago
    Now I'm confused. Why do you consider blocking someone that clearly is trying to brute force his way in 'obscure'?
peteretep 12y ago
Really no passwords with spaces in them, or a data-preparation error?
- Terretta 12y ago
  Defeat shoulder surfers -- just use n spaces and m spaces to spell your password in morse code, appearing as all spaces.
- peteretep 12y ago
  I would be curious to know why this got downvoted. I went looking for "correct horse battery staple" and then realized that apparently the bots hadn't tried any passwords with spaces in them, but also that the patch uses spaces as a delimiter...
uzonite 12y ago
https://home.regit.org/2014/06/pshitt-collect-passwords-used-in-ssh-bruteforce/ https://home.regit.org/2014/06/pshitt-collect-passwords-used...
feld 12y ago
Use 2 factor auth with ssh via Yubikey or TOTP and it doesn't matter if they try to brute force you
- mrsteveman1 12y ago
  I'm considering using those yubikey modes for ssh or local login on certain servers and in certain situations, though it requires some changes on each server to enable it. I'm quite fond of the Yubikey NEO's openpgp applet paired with gpg-agent's ability to act as a compatible ssh-agent, allows standard SSH key login to any server with no server changes at all. I love the idea of my GPG and SSH key being truly portable in a very reasonably sized formfactor as well.

81 points by w8rbt 12y ago

ryan-c 12y ago

I wonder what's up with all the super long entries in there. Bugs in the bots?

pdoconnell 12y ago
I'd guess that they're unique passwords taken from plain text password dumps that ended up in dictionaries.
korzun 12y ago
It looks like ever wrote the scanner (that hit this honeypot) thought it would be a great idea to count on instances where terminal becomes laggy/crashes during a password change. Adminstrator would then set a new password by an accident. My theory anyways.

tedunangst 12y ago

Damn! I was certain nobody would guess my password of eight commas.

byuu 12y ago
Shit!! Someone guessed my password as well, on line 1120! 000000.000000000**0000000000000000000ooooo000111222333000OOO00OO0O0O0011447700384zxh.007Martin00idc805188..e0102030114110123.01234.01234.*012345601234567.*0123456789!@0123lhb0123014785236901601hr0205\\023022-58810235025516700270301fjfzw1=-03110368350037804047 I thought for sure a 260-character password with 1,560 bits of entropy would be sufficient. I better go change it right away :O

jamiesonbecker 12y ago

I just don't know why people still use passwords with SSH anyway! (ie userify and stuff)

imron 12y ago
Not sure why you're getting downvotes. I use key authentication for all my SSH needs. If it's important enough to still need a password on top of that, the password can go on the key.
- deleted 12y ago
  [deleted]
- e12e 12y ago
  Huh? Always encrypt the ssh-key, and use ssh-agent for convenience. That said it is now quite easy to set up proper two-factor authentication: eg key and otp.
  - lobster_johnson 12y ago
    On OS X, the keychain app caches the private key password forever. Even after a reboot. Any idea how to fix this? Ideally Keychain should ask me again (say) an hour after my last login with the same key.
    - cflee 12y ago
      I don't think you can set this at a key-specific level, but in Keychain Access, you can ctrl-click on the keychain and set it to lock after x min of inactivity / when sleeping. I'm not sure if you can put your ssh keys on a specific (non-login) keychain. If you want those, you may want to go to Keychain Access > Preferences > First Aid > uncheck "Keep login keychain unlocked".
      - rectang 12y ago
        You can drag-and-drop items between keychains -- you just need to enter the passwords for both keychains when doing so. This makes it possible to keep valuable items in one or more auxiliary keychains set to always prompt (lock after 0 minutes). (This technique isn't a panacea but it contributes to defense in depth.)

jijji 12y ago

use ssh keys or use iptables whitelisting on all your boxes

byuu 12y ago
Alternatively or in addition, add a firewall rule to permanently ban any IPs after too many failed attempts or simultaneous connections, make sure root login is disabled, and/or put sshd on a non-standard port (I find the last one a bit of security theater, but it will reduce some wasted traffic if nothing else.) Here's my pf rule for ssh (brute force filter): table <sshbans> persist block quick from <sshbans> pass quick proto tcp from any to any port ssh \ flags S/SA keep state \ (max-src-conn 15, max-src-conn-rate 5/3, \ overload <sshbans> flush global) Raise the values a bit if you have other SSH users on your box. I get about 50 new bans a day. It's pretty much guaranteed if you have a server on the web with port 22 open, that bots will be attempting to brute-force it.

dsl 12y ago

I'll save you the time of downloading the full results. 'hunter2' is in the list.

VonGuard 12y ago
How come when I type "hunter2" it comes up "*"?

gburt 12y ago

Wait, who is logging SSH passwords? Is this an intentional attack on OpenSSH Portable or is it a honeypot?

w8rbt 12y ago
Sheep dogs and wolves. The sheep have no idea. If you are asking the question, take a deep breath and say, "bah".
- Thimothy 12y ago
  Yeah. Bah at you all day long. http://dilbert.com/strips/comic/1996-07-27/ http://dilbert.com/strips/comic/1996-07-27/
  - w8rbt 12y ago
    I thought people would understand the reference I was making, but it totally failed... my apologies. It's a good read. http://mwkworks.com/onsheepwolvesandsheepdogs.html http://mwkworks.com/onsheepwolvesandsheepdogs.html
wglb 12y ago
Hang any SSHD on the internet, and within minutes you get these attempts. You can choose to log the passwords if you like and this is what you would see.
- xtrumanx 12y ago
  Wow you're right. I just setup my own VPS yesterday. Decided to check the auth logs and the first invalid user attempt occurred less than 3 hours from my first login. The "POSSIBLE BREAK-IN ATTEMPT!" message worried me for a bit but a little googling and the fact I've disabled password login calmed me down. Presumably, changing my sshd port will drastically reduce these attempts right? Or do attackers routinely port scan servers?
  - 12y ago

ryan-c 12y ago

So, some stats: There's 350,032 unique passwords in there. * 122,094 (~35%) are in the rockyou dump (which has 14,344,391 unique entries) * 2898 passwords in my list of cracked linkedin passwords, excluding those in the rockyou dump (2,002,484 unique entries) * 27,639 are in the phpbb dump i have (184,344 unique entries)

anonfunction 12y ago
I also detected 1893 palindromes out of 350064 total lines. Finally a (laughable) real-world use for my palindrome detection project[1]. [1] https://github.com/montanaflynn/palindromes/ https://github.com/montanaflynn/palindromes/ Edit: I also pulled some more stats out of just the passwords: Total characters: 2938676 Average character count: 8.39544955889747 Median character count: 6 Maximum character count: 294
ryan-c 12y ago
Sorry about the formatting there sucking. :-(

deleted 12y ago

[deleted]

machrider 12y ago

If you're running an ssh server that allows password authentication, make sure you're also running fail2ban.[1] Too many failed login attempts will block the IP (at an iptables level) for a configurable time period. [1]: http://www.fail2ban.org/wiki/index.php/Main_Page http://www.fail2ban.org/wiki/index.php/Main_Page

hoers 12y ago
You also might want to consider changing your SSH Port http://danielmiessler.com/blog/security-and-obscurity-does-changing-your-ssh-port-lower-your-risk/ http://danielmiessler.com/blog/security-and-obscurity-does-c...
- sireat 12y ago
  As the author of that post says it greatly reduces the login attempts. It has been my experience as well. An analogy with a house it would be like making a brick wall behind your front door and making a new door on the side of the house. Sure, it would not change significantly the time for a determined thief wanting your house specifically,. However moving the door would do wonders against some punk with a bunch of keys who runs around trying them on all neighborhood doors. You still have to make sure you have a good lock and door.
ryan-c 12y ago
I like pam_shield, personally. https://github.com/jtniehof/pam_shield https://github.com/jtniehof/pam_shield Back in the day, disabling password auth but leaving keyboard_interactive on would stop a lot of these things, but I don't think that's true any more.
joshavant 12y ago
If you're going for a security plan of obscurity (which, IMO, is what fail2ban is), I'd just change the SSH port, instead.
- darklajid 12y ago
  Now I'm confused. Why do you consider blocking someone that clearly is trying to brute force his way in 'obscure'?

peteretep 12y ago

Really no passwords with spaces in them, or a data-preparation error?

Terretta 12y ago
Defeat shoulder surfers -- just use n spaces and m spaces to spell your password in morse code, appearing as all spaces.
peteretep 12y ago
I would be curious to know why this got downvoted. I went looking for "correct horse battery staple" and then realized that apparently the bots hadn't tried any passwords with spaces in them, but also that the patch uses spaces as a delimiter...

uzonite 12y ago

https://home.regit.org/2014/06/pshitt-collect-passwords-used-in-ssh-bruteforce/ https://home.regit.org/2014/06/pshitt-collect-passwords-used...

feld 12y ago

Use 2 factor auth with ssh via Yubikey or TOTP and it doesn't matter if they try to brute force you

mrsteveman1 12y ago
I'm considering using those yubikey modes for ssh or local login on certain servers and in certain situations, though it requires some changes on each server to enable it. I'm quite fond of the Yubikey NEO's openpgp applet paired with gpg-agent's ability to act as a compatible ssh-agent, allows standard SSH key login to any server with no server changes at all. I love the idea of my GPG and SSH key being truly portable in a very reasonably sized formfactor as well.