taskSavannah Administration - Tasks: task #4723, Submission of attacker blocking...

 
 

task #4723: Submission of attacker blocking PAM module

Submitter:  Maarten Deprez <maarten>
Submitted:  Fri 30 Sep 2005 08:23:23 PM UTC
   
 
Should Start On:  Thu 29 Sep 2005 10:00:00 PM UTC Should be Finished on:  Sun 09 Oct 2005 10:00:00 PM UTC
Category:  Project Approval Priority:  * 5 - Normal
Status:  Done Privacy:  Public
Assigned to:  kickino Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 02 Oct 2005 07:54:56 PM UTC, comment #1: 

Hi,
I'm evaluating the project you submitted for approval in Savannah.


The COPYING file should be a file not a link and the license should be intac - please don't write any personal comments into it.


Nevertheless, I have approved your project.  You will receive an automated e-mail containing detailed information about the approval.

Regards.


Sebastian Wieseler <kickino>
Fri 30 Sep 2005 08:23:23 PM UTC, original submission:  

A new project has been registered at Savannah
The project account will remain inactive until a site admin approve or discard the registration.


######### REGISTRATION ADMINISTRATION #########

While this item will be useful to track the registration process, approving or discarding the registration must be done using the specific "Group Administration" page, accessible only to site administrators, effectively logged as site administrators (superuser):

  <https://savannah.gnu.org/admin/groupedit.php?group_id=8009>


######### REGISTRATION DETAILS #########

Full Name:
----------
  attacker blocking PAM module

System Group Name:
-----------------
  pam-siegho

Type:
-----
  non-GNU software &amp; documentation

License:
--------
  GNU General Public License V2 or later

Description:
------------
  This project is a little pam module "pam_siegho" that defends by blocking a user/host when s/he repeatedly fails to login (such as an attacker who tries to guess a password).
For every visitor, the time of the last try and the "fear" is
remembered. Every time a visitor tries to get in
(when pam is called), the "fear" increases by one unit , and decreases
by one unit for each time the "fearyness" time passed since the last try. If after that the "fear" exceeds the limit, the visitor will not be allowed to come in and a configurable action will be executed. If the visitor, while he is barred out, tries to come in before the timeout passed, the time of the last try is updated (so he will have to wait the whole timeout again), but the action isn't done again. After a successful login, the guard becomes quiet about that visitor again (the fear becomes 0).

I already have a working version. Since i didn't find a PAM module like this to help defend our attacked ssh server, i wrote this (for blocking repeatedly trying users it exists, but as an attacker can specify any username, it wouldn't help at all and he would be able to blacklist any user he wants). It can be used to add the address of the attacker to a blacklist for use in firewall rules. Now i want to share my work.
You can get the source code from http://home.scarlet.be/~p1925850/pam_siegho.tar.gz

Other Software Required:
------------------------
  As this is a PAM module, it depends on PAM. I don't think there are other dependencies.


Maarten Deprez <maarten>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

Follow 3 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2005-10-02 kickino StatusNone Done
    Assigned toNone kickino
    Open/ClosedOpen Closed

Back to the top

Powered by Savane 3.13-caa5.
Corresponding source code