Automating the Response to SSH Scans
Servers with SSH exposed to the public internet are routinely probed by automated tools trying common username and password combinations. A typical attack shows up in /var/log/auth.log as repeated lines resembling:
cr:code
Jun 12 13:33:57 localhost sshd[18900]: Illegal user admin from 219.254.25.100
Jun 12 13:37:17 localhost sshd[18904]: Illegal user admin from 219.254.25.100
Jun 12 13:37:20 localhost sshd[18906]: Illegal user test from 219.254.25.100
Jun 12 13:37:22 localhost sshd[18908]: Illegal user guest from 219.254.25.100
</cr:code>
Left alone, a single scan can generate hundreds of such lines, cluttering the logs without adding any useful signal.
SBLD is a small Perl daemon built to catch these patterns as they appear. It watches the log file for entries matching a regex, then uses iptables to block the originating IP address. Detection happens within seconds, which shortens the window an attacker has to work with. The script also keeps the ban list from growing indefinitely: blocks last only as long as needed, and the daemon limits the number of simultaneous bans to avoid putting unnecessary load on iptables or on itself. The alert level for a host is gradually lowered when no further attack traffic is observed.
The effect is visible almost immediately in the logs:
cr:code
Jun 17 13:31:58 localhost sshd[3314]: Illegal user test from 209.76.72.12
Jun 17 13:31:59 localhost sshd[3316]: Illegal user test from 209.76.72.12
Jun 17 13:32:00 localhost sshd[3322]: Illegal user tester from 209.76.72.12
Jun 17 13:32:00 localhost sbld[3326]: Blocked 209.76.72.12
Jun 17 13:32:30 localhost sbld[3326]: Unblocked 209.76.72.12
</cr:code>
Because detection is driven by a simple regex on the log content, extending SBLD to handle other attack patterns should be straightforward.
Availability
SBLD is still under active development, and there are no guarantees regarding performance, safety, or security. Feedback and suggestions are welcome.
