|David Wolfskill||Mar 21, 2007 12:45 pm|
|Tadas Miniotas||Mar 21, 2007 1:18 pm|
|David Wolfskill||Mar 21, 2007 1:32 pm|
|Bill Moran||Mar 21, 2007 1:37 pm|
|Richard Jones||Mar 21, 2007 2:12 pm|
|Dan Lukes||Mar 21, 2007 2:27 pm|
|Bill Moran||Mar 21, 2007 2:29 pm|
|W. D.||Mar 21, 2007 2:44 pm|
|Eygene Ryabinkin||Mar 21, 2007 2:50 pm|
|Julian Elischer||Mar 21, 2007 11:21 pm|
|Carl Makin||Mar 21, 2007 11:22 pm|
|Volker||Mar 22, 2007 1:32 pm|
|Eygene Ryabinkin||Mar 23, 2007 11:36 am|
|Subject:||Reality check: IPFW sees SSH traffic that sshd does not?|
|From:||David Wolfskill (dav...@catwhisker.org)|
|Date:||Mar 21, 2007 12:45:15 pm|
This note is essentially a request for a reality check.
I use IPFW & natd on the box that provides the interface between my home networks and the Internet; the connection is (static) residential DSL.
I configured IPFW to accept & log all SSH "setup" requests, and use natd to forward such requests to an internal machine that only accepts public key authentication; that machine's sshd logs SSH-specific information.
Usually, the SSH setup requests logged by IPFW correspond with sshd activity (whether authorized or not); I expect this.
What has come as rather a surprise, though, is that every once in a while, I will see IPFW logging setup requests that have no corresponding sshd activity logged at all.
This morning (in reviewing the logs from yesterday), I found a set of 580 such setup requests logged from Mar 20 19:30:06 - Mar 20 19:40:06 (US/Pacific; currently 7 hrs. west of GMT/UTC), each from 18.104.22.168 (part of a VAULT-NETWORKS netblock). The sshd on the internal machine never logged anything corresponding to any of this.
I cannot imagine any valid reason for SSH traffic to my home to be originating from that netblock. I perceive nothing comforting in the lack of sshd logging the apparent activity.
Lacking rationale to do otherwise, I interpret this as an attack: I've modified my IPFW rules to include a reference to a table rather early on; IP addresses found in this table are not permitted to establish SSH sessions to my networks, and the attempted activity is logged. (I also use the same technique on my laptop and my work desktop, and -- manually, so far -- keep the tables in question synchronized.)
I have accordingly added the VAULT-NETWORKS netblocks to this table, pending either information or reason to remove those specifications.
Granted, there appears to be no access granted, but the lack of sshd logging makes me nervous.
Have other folks noticed this type of behavior? Have I gone off the deep end of paranoia? (Yes, I expect that some of "them" really are out to get me. What can I say; it's an occupational hazard.)
-- David H. Wolfskill dav...@catwhisker.org Believe SORBS at your own risk: 22.214.171.124 has been static since Aug 1999.
See http://www.catwhisker.org/~david/publickey.gpg for my public key.