Stopping SSH & FTP brute force attacks with IPFW

Brute force attacks are becoming more and more common in todays security landscape; if you receive security cron logs from your FreeBSD server you will know exactly what I mean. These attacks usually use automated software to try thousands of username and password combinations on SSH and FTP, continually aiming to find a weak account on your system and exploit it.

If an attacker can get access to one system account, that is the first step to doing some very bad things on your system, a nightmare for users and administrators. Luckily, there is a way to stop these attacks, and they’re freely available in the ports collection.

IPTables on Linux has the ability to dynamically add rules to block brute force attacks, however IPFW, a widely used firewall and packet filter, does not have an ability. We are forced to turn to look for 3rd party apps, lucky for us there are some very good ones out there, and we will look at 2 here.

Setup and Anonymous FTP server on FreeBSD

To test the speed differences between SFTP and FTP I decided to setup an anonymous FTP server on my trusted old 266 Mhz Celeron running FreeBSD 7.0.

The File Transfer Protocol (FTP) provides a simple and classic method for transferring files from one computer to another across the internet.

FreeBSD base install includes FTP server software, namely ftpd.

I'm fully aware of the security implications regarding FTP's transmission of usernames and passwords in clear text hence the choice of an anonymous FTP server in real-only mode.

Set up a virtual FTP server with pam-mysql

Setting up a virtual File Transfer Protocol (FTP) server with a database back end offers many benefits. By using a database, you can store a large number of users centrally, so it's easy to manage. It offers more security than traditional Unix OS authentication methods, because virtual users can access only the FTP server's resources, not the OS's. You can use the many Web tools that are available to easily install, configure, and manage the database back end. A virtual FTP server also supports some special characters, such as @, that FTP itself doesn't support, which can come in handy if, for example, your company uses its employees' email addresses for identity purposes.

(more...)