download issue 27 here - Help Net Security

We security folks are often blamed for treating our users (or customers, if you
want) as less than competent. We generally expect users to consider what we
say as information security gospel, but that doesnʼt happen very often.
Many users have questions, and if we are
lucky they may voice them. Personally, I have
found that when I take the trouble to explain
the reason behind my decree, people are
more likely to comply. You can file that under
the “user education” category, if you will.
I have a small home server that I use and
abuse for various purposes, and tracking the
various trends and attempts of ssh bruteforcing
has always been a source of endless
amusement. But one day, the following questions
sprung into my mind: "Could I actually
use that information? Could I get something
useful from it?"
With that in mind, I set about working on starting
logging the passwords. I will not go into
the details now - suffice to say I wanted some-
thing that was low maintenance, worked and
did not require another server process or
modifying the sshd code.
I ended up using a custom pam module to log
the source, the username and the password
of each attempt, and I created honeypot users
to monitor these attempts.
Each bruteforce attempt creates a log entry
that looks something like this:
host = estpak.ee : username = shoutcast :
password = shoutcast
I let that setup run for a few months, specifically
from December 2009 to July 2010. Letʼs
see if the collected data can help us answer
some questions.
www.insecuremag.com 23