hack attempt foiled, but questions remain

[Saeven]

Hi everyone,

So I get up this morning and find a nice message from BFD stating that a certain IP had been banned outright because of repeated attempts.

This is nothing new, we have on occasion had a bot or two get stonewalled for attempting bad usernames/passwords a few times too many.

What's worrisome in this case, is that the attacker actually held 3 valid usernames that they cycled to get in a few more attempts than usual.

Checking the httpd access log, it appears that a dictionary was involved, where there are a great number of GET requests tilde type userspaces. The usernames that were used in the FTP attack, were indeed in the dictionary used during the GET requests (discovery process?). What's confusing however, is that tilde type access is turned off on our machines -- so how would the attacker have been able to confirm that the usernames were valid?

I notice also that in httpd's access_log, some names are repeated:

1.2.3.4 - - [06/Apr/2008:21:05:46 -0400] "GET /~username/ HTTP/1.1" 404 215 "-" "-"
1.2.3.4 - - [06/Apr/2008:21:05:46 -0400] "GET /~username/ HTTP/1.1" 404 215 "-" "-"

Any tips from experience most always appreciated.

Best always.
Alex

 

[Saeven]

Giving it more thought, would the proftpd engine only log usernames when they actually exist?

 

[YICHosting]

Are your usernames easily guessable. It may have been just a lucky robot, or perhaps it was someone who is already based on your server.

What I tend to do is add digits on the end of usernames such as 'joshc01', instead of just 'josh'.

Another thing to do is an IP audit, reference to doing a bit of research on the IP, just to see what you can dig up on it, does it seem like a 'dodgy' IP address?

Either way, remember of course that a good username and password will protect you from these dictionary attacks.

I would log onto SSH as well, just execute 'last', see if there is anything that should not be there. Just for your peace of mind.