Re: SSH break-in attempts

Peter Weaver wrote:

$! To control the purging of .LOG files edit SYS$SYSTEM:TCPIP$SSH_RUN.COM
$! I have modified SYS$SYSTEM:TCPIP$SSH_RUN.COM to keep any log created in
$! the past 14 days.

Since the default is /Keep=5, this is very important if you want
this procedure to work as intended. I just changed mine to /Keep=50

Also, if you have had your system connected to the Internet for a
while, you will find that the log files have topped out at version
32767 and no new ones are being created. Time to delete them all
and start over.

Another thing to note when using this procedure (as I have learned
in the last two days) is that the script kiddies will fire off five
or ten simultaneous SSH threads. Thus, you will have five or ten
log files with no records in them yet. Given that each one gives
them three attempts to guess the password, you will get a lot of
alarms before the rate limiting kicks in. But when those log files
are closed/flushed, boy do they hit a brick wall! :-)

I changed mine from a linear increase to an exponential increase
(limited by integer DCL arithmetic):

$ seconds = number_of_times * (number_of_times / 2)

At first I left off the "/2", but decided that was a bit *too*
aggressive. :-)

All in all, I am very happy with this procedure!

Now I just wish for a similar one for FTP.

Thanks,
Alan
.

Relevant Pages

  • Re: looping through inbox messages / debugger under Outlook VBA
    ... We have some software that creates very large log files as it runs, ... a rule that triggers a script may not always fire. ... I've read that the ItemAdd event and the NewMail events don't ...
    (microsoft.public.office.developer.outlook.vba)
  • Re: How IIS write his log files?
    ... the Log files life. ... Hence the events will not fire since the file is not ... > I'm trying to read IIS log files in real time. ...
    (microsoft.public.inetserver.iis.security)