Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Here's the deal:

Over the last few weeks, I've noticed a large number of authentication failures for both the sshd service and the screensharingd service on my Mac OS X Mavericks server (running 10.9.2 (Build 13C64), Server v3.1.1 (Build 13S4140), Apache v2.2.26, and OpenSSL v1.0.1g (no Heartbleed for me, haha)). A quick sample of some server logs:

Apr 21 08:08:45 [myhost] sshd[6558]: Invalid user fls from 83.222.230.90
Apr 21 08:08:45 [myhost] sshd[6558]: input_userauth_request: invalid user fls [preauth]
Apr 21 08:08:45 [myhost] sshd[6558]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:47 [myhost] sshd[6560]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:48 [myhost] sshd[6568]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:49 [myhost] sshd[6571]: Invalid user x from 83.222.230.90
Apr 21 08:08:49 [myhost] sshd[6571]: input_userauth_request: invalid user x [preauth]
Apr 21 08:08:50 [myhost] sshd[6571]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:51 [myhost] sshd[6573]: Invalid user http from 83.222.230.90
Apr 21 08:08:51 [myhost] sshd[6573]: input_userauth_request: invalid user http [preauth]
Apr 21 08:08:51 [myhost] sshd[6573]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:52 [myhost] sshd[6578]: Invalid user mp3 from 83.222.230.90
Apr 21 08:08:52 [myhost] sshd[6578]: input_userauth_request: invalid user mp3 [preauth]
Apr 21 08:08:53 [myhost] sshd[6578]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:54 [myhost] sshd[6581]: Invalid user oracle from 83.222.230.90
Apr 21 08:08:54 [myhost] sshd[6581]: input_userauth_request: invalid user oracle [preauth]
Apr 21 08:08:54 [myhost] sshd[6581]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:55 [myhost] sshd[6584]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:57 [myhost] sshd[6589]: Invalid user r00t from 83.222.230.90
Apr 21 08:08:57 [myhost] sshd[6589]: input_userauth_request: invalid user r00t [preauth]
Apr 21 08:08:57 [myhost] sshd[6589]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:58 [myhost] sshd[6595]: Invalid user bin from 83.222.230.90
Apr 21 08:08:58 [myhost] sshd[6595]: input_userauth_request: invalid user bin [preauth]
Apr 21 08:08:59 [myhost] sshd[6595]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:09:00 [myhost] sshd[6597]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:09:01 [myhost] sshd[6600]: Invalid user sm0k3y from 83.222.230.90
Apr 21 08:09:01 [myhost] sshd[6600]: input_userauth_request: invalid user sm0k3y [preauth]
Apr 21 08:09:02 [myhost] sshd[6600]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:09:03 [myhost] sshd[6604]: Invalid user cgi from 83.222.230.90
Apr 21 08:09:03 [myhost] sshd[6604]: input_userauth_request: invalid user cgi [preauth]
Apr 21 08:09:03 [myhost] sshd[6604]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]

The screensharingd logs are as follows:

Apr 21 08:02:38 [myhost] screensharingd[5553]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 174.47.177.235 :: Type: VNC DES
Apr 21 08:02:57 --- last message repeated 7 times ---
Apr 21 08:28:42 [myhost] screensharingd[8520]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 208.71.217.153 :: Type: VNC DES
Apr 21 08:36:14 [myhost] screensharingd[9232]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 173.165.178.100 :: Type: VNC DES
Apr 21 08:43:34 [myhost] screensharingd[9928]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 5.135.101.206 :: Type: VNC DES
Apr 21 08:56:13 [myhost] screensharingd[11240]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 24.197.239.70 :: Type: VNC DES
Apr 21 08:56:34 [myhost] screensharingd[11273]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 24.197.239.70 :: Type: VNC DES
Apr 21 08:56:51 [myhost] screensharingd[11300]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 24.197.239.70 :: Type: VNC DES
Apr 21 08:56:58 --- last message repeated 1 time ---
Apr 21 09:29:15 [myhost] screensharingd[14752]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 75.150.95.108 :: Type: VNC DES
Apr 21 09:29:23 --- last message repeated 2 times ---
Apr 21 09:29:27 [myhost] screensharingd[14752]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 75.150.95.108 :: Type: VNC DES
Apr 21 09:29:33 --- last message repeated 1 time ---
Apr 21 09:29:59 [myhost] screensharingd[14819]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 75.150.95.108 :: Type: VNC DES
Apr 21 09:30:03 [myhost] screensharingd[14819]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 75.150.95.108 :: Type: VNC DES
Apr 21 09:30:13 --- last message repeated 2 times ---
Apr 21 09:30:14 [myhost] screensharingd[14819]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 75.150.95.108 :: Type: VNC DES
Apr 21 09:30:23 --- last message repeated 2 times ---
Apr 21 09:32:48 [myhost] screensharingd[15094]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 61.160.201.25 :: Type: VNC DES

Obviously, I could manually add firewall rules using /Applications/Server.app/Contents/ServerRoot/usr/libexec/afctl -a [ip-address], but that is both time-consuming and pretty dumb. I've tried using some of the tools offered by my MacPorts tree, but they don't seem to work, and I'm concerned that anything I install might be conflicting with the built-in firewall.

Is there software for OS X that will automate firewall changes in response to repeated failed attempts or perhaps some other way to reduce the risk of brute force log in attempts succeeding?

share|improve this question

migrated from serverfault.com Apr 22 at 9:26

This question came from our site for professional system and network administrators.

    
I don´t know what do you want exactly so I could give you only some advises: 1. Don´t connect a server directly to the internet - install a firewall in front of the server (different system, different operating system) and only allow the ports do you want to be accessible from the internet. 2. If you need to connect your server directly to the internet (again: bad decision) configure your firewall like Apple described in their support file 3. If you need to get the ssh and screensharing port (for example) from the internet let´s have a look at fail2ban - –  UsersUser Apr 22 at 10:33
1  
Matt - I'll ping the SF mods, but unless they want it back, it might need to get promoted / hosted / answered here. I've edited out some of the "meta" of the question. Welcome to the site, the SE way is to document what precicely you know/think so that others can help you over a sticking point. Asking for options / tools or votes generally is not seen as helpful. –  bmike Apr 25 at 21:53
    
OK - since it was closed already on SF, it would be a bit of an uphill battle to get that community to want it back. Let's see how it fares after a week and maybe I can put a bounty on it if it doesn't get a better answer than mine. –  bmike Apr 25 at 22:26

2 Answers 2

up vote 3 down vote accepted

If your server is on the public internet, it will get hundreds of automated log in attempts on whatever ports it listens. You will want to either set up an external firewall, use the existing ipfw/pfctl tools Apple ships or perhaps get a package like fail2ban which can be installed easily if you already have the homebrew tool.

You can test with ipfw and pfctl yourself and block a test IP from ssh and verify that there is no interference from Apple's firewall rules, but I've not experienced anyone that knows how to use the command line from breaking things if they have local access and know how to unconfigure a ruleset that has unintended consequences.

That would allow you to to have the firewall block repeated attempts after a threshold of failed attempts in a time range. It's not perfect, but can reduce the size of your log files and reduce the change someone will brute force an account or guess a common password.

This would be a good way to secure things if you can't use VPN or another firewall to reduce the number of listening ports your OS X server exposes to the internet in general.

share|improve this answer
    
fail2ban is one of the best tool to reply to automatic attacks, There is another one which gives me a very high ROI: simply change the ssh port. I'm using this deception method since Lion with an astounding success. Look here to start with: serverfault.com/a/67616 . –  daniel Azuelos Jul 5 at 19:17

Short answer: There is no option in any firewall tools to prevent brute force attacks. A firewall tool only could block/allow/mangle a connection (as I know).

A little bit longer answer: To prevent a brute force attack you need a tool that could measure how often (and how short the pauses between every try) a biunique source will connect a special destination on your server. One of these tool is fail2ban as I wrote in (my/the) first answer (converted from bmike into a comment).

All other answers that I already gave are always valid - please first check if it will necessary that you connect your server directly to internet.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.