Toblog

I’m used to seeing ssh dictionary attacks from single IPs, hitting my servers in a short amount of time. For the first time today, however, I have had entries like the following:

Oct 22 15:05:54 [sshd] error: PAM: Authentication failure for root from <hostname>

...fairly regularly spaced throughout the day, all from different hosts. The natural assumption is that the dictionary attacks are now being run from botnets.

Anyone else seeing these? In the past when noticing dictionary attacks I’ve blocked the source IP; that now seems a little harsh for hosts that are being used without their owners’ consent. If a lot of people did that it may encourage the owners to take more notice of their security, but such a draconian measure would require a large amount of people to take part in order for it to be effective.

A DNSBL for firewalls would be a possible solution, although there would have to be a way of notifying people the reason they can’t connect to a particular host.