Patch to Log SSH Passwords – One Year Results

[ryan-c]

So, some stats:

There's 350,032 unique passwords in there.

* 122,094 (~35%) are in the rockyou dump (which has 14,344,391 unique entries) * 2898 passwords in my list of cracked linkedin passwords, excluding those in the rockyou dump (2,002,484 unique entries) * 27,639 are in the phpbb dump i have (184,344 unique entries)

[anonfunction]

I also detected 1893 palindromes out of 350064 total lines. Finally a (laughable) real-world use for my palindrome detection project[1].

[1] https://github.com/montanaflynn/palindromes/

Edit: I also pulled some more stats out of just the passwords:

  Total characters: 2938676
  Average character count: 8.39544955889747
  Median character count: 6
  Maximum character count: 294

[ryan-c]

Sorry about the formatting there sucking. :-(

[machrider]

If you're running an ssh server that allows password authentication, make sure you're also running fail2ban.[1] Too many failed login attempts will block the IP (at an iptables level) for a configurable time period.

[1]: http://www.fail2ban.org/wiki/index.php/Main_Page

[jlgaddis]

On the BSDs, you can use "pf" to do this as well with the (minor) advantage that it doesn't require installing another piece of software.

[ryan-c]

I like pam_shield, personally.

https://github.com/jtniehof/pam_shield

Back in the day, disabling password auth but leaving keyboard_interactive on would stop a lot of these things, but I don't think that's true any more.

[trashcan]

http://www.cvedetails.com/vulnerability-list/vendor_id-5567/...

Probably best to just whitelist SSH to known IPs.

[joshavant]

If you're going for a security plan of obscurity (which, IMO, is what fail2ban is), I'd just change the SSH port, instead.

[hoers]

You also might want to consider changing your SSH Port

http://danielmiessler.com/blog/security-and-obscurity-does-c...

[dsl]

I'll save you the time of downloading the full results.

'hunter2' is in the list.

[VonGuard]

How come when I type "hunter2" it comes up "*"?

[ryan-c]

I wonder what's up with all the super long entries in there. Bugs in the bots?

[pdoconnell]

I'd guess that they're unique passwords taken from plain text password dumps that ended up in dictionaries.

[korzun]

It looks like ever wrote the scanner (that hit this honeypot) thought it would be a great idea to count on instances where terminal becomes laggy/crashes during a password change.

Adminstrator would then set a new password by an accident.

My theory anyways.

[gburt]

Wait, who is logging SSH passwords? Is this an intentional attack on OpenSSH Portable or is it a honeypot?

[wglb]

Hang any SSHD on the internet, and within minutes you get these attempts. You can choose to log the passwords if you like and this is what you would see.

[w8rbt]

Sheep dogs and wolves. The sheep have no idea. If you are asking the question, take a deep breath and say, "bah".

[jamiesonbecker]

I just don't know why people still use passwords with SSH anyway! (ie userify and stuff)

[imron]

Not sure why you're getting downvotes. I use key authentication for all my SSH needs.

If it's important enough to still need a password on top of that, the password can go on the key.

[lucaspiller]

At work we have to send data to a few third parties, it's pretty much up to them how they set up their end. I think everything is using SFTP at least, but a few still have passwords rather than keys. The accounts are restricted so you can't get a full shell though. My guess is these systems are designed by non-technical people who don't really understand the issues.

[sebastianavina]

well, for generating/uploading your key, you need a password.

[ytch]

It's just a honeypot, not a real server with password-based auth.

[dmix]

Who is proposing using passwords for SSH is a good idea? This is a honeypot.

[uzonite]

https://home.regit.org/2014/06/pshitt-collect-passwords-used...

[feld]

Use 2 factor auth with ssh via Yubikey or TOTP and it doesn't matter if they try to brute force you

[mrsteveman1]

I'm considering using those yubikey modes for ssh or local login on certain servers and in certain situations, though it requires some changes on each server to enable it.

I'm quite fond of the Yubikey NEO's openpgp applet paired with gpg-agent's ability to act as a compatible ssh-agent, allows standard SSH key login to any server with no server changes at all. I love the idea of my GPG and SSH key being truly portable in a very reasonably sized formfactor as well.

[peteretep]

Really no passwords with spaces in them, or a data-preparation error?

[peteretep]

I would be curious to know why this got downvoted. I went looking for "correct horse battery staple" and then realized that apparently the bots hadn't tried any passwords with spaces in them, but also that the patch uses spaces as a delimiter...

[Terretta]

Defeat shoulder surfers -- just use n spaces and m spaces to spell your password in morse code, appearing as all spaces.

[tedunangst]

Damn! I was certain nobody would guess my password of eight commas.

[byuu]

Shit!! Someone guessed my password as well, on line 1120!

    000000.000000000**0000000000000000000ooooo000111222333000OOO00OO0O0O0011447700384zxh.007Martin00idc805188..e0102030114110123.01234.01234.*012345601234567.*0123456789!@0123lhb0123014785236901601hr0205\\023022-58810235025516700270301fjfzw1=-03110368350037804047

I thought for sure a 260-character password with 1,560 bits of entropy would be sufficient. I better go change it right away :O

[jijji]

use ssh keys or use iptables whitelisting on all your boxes

[byuu]

Alternatively or in addition, add a firewall rule to permanently ban any IPs after too many failed attempts or simultaneous connections, make sure root login is disabled, and/or put sshd on a non-standard port (I find the last one a bit of security theater, but it will reduce some wasted traffic if nothing else.) Here's my pf rule for ssh (brute force filter):

    table <sshbans> persist
    block quick from <sshbans>
    pass quick proto tcp from any to any port ssh \
      flags S/SA keep state \
      (max-src-conn 15, max-src-conn-rate 5/3, \
      overload <sshbans> flush global)

Raise the values a bit if you have other SSH users on your box.

I get about 50 new bans a day. It's pretty much guaranteed if you have a server on the web with port 22 open, that bots will be attempting to brute-force it.