Stopping SSH Brute Force attacks with PF on FreeBSD

Most people know that port 22 is used for SSH communication and due to this common knowledge, you get people using scripts to test for weak passwords. If you look into your /var/log/auth.log and you see tons of fails/errors from users not on your system or from invalid passwords for root, it means you have people trying to break into your system. Truthfully, anyone that puts a system online with port 22 open will see this happen to them. It’s quite common and not direct attack against you, just scripts looking for IPs with port 22 open.

(more...)

FreeBSD Security Advisory

FreeBSD-SA-10:07.mbuf

FreeBSD Security Advisories

FreeBSD-SA-10:04.jail
FreeBSD-SA-10:06.nfsclient
FreeBSD-SA-10:05.opie

FreeBSD Security Advisories

FreeBSD-SA-10:01.bind
FreeBSD-SA-10:02.ntpd
FreeBSD-SA-10:03.zfs

FreeBSD Errata Notice

Since FreeBSD 8.0 was released, several stability and performance problems have been identified. This Errata Notice describes several fixes judged to be of particular importance, but low risk, to users with specific workloads or using specific features that trigger these problems.

Areas where problems are addressed include NFS, ZFS, Multicast networking, SCTP as well as the rename(2) syscall.

(more...)

FreeBSD Security Advisory

FreeBSD-SA-09:16.rtld
FreeBSD-SA-09:17.freebsd-update
FreeBSD-SA-09:15.ssl

FreeBSD Security Advisory

A short time ago a "local root" exploit was posted to the full-disclosure mailing list; as the name suggests, this allows a local user to execute arbitrary code as root.

Normally it is the policy of the FreeBSD Security Team to not publicly discuss security issues until an advisory is ready, but in this case since exploit code is already widely available I want to make a patch available ASAP. Due to the short timeline, it is possible that this patch will not be the final version which is provided when an advisory is sent out; it is even possible (although highly doubtful) that this patch does not fully fix the issue or introduces new issues -- in short,
use at your own risk (even more than usual).

(more...)

Securing Network Services with FreeBSD Jails

In this article by Christer Edwards, we will explore FreeBSD Jails. FreeBSD Jails are a kernel-level security mechanism which allows you to safely segregate processes within a sandbox environment. Jails are commonly used to secure production network services like DNS or Email by restricting what a process can access. In the case of a malicious attack on one service, all other Jailed processes would remain secure. FreeBSD Jails securely limits, in an administratively simple way, the amount of damage an attacker can do to a server.

FreeBSD Security Advisories

FreeBSD-SA-09:14.devfs
FreeBSD-SA-09:13.pipe
FreeBSD-EN-09:05.null

Attack on audio and video conferencing made easy

At the DEFCON conference, which drew to a close yesterday, the developers behind UCSniff presented version 3.0 of the VoIP sniffer, which includes two major new features. Firstly UCSniff, which is coded by Jason Ostrom and Arjun Sambamoorthy, now automatically detects video data transferred by VoIP telephones on the network, even when mixed with audio data. This allows the tool to record those audio and video components which occur in a typical 'unified communication environment'. Secondly, the software will in future also run on Windows – previously it was intended for use only in conjunction with the Linux-based BackTrack 3 penetration testing distribution. The developers plan to make the new version available for download shortly.

(more...)

FreeBSD Security Advisory

FreeBSD-SA-09:12.bind

RANCID on FreeBSD

RANCID is an application that allows you to track changes to network devices using a CVS tree. It will email you any changes made at scheduled intervals.

I’m going to implement RANCID on a FreeBSD box at work to track changes to my Cisco network devices. I’ve tested these directions on FreeBSD 6.3 and 7.2 and they should work on FreeBSD in general.

(more...)

FreeBSD Errata Notices

FreeBSD-EN-09:02.bce
FreeBSD-EN-09:03.fxp
FreeBSD-EN-09:04.fork

FreeBSD Security Advisory

FreeBSD-SA-09:11.ntpd
FreeBSD-SA-09:10.ipv6
FreeBSD-SA-09:09.pipe

FreeBSD Security Advisories

FreeBSD-SA-09:08.openssl
FreeBSD-SA-09:07.libc

IPsec VPN and NAT

At work we run a number of IPsec VPN tunnels to peers all over the world and we have always been concerned about possible RFC1918 address space collisions between our network and one of the other companies - it is surprising how often administrators keep the default 192.168.0.0/24 network! To the best of our knowledge on OpenBSD there was no good technical solution to the problem, and migrating the whole partner network to a unique address space is often politically unacceptable or too expensive.

(more...)

FreeBSD Security Advisory

FreeBSD-SA-09:01.lukemftpd
FreeBSD-SA-09:02.openssl

Stopping SSH & FTP brute force attacks with IPFW

Brute force attacks are becoming more and more common in todays security landscape; if you receive security cron logs from your FreeBSD server you will know exactly what I mean. These attacks usually use automated software to try thousands of username and password combinations on SSH and FTP, continually aiming to find a weak account on your system and exploit it.

If an attacker can get access to one system account, that is the first step to doing some very bad things on your system, a nightmare for users and administrators. Luckily, there is a way to stop these attacks, and they’re freely available in the ports collection.

IPTables on Linux has the ability to dynamically add rules to block brute force attacks, however IPFW, a widely used firewall and packet filter, does not have an ability. We are forced to turn to look for 3rd party apps, lucky for us there are some very good ones out there, and we will look at 2 here.

Best Backup Solutions for Desktop Linux

Despite common misconceptions, there are more solid backup solutions for desktop Linux than most people might suspect. Best of all, many of them are completely free with the code being open source. Some of them however, are not.

In this piece, I will give you a break down of each of them. How they can work in your specific situation, where you will find the applications, and I'll provide the needed details so that you can better decide what option is best for you.

Tripwire: Linux Host Based Intrusion Detection System

Tripwire is a host based Intrusion detection system for Linux. Tripwire monitors Linux system to detect and report any unauthorized changes to the files and directories. Once a baseline is created, tripwire monitors and detects, which file is added, which file is changed, what is changed, who changed it, and when it was changed. If the changes are legitimate, you can update the tripwire database to accept these changes.

This step by step instruction guide explains how to install and configure open source version of tripwire.