From owner-freebsd-questions@FreeBSD.ORG Tue Aug 10 06:38:05 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EAD1A1065670 for ; Tue, 10 Aug 2010 06:38:04 +0000 (UTC) (envelope-from rrborg@speakeasy.net) Received: from mail7.sea5.speakeasy.net (mail7.sea5.speakeasy.net [69.17.117.52]) by mx1.freebsd.org (Postfix) with ESMTP id C78DC8FC18 for ; Tue, 10 Aug 2010 06:38:04 +0000 (UTC) Received: (qmail 31681 invoked from network); 10 Aug 2010 06:38:04 -0000 Received: from c-67-187-169-218.hsd1.ca.comcast.net (HELO [192.168.1.141]) (rrborg@[67.187.169.218]) (envelope-sender ) by mail7.sea5.speakeasy.net (qmail-ldap-1.03) with AES256-SHA encrypted SMTP for ; 10 Aug 2010 06:38:03 -0000 Message-ID: <4C60F3CB.6090204@speakeasy.net> Date: Mon, 09 Aug 2010 23:38:03 -0700 From: Rocky Borg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.11) Gecko/20100711 Thunderbird/3.0.6 MIME-Version: 1.0 To: freebsd-questions@freebsd.org References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: ssh under attack - sessions in accepted state hogging CPU X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Aug 2010 06:38:05 -0000 One thing I don't see mentioned a lot is port knocking. It's not perfect but it does have it's uses. Since it sounds like you have a lot of users that need to connect you might be able to adapt it to your situation. I haven't tried this specific port knocking sequence but you could setup a knock where if a user attempts to connect to port 22 say 3 times (most clients should auto retry) it then opens up port 22 to that ip and allows them to connect to sshd. This would depend on the type of brute force being done. A distributed botnet might only try an ip/port once or twice then move on. This would be pretty seemless to the end user except for an initial delay when connecting as their client retries the connection until the specific knock threshold has been hit. It's a middle ground to changing the port sshd is operating on. You can do this with firewall rules or http://www.freshports.org/security/knock/. A lot of SSH attacks are coming from large numbers of compromised hosts that make them very hard to stop with sshguard which is pretty annoying. On 8/9/2010 8:13 PM, Matt Emmerton wrote: > Hi all, > > I'm in the middle of dealing with a SSH brute force attack that is > relentless. I'm working on getting sshguard+ipfw in place to deal > with it, but in the meantime, my box is getting pegged because sshd is > accepting some connections which are getting stuck in [accepted] state > and eating CPU. > > I know there's not much I can do about the brute force attacks, but > will upgrading openssh avoid these stuck connections? > > root 39127 35.2 0.1 6724 3036 ?? Rs 11:10PM 0:37.91 sshd: > [accepted] (sshd) > root 39368 33.6 0.1 6724 3036 ?? Rs 11:10PM 0:22.99 sshd: > [accepted] (sshd) > root 39138 33.1 0.1 6724 3036 ?? Rs 11:10PM 0:41.94 sshd: > [accepted] (sshd) > root 39137 32.5 0.1 6724 3036 ?? Rs 11:10PM 0:36.56 sshd: > [accepted] (sshd) > root 39135 31.0 0.1 6724 3036 ?? Rs 11:10PM 0:35.09 sshd: > [accepted] (sshd) > root 39366 30.9 0.1 6724 3036 ?? Rs 11:10PM 0:23.01 sshd: > [accepted] (sshd) > root 39132 30.8 0.1 6724 3036 ?? Rs 11:10PM 0:35.21 sshd: > [accepted] (sshd) > root 39131 30.7 0.1 6724 3036 ?? Rs 11:10PM 0:38.07 sshd: > [accepted] (sshd) > root 39134 30.2 0.1 6724 3036 ?? Rs 11:10PM 0:40.96 sshd: > [accepted] (sshd) > root 39367 29.3 0.1 6724 3036 ?? Rs 11:10PM 0:22.08 sshd: > [accepted] (sshd) > > PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU > COMMAND > 39597 root 1 103 0 6724K 3036K RUN 3 0:28 > 35.06% sshd > 39599 root 1 103 0 6724K 3036K RUN 0 0:26 > 34.96% sshd > 39596 root 1 103 0 6724K 3036K RUN 0 0:27 > 34.77% sshd > 39579 root 1 103 0 6724K 3036K CPU3 3 0:28 > 33.69% sshd > 39592 root 1 102 0 6724K 3036K RUN 2 0:27 > 32.18% sshd > 39591 root 1 102 0 6724K 3036K CPU2 2 0:27 > 31.88% sshd > > -- > Matt Emmerton > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to > "freebsd-questions-unsubscribe@freebsd.org" > >