gethostbyname()

The last few years (2010-2015), I have been using a command line log-compiler tool I made, called "sshlog", to monitor incoming SSH-logins, both accepted and failed.

It is basically a crude administration-tool (server-side) for remote use on mobile devices and tablets. In combination with "DenyHosts" (python-program for blocking IPs that carry out repetitive and malicious ssh-bruteforce attempts), it proved to be a very solid security-framework.

That is, until January this year.

Suddenly sshlog reported that there weren't made any malicious ssh-connections the last month, and, DenyHosts did not add any new IPs since december last year. Weird...

While log-surfing and manually executing my sshlog-algorithm on my system-logs, I noticed there HAD been malicious ssh-bruteforcing (like usual)... but none of the offending addresses had been added to the blacklist because 'auth.log' was full of warnings about unresolvable hostnames in '/etc/hosts.deny'.

After checking out /etc/hosts.deny, it became apparent that DenyHosts had been adding random canonical hostnames (which, in turn, requires DNS resolving of the IP-addresses) instead of legitimate IP-addresses.

I made my discovery thanks to this repeating error in /etc/hosts.deny:

warning: /etc/hosts.deny, line xxxx: can't verify hostname: getaddrinfo(<some-dynamic-ip>, AF_INET)

*SIGH*
Firstly, I had to stop DenyHosts, then I had to manually 'sed' all the IP-addresses that had been added as canonical hostnames from the DenyHosts config-files, then from /etc/hosts.deny and lastly start DenyHosts up again...

The whole ordeal was apparently caused by none other than... myself -_-

I had enabled DenyHosts to do hostname-lookups for blocked IP-addresses :P *Doh!* which in turn forced DenyHosts to add dynamic hostnames to /etc/hosts.deny, no matter if they were legitimate addresses or not.

Fact is; many of these malicious SSH auto-dialers use dynamic IP-addresses that won't resolve as legitimate addresses in DNS (no registered reverse-lookup, or similar), thus, they are added to '/etc/hosts.deny' with (invalid) canonical hostnames that don't correspond to legitimate MAC and IP-address pairs.

another cli-shot :P

sshlog v1.6

Bash scripts for generating and viewing simplified SSH access-logs in a console.

My reason for creating sshlog (and consequently sshloglist and sshlogviewer) was to have an easily available command-line toolchain, capable of generating and viewing simplified SSH access-logs through a console (plain-text interface, usually SSH+Bash).

sshlog generates a logfile based on command-line options given, then pipes the results to sshlog-viewer. Or, it can simply pipe the results into a timestamped text-logfile, in a directory called "ssh-logs" in your home-directory.

https://code.google.com/p/sshlog/

sshloglist is used to generate a box-based, selectable list of the logs already present in the ssh-logs directory, when a log is selected, it pipes the selected list filename to sshlog-viewer.

https://code.google.com/p/sshlog/

sshlogviewer is a box-based log-viewer interface. It prints the content from a given sshlog (from a datastream piped directly by sshlog, or given as a filename at the command-prompt or by sshlog-list). It then lets you flip through the sshlog-pages with the Page Up and Page Down keys. Press 'q' to quit (using less, if dialog is not installed) or spacebar/enter to press the "OK" button (using sshlog-viewer + dialog).

https://code.google.com/p/sshlog/

WinSCPbeen in heavy use over the years...

I hadn't given it much thought, but I have been using ONE Windows-application quite extensively over the past years. WinSCP.

For a simple-faced filemanager, it has many uses. But it's main feature is to connect to SSH / SFTP / FTP servers, handle files locally / remotely, transfer files, etc. A networked client-server file-manager application.

Before the early years of 2000, there were no decent graphical file-managers for cross-platform transfers and handling. Especially not with proper support for the Secure SHell v2 protocol.

WinSCP had this from the beginning (mainly with the scp program at first, then the SFTPv2 protocol. more recently WinSCP opts for switching to SFTPv3 protocol if available, for added security).

I can't recommend this program enough for it's easy transfer, handling and other file-related operations. I have never had any serious problems with it. It just works, and it works pretty damn good too.

It's interface is a beautiful interpretation of earlier, rather similar :P command-line designer guidelines.

A random screenshot

This is a normal, everyday looking screen for me.
Yes, I spend a lot of time on the CLI ;) both local and remote :P

OpenSSH

OpenSSH er en derivat av den originale "free ssh 1.2.12" utgivelsen fra Tatu Ylönen. Denne versjonen var den siste som var "fri" nok for gjenbruk i OpenSSH-prosjektet. Deler av OpenSSH bærer fremdeles Tatus lisens som var inkludert i hans egen utgivelse. Denne versjonen, og alle tidligere, brukte matematiske funksjoner fra "libgmp" biblioteket. Biblioteket var også inkludert med disse tidlige ssh versjonene. Libgmp er gjort tilgjengelig under (LGPL) Lesser GNU Public License, selv om versjoner av lisensen på denne tiden lignet mer på standard (GPL) GNU Public License.

En kombinert lisens for alle delene er tilgjengelig på http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENCE.

Snart etter 1.2.12 utgivelsen fra Tatu, ville nyere utgivelser by på mer restriktive lisenser, selv om libgmp fremdeles var inkludert og nødvendig for å bruke programvaren. Tidligere restriktive lisenser nektet folk å lage en Windows eller DOS versjon. Senere lisenser avgrenset bruken av ssh i kommersielle miljøer, hvor de i stedet krevde at firmaer kjøpte en dyr versjon fra Datafellows.

Tidlig i 1999, gjenoppdaget Björn Grönvall denne bestemte utgivelsen og startet å fikse bugs. Hans versjon av ssh er kalt OSSH og hadde bare støtte for SSH 1.3 protokollen. Rykter sier at OSSH har blitt integrert i noen kommersielle produkter i Sverige. Og til og med den dag i dag, har ikke OSSH støtte for SSH 2 protokollen.

OpenBSD prosjekt medlemmer ble klar over Björns arbeid mindre enn 2 måneder før utgivelsen av OpenBSD 2.6 release. De ville inkludere støtte for ssh protokollen i 2.6 utgivelsen av OpenBSD, men de måtte bli sikre på at den var perfekt. Derfor bestemte de seg for å 'forke' fra OSSH utgivelsen, og strebe etter rask utvikling på samme måte som den originale sikkerhetsrevisjonsprosessen ble utført internt i OpenBSD prosjektet. Som et resultat, var mye av kildekoden i utgivelses-filene allerede på RCS revision 1.34, noen helt oppe i 1.66. Utvikling gikk veldig raskt siden de hadde en deadline å komme i møte.

SSH, domains, crypto...

Finally, I've acquired a location to set up a desktop computer as a domain-gateway for my personal LAN/WAN/WiFi-connections! Sw33t! My earlier conclusion to carry an USB memory dongle was a good idea. I got so many notifications about brute-force attack-attempts running SSH-blockage rules on my firewall, so I decided to drop them all together.


Using private-key authentication with a passphrase, proved to be MUCH better. Nearly any excessive bandwidth-overhead, nor serious lagging (which was the main problems when running SSH firewall rules for brute-force attack tracking and blocking. It was basically too CPU intensive to be useful).

Regarding the key-authentication, both the generation of keys, and re-configuring of the SSH server to accept the keys was pretty straightforward. So now I'm enjoying fully secured SSHv2 sessions.

But again, I decided against utilizing some parts of my plans, like using 256bit AES cipher, instead of the intended 448bit Blowfish cipher, as it would be overkill with regards to the processing power available on the desktop machine I'm going to use ;P (Pentium-III 1st gen. 800Mhz). From what I know, Norwegian government-sections use 256bit AES, so it will more than suffice for my uses. Less is more.

I also set up a basic, free static hostname (with wildcards) to reach my public gateway-machine, and a secondary hostname for dynamic http-forwarding to the web-server hosted on the domain.

Good luck to the ones wanting to crack these streams! ;D