04 Jun 2007 SSH login Expect script to supply password
Expect script to supply root/admin password for remote SSH server and execute command.
(more…)
Posted by Hans-Henry Jakobsen
24 May 2007 Tunneling ports with SSH
Using -L on the command line with SSh will bind a remote port to a local one. For instance, if you wanted to tunnel the port for a remote desktop (usually 5901) to a local machine, you would type the following
ssh -L 5901:localhost:5901 remote_ip
You could then access your remote desktop by connecting your VNC client to port 5901 on the local machine, and the data for the remote desktop would be tunneled through the SSH connection.
Posted by Hans-Henry Jakobsen
18 May 2007 Transfer directories between computers using SSH and tar
When I need to transfer lots of files or directories between computers, I usually use tar and ssh together. Last time I used it however, I realized that perhaps not everyone knows how to do this. The procedure is very simple, and a full command could look something like this:
tar -cf - directory/ | ssh my.other.computer tar -xf - -C /destination/
If you want compression, just add z for gzip or j for bzip2 to both tar statements. This could be necessary if you are planning to do this over slow lines.
Posted by Hans-Henry Jakobsen
08 May 2007 SSH Dictionary Attack Prevention with iptables
It is ideal to slow down the SSH dictionary attack when the infested host started to brute force the SSH authentication. There are many scripts/user-land daemons that perform monitoring and blocking. I prefer to use something that has less demand in memory/CPU usage. IPTables module provides a kernel level solution with little overhead.
(more…)
Tags: firewall, iptables, ssh, syslog
Posted by Hans-Henry Jakobsen
07 May 2007 Monitoring /var/log/secure for break-in attempts
date >> ssh-intruders.log ; cat /var/log/secure | grep -i "sshd.*authentication failure" | sort | awk '{FS="rhost="; print $2}' | awk '{FS="user="; print $1}' | grep ".*\..*\." | grep -v "knownhost.com" | grep -v "knownhost2.com" | sort | uniq | while read i; do counter=`grep -i "$i" /var/log/secure | wc -l` ; echo "$counter attempts by $i"; done >> ssh-intruders.log ; cat ssh-intruders.log
Posted by Hans-Henry Jakobsen
