{"id":3494,"date":"2017-02-18T22:36:21","date_gmt":"2017-02-18T18:36:21","guid":{"rendered":"https:\/\/nayarweb.com\/blog\/?p=3494"},"modified":"2017-02-18T22:36:21","modified_gmt":"2017-02-18T18:36:21","slug":"detecting-brute-force-attacks-on-linux-using-graylogelasticsearch","status":"publish","type":"post","link":"https:\/\/nayarweb.com\/blog\/2017\/detecting-brute-force-attacks-on-linux-using-graylogelasticsearch\/","title":{"rendered":"Detecting Brute Force Attacks on Linux using Graylog\/Elasticsearch"},"content":{"rendered":"

I noticed one of my servers is sending more logs than the other. `sshd` was the application sending the most amount of logs in the last 24 hours.<\/p>\n

\"\"<\/p>\n

The logs look like these:<\/p>\n

pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.52 user=root<\/p>\n

Failed password for root from 116.31.116.52 port 14281 ssh2<\/p>\n

message repeated 2 times: [ Failed password for root from 116.31.116.52 port 14281 ssh2]<\/p>\n

Received disconnect from 116.31.116.52 port 14281:11: [preauth]<\/p>\n

Disconnected from 116.31.116.52 port 14281 [preauth]<\/p>\n

PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.52 user=root<\/p><\/blockquote>\n

Since the IPs are being logged, I can know from where these are coming. Let’s generate a map.<\/p>\n

\"\"<\/p>\n

Well well well, 5437 occurrences from China. Gotta do something. Here’s frequency of the attacks this week.<\/p>\n

\"\"<\/p>\n

It seems to have amplified today. Looking at the logs, we can see that the were trying different passwords for the user `root`. Lemme just disable password authentication for SSH.<\/p>\n

$ vim \/etc\/ssh\/sshd_config<\/p><\/blockquote>\n

Change the line<\/p>\n

#PasswordAuthentication yes<\/span><\/p><\/blockquote>\n

to<\/p>\n

\n

PasswordAuthentication no<\/span><\/p>\n

$ service ssh restart<\/p>\n<\/blockquote>\n

And we can see the logs are no more appearing \ud83d\ude09<\/p>\n

\"\"<\/p>\n

Do you wish to analyse your server logs too? Feel free to message me on Facebook or Twitter or LinkedIn<\/h2>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

I noticed one of my servers is sending more logs than the other. `sshd` was the application sending the most amount of logs in the last 24 hours. The logs look like these: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.52 user=root Failed password for root from 116.31.116.52 port 14281 ssh2 message repeated 2 … Continue reading Detecting Brute Force Attacks on Linux using Graylog\/Elasticsearch<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[210],"tags":[224,225,226,61,223],"class_list":["post-3494","post","type-post","status-publish","format-standard","hentry","category-technology","tag-big-data","tag-elasticsearch","tag-graylog","tag-linux","tag-system-administration"],"_links":{"self":[{"href":"https:\/\/nayarweb.com\/blog\/wp-json\/wp\/v2\/posts\/3494","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nayarweb.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nayarweb.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nayarweb.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nayarweb.com\/blog\/wp-json\/wp\/v2\/comments?post=3494"}],"version-history":[{"count":4,"href":"https:\/\/nayarweb.com\/blog\/wp-json\/wp\/v2\/posts\/3494\/revisions"}],"predecessor-version":[{"id":3506,"href":"https:\/\/nayarweb.com\/blog\/wp-json\/wp\/v2\/posts\/3494\/revisions\/3506"}],"wp:attachment":[{"href":"https:\/\/nayarweb.com\/blog\/wp-json\/wp\/v2\/media?parent=3494"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nayarweb.com\/blog\/wp-json\/wp\/v2\/categories?post=3494"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nayarweb.com\/blog\/wp-json\/wp\/v2\/tags?post=3494"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}