Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Alguem tentando acessar pfsense através de ssh! Segurança !

    Scheduled Pinned Locked Moved
    Portuguese
    6
    7
    3.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      vina18
      last edited by

      Pessoal chequei o system logs e temos tais tentativas sem sucesso de acessar a interface do pfsense.Trata-se de uma tentativa de acessar a interface do pfsense através do ssh.

      Segue os logs:

      un 5 10:33:16	sshlockout[19472]: Locking out 202.103.190.122 after 15 invalid attempts
Jun 5 10:33:16	sshd[7367]: Failed password for root from 202.103.190.122 port 44087 ssh2
Jun 5 10:33:13	sshd[5356]: Failed password for root from 202.103.190.122 port 43903 ssh2
Jun 5 10:33:10	sshd[4605]: Failed password for root from 202.103.190.122 port 43716 ssh2
Jun 5 10:33:07	sshd[4229]: Failed password for root from 202.103.190.122 port 43547 ssh2
Jun 5 10:33:04	sshd[3810]: Failed password for root from 202.103.190.122 port 43349 ssh2
Jun 5 10:33:02	sshd[1835]: Failed password for root from 202.103.190.122 port 43163 ssh2
Jun 5 10:32:59	sshd[48874]: Failed password for root from 202.103.190.122 port 42981 ssh2
Jun 5 10:32:56	sshd[48335]: Failed password for root from 202.103.190.122 port 42801 ssh2
Jun 5 10:32:53	sshd[48002]: Failed password for root from 202.103.190.122 port 42621 ssh2
Jun 5 10:32:50	sshd[47380]: Failed password for root from 202.103.190.122 port 42449 ssh2
Jun 5 10:32:48	sshd[47030]: Failed password for root from 202.103.190.122 port 42265 ssh2
Jun 5 10:32:45	sshd[46765]: Failed password for root from 202.103.190.122 port 42082 ssh2
Jun 5 10:32:42	sshd[46120]: Failed password for root from 202.103.190.122 port 41879 ssh2
Jun 5 10:32:39	sshd[45891]: Failed password for root from 202.103.190.122 port 41699 ssh2
Jun 5 10:32:36	sshd[45559]: Failed password for root from 202.103.190.122 port 41505 ssh2
Jun 5 10:15:54	sshd[2302]: Failed password for invalid user nagios from 210.245.90.176 port 40851 ssh2
Jun 5 10:15:54	sshd[2302]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:49	sshd[113]: Failed password for invalid user nagios from 210.245.90.176 port 40143 ssh2
Jun 5 10:15:49	sshd[113]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:39	sshd[63656]: Failed password for invalid user nagios from 210.245.90.176 port 39743 ssh2
Jun 5 10:15:39	sshd[63656]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:34	sshd[63151]: Failed password for invalid user nagios from 210.245.90.176 port 39362 ssh2
Jun 5 10:15:34	sshd[63151]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:29	sshd[59370]: Failed password for invalid user nagios from 210.245.90.176 port 38722 ssh2
Jun 5 10:15:29	sshd[59370]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:20	sshd[39815]: Failed password for invalid user nagios from 210.245.90.176 port 38404 ssh2
Jun 5 10:15:20	sshd[39815]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:15	sshd[39199]: Failed password for invalid user nagios from 210.245.90.176 port 37763 ssh2
Jun 5 10:15:15	sshd[39199]: Invalid user nagios from 210.245.90.176
Jun 5 09:07:08	check_reload_status: Syncing firewall
Jun 5 09:07:08	check_reload_status: Syncing firewall
Jun 5 07:51:08	ipfw-classifyd: Loaded Protocol: msnmessenger (rule action block)
Jun 5 07:51:08	ipfw-classifyd: Loaded Protocol: bittorrent (rule action block)
Jun 5 07:51:08	ipfw-classifyd: Reloading config...
Jun 5 07:51:08	php: : Sending HUP signal to 26183
Jun 5 07:51:07	kernel: Bump sched buckets to 64 (was 0)
Jun 5 07:51:07	kernel: Bump sched buckets to 64 (was 0)
Jun 5 07:51:01	check_reload_status: Reloading filter
Jun 5 07:51:01	php: /pkg_edit.php: Reloading Squid for configuration sync
Jun 5 07:48:32	check_reload_status: Syncing firewall
Jun 5 07:48:21	check_reload_status: Syncing firewall
Jun 5 07:48:12	check_reload_status: Syncing firewall
Jun 5 07:47:22	check_reload_status: Syncing firewall
Jun 5 07:47:22	check_reload_status: Syncing firewall

      1- O "hacker" está tentando usar um dicionário de senhas e palavras para quebrar a senha e o nome de usuário.
      2- Tais Ips estão mascarados através de proxys em diferentes países.
      3- Gostaria de descobrir quem está fazendo isso .. sei que é difícil.
      4- Alguém tem alguma sugestão ?

      Grato

      Just do it !

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        vina,

        Antes de se preocupar em encontrar a maquina infectada/rodando script, siga o procedimento mínimo para deixar seu acesso ssh mais seguro.

        se faz acesso externo, tente criar um dns dinamico para usa maquina, desta forma você pode criar uma regra restrita a um ip dinamico.
        mude a porta ssh, a maioria dos scripts busca acesso na porta 22.

        Para nossa sorte, o pfsense por padrão já bloqueia qualquer ip que erra a senha mais de 15 vezes, o que torna o ataque de força bruta inútil.

        Para identificar a origem, busque nos sites/orgãos que distribuem os ips. Assim que você encontrar o responsável pela faixa, você manda um email relatando a tentativa.

        No brasil, começa pelo whois.registro.br

        att,
        Marcello Coutinho

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • M
          mantunespb
          last edited by

          Por questão de segurança, eu não acesso nenhum servidor via ssh ou até mesmo o webgui diretamente via WAN.. eu sempre faço uma VPN com OpenVPN e
          acesso local.

          Simples e seguro..

          1 Reply Last reply Reply Quote 0
          • J
            johnnybe
            last edited by

            @marcelloc:

            mude a porta ssh, a maioria dos scripts busca acesso na porta 22.

            Mudar a porta é o que eu faço, sim.  :)

            you would not believe the view up here

            1 Reply Last reply Reply Quote 0
            • L
              laos
              last edited by

              Ola , boa tarde, cara isso e' normal. So' iniciar o servico que ja comecam as tentativas. O que eu fazia era, tirar a possibilidade do root de fazer acesso e especificar quais usuarios poderiam acessar por ssh e se fosse permitido, mudar a porta. Como estou comecando no pfsense ainda nao achei essas primeiras coisas que te disse so' a mudanca da porta consegui fazer. Desculpe a resposta pela metade mas acho que a partir dai ja da pra comecar alguma coisa. abraco.

              @vina18:

              Pessoal chequei o system logs e temos tais tentativas sem sucesso de acessar a interface do pfsense.Trata-se de uma tentativa de acessar a interface do pfsense através do ssh.

              Segue os logs:

              un 5 10:33:16	sshlockout[19472]: Locking out 202.103.190.122 after 15 invalid attempts
Jun 5 10:33:16	sshd[7367]: Failed password for root from 202.103.190.122 port 44087 ssh2
Jun 5 10:33:13	sshd[5356]: Failed password for root from 202.103.190.122 port 43903 ssh2
Jun 5 10:33:10	sshd[4605]: Failed password for root from 202.103.190.122 port 43716 ssh2
Jun 5 10:33:07	sshd[4229]: Failed password for root from 202.103.190.122 port 43547 ssh2
Jun 5 10:33:04	sshd[3810]: Failed password for root from 202.103.190.122 port 43349 ssh2
Jun 5 10:33:02	sshd[1835]: Failed password for root from 202.103.190.122 port 43163 ssh2
Jun 5 10:32:59	sshd[48874]: Failed password for root from 202.103.190.122 port 42981 ssh2
Jun 5 10:32:56	sshd[48335]: Failed password for root from 202.103.190.122 port 42801 ssh2
Jun 5 10:32:53	sshd[48002]: Failed password for root from 202.103.190.122 port 42621 ssh2
Jun 5 10:32:50	sshd[47380]: Failed password for root from 202.103.190.122 port 42449 ssh2
Jun 5 10:32:48	sshd[47030]: Failed password for root from 202.103.190.122 port 42265 ssh2
Jun 5 10:32:45	sshd[46765]: Failed password for root from 202.103.190.122 port 42082 ssh2
Jun 5 10:32:42	sshd[46120]: Failed password for root from 202.103.190.122 port 41879 ssh2
Jun 5 10:32:39	sshd[45891]: Failed password for root from 202.103.190.122 port 41699 ssh2
Jun 5 10:32:36	sshd[45559]: Failed password for root from 202.103.190.122 port 41505 ssh2
Jun 5 10:15:54	sshd[2302]: Failed password for invalid user nagios from 210.245.90.176 port 40851 ssh2
Jun 5 10:15:54	sshd[2302]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:49	sshd[113]: Failed password for invalid user nagios from 210.245.90.176 port 40143 ssh2
Jun 5 10:15:49	sshd[113]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:39	sshd[63656]: Failed password for invalid user nagios from 210.245.90.176 port 39743 ssh2
Jun 5 10:15:39	sshd[63656]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:34	sshd[63151]: Failed password for invalid user nagios from 210.245.90.176 port 39362 ssh2
Jun 5 10:15:34	sshd[63151]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:29	sshd[59370]: Failed password for invalid user nagios from 210.245.90.176 port 38722 ssh2
Jun 5 10:15:29	sshd[59370]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:20	sshd[39815]: Failed password for invalid user nagios from 210.245.90.176 port 38404 ssh2
Jun 5 10:15:20	sshd[39815]: Invalid user nagios from 210.245.90.176
Jun 5 10:15:15	sshd[39199]: Failed password for invalid user nagios from 210.245.90.176 port 37763 ssh2
Jun 5 10:15:15	sshd[39199]: Invalid user nagios from 210.245.90.176
Jun 5 09:07:08	check_reload_status: Syncing firewall
Jun 5 09:07:08	check_reload_status: Syncing firewall
Jun 5 07:51:08	ipfw-classifyd: Loaded Protocol: msnmessenger (rule action block)
Jun 5 07:51:08	ipfw-classifyd: Loaded Protocol: bittorrent (rule action block)
Jun 5 07:51:08	ipfw-classifyd: Reloading config...
Jun 5 07:51:08	php: : Sending HUP signal to 26183
Jun 5 07:51:07	kernel: Bump sched buckets to 64 (was 0)
Jun 5 07:51:07	kernel: Bump sched buckets to 64 (was 0)
Jun 5 07:51:01	check_reload_status: Reloading filter
Jun 5 07:51:01	php: /pkg_edit.php: Reloading Squid for configuration sync
Jun 5 07:48:32	check_reload_status: Syncing firewall
Jun 5 07:48:21	check_reload_status: Syncing firewall
Jun 5 07:48:12	check_reload_status: Syncing firewall
Jun 5 07:47:22	check_reload_status: Syncing firewall
Jun 5 07:47:22	check_reload_status: Syncing firewall

              1- O "hacker" está tentando usar um dicionário de senhas e palavras para quebrar a senha e o nome de usuário.
              2- Tais Ips estão mascarados através de proxys em diferentes países.
              3- Gostaria de descobrir quem está fazendo isso .. sei que é difícil.
              4- Alguém tem alguma sugestão ?

              Grato

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                @laos:

                Ola , boa tarde, cara isso e' normal. So' iniciar o servico que ja comecam as tentativas.

                Sim.

                @laos:

                O que eu fazia era, tirar a possibilidade do root de fazer acesso e especificar quais usuarios poderiam acessar por ssh e se fosse permitido, mudar a porta.

                O pacote sshdcond vai te ajudar bastante nas acls de ssh. Você pode por exemplo dizer que root login só dos ips da rede interna.

                O primeiro passo é com certeza mudar a porta.

                att,
                Marcello Coutinho

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • JackLJ
                  JackL
                  last edited by

                  Adicionalmente a tudo que já foi dito aqui por outros colegas, gostaria de sugerir fortemente a leitura deste material disponibilizado pelo CERT: http://www.cert.br/docs/whitepapers/defesa-forca-bruta-ssh/

                  Trata-se de um guia compacto e didático que aborda sugestões para defesa contra ataques de força bruta para SSH.

                  Fica a dica! ;)

                  Abraços!
                  Jack

                  Treinamentos de Elite: http://sys-squad.com
                  Soluções: https://conexti.com.br

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.