2

Here's the deal:

Over the last few weeks, I've noticed a large number of authentication failures for both the sshd service and the screensharingd service on my Mac OS X Mavericks server (running 10.9.2 (Build 13C64), Server v3.1.1 (Build 13S4140), Apache v2.2.26, and OpenSSL v1.0.1g (no Heartbleed for me, haha)). A quick sample of some server logs:

Apr 21 08:08:45 [myhost] sshd[6558]: Invalid user fls from 83.222.230.90
Apr 21 08:08:45 [myhost] sshd[6558]: input_userauth_request: invalid user fls [preauth]
Apr 21 08:08:45 [myhost] sshd[6558]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:47 [myhost] sshd[6560]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:48 [myhost] sshd[6568]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:49 [myhost] sshd[6571]: Invalid user x from 83.222.230.90
Apr 21 08:08:49 [myhost] sshd[6571]: input_userauth_request: invalid user x [preauth]
Apr 21 08:08:50 [myhost] sshd[6571]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:51 [myhost] sshd[6573]: Invalid user http from 83.222.230.90
Apr 21 08:08:51 [myhost] sshd[6573]: input_userauth_request: invalid user http [preauth]
Apr 21 08:08:51 [myhost] sshd[6573]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:52 [myhost] sshd[6578]: Invalid user mp3 from 83.222.230.90
Apr 21 08:08:52 [myhost] sshd[6578]: input_userauth_request: invalid user mp3 [preauth]
Apr 21 08:08:53 [myhost] sshd[6578]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:54 [myhost] sshd[6581]: Invalid user oracle from 83.222.230.90
Apr 21 08:08:54 [myhost] sshd[6581]: input_userauth_request: invalid user oracle [preauth]
Apr 21 08:08:54 [myhost] sshd[6581]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:55 [myhost] sshd[6584]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:57 [myhost] sshd[6589]: Invalid user r00t from 83.222.230.90
Apr 21 08:08:57 [myhost] sshd[6589]: input_userauth_request: invalid user r00t [preauth]
Apr 21 08:08:57 [myhost] sshd[6589]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:08:58 [myhost] sshd[6595]: Invalid user bin from 83.222.230.90
Apr 21 08:08:58 [myhost] sshd[6595]: input_userauth_request: invalid user bin [preauth]
Apr 21 08:08:59 [myhost] sshd[6595]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:09:00 [myhost] sshd[6597]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:09:01 [myhost] sshd[6600]: Invalid user sm0k3y from 83.222.230.90
Apr 21 08:09:01 [myhost] sshd[6600]: input_userauth_request: invalid user sm0k3y [preauth]
Apr 21 08:09:02 [myhost] sshd[6600]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]
Apr 21 08:09:03 [myhost] sshd[6604]: Invalid user cgi from 83.222.230.90
Apr 21 08:09:03 [myhost] sshd[6604]: input_userauth_request: invalid user cgi [preauth]
Apr 21 08:09:03 [myhost] sshd[6604]: Received disconnect from 83.222.230.90: 11: Bye Bye [preauth]

The screensharingd logs are as follows:

Apr 21 08:02:38 [myhost] screensharingd[5553]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 174.47.177.235 :: Type: VNC DES
Apr 21 08:02:57 --- last message repeated 7 times ---
Apr 21 08:28:42 [myhost] screensharingd[8520]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 208.71.217.153 :: Type: VNC DES
Apr 21 08:36:14 [myhost] screensharingd[9232]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 173.165.178.100 :: Type: VNC DES
Apr 21 08:43:34 [myhost] screensharingd[9928]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 5.135.101.206 :: Type: VNC DES
Apr 21 08:56:13 [myhost] screensharingd[11240]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 24.197.239.70 :: Type: VNC DES
Apr 21 08:56:34 [myhost] screensharingd[11273]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 24.197.239.70 :: Type: VNC DES
Apr 21 08:56:51 [myhost] screensharingd[11300]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 24.197.239.70 :: Type: VNC DES
Apr 21 08:56:58 --- last message repeated 1 time ---
Apr 21 09:29:15 [myhost] screensharingd[14752]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 75.150.95.108 :: Type: VNC DES
Apr 21 09:29:23 --- last message repeated 2 times ---
Apr 21 09:29:27 [myhost] screensharingd[14752]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 75.150.95.108 :: Type: VNC DES
Apr 21 09:29:33 --- last message repeated 1 time ---
Apr 21 09:29:59 [myhost] screensharingd[14819]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 75.150.95.108 :: Type: VNC DES
Apr 21 09:30:03 [myhost] screensharingd[14819]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 75.150.95.108 :: Type: VNC DES
Apr 21 09:30:13 --- last message repeated 2 times ---
Apr 21 09:30:14 [myhost] screensharingd[14819]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 75.150.95.108 :: Type: VNC DES
Apr 21 09:30:23 --- last message repeated 2 times ---
Apr 21 09:32:48 [myhost] screensharingd[15094]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 61.160.201.25 :: Type: VNC DES

Obviously, I could manually add firewall rules using /Applications/Server.app/Contents/ServerRoot/usr/libexec/afctl -a [ip-address], but that is both time-consuming and pretty dumb. I've tried using some of the tools offered by my MacPorts tree, but they don't seem to work, and I'm concerned that anything I install might be conflicting with the built-in firewall.

Is there software for OS X that will automate firewall changes in response to repeated failed attempts or perhaps some other way to reduce the risk of brute force log in attempts succeeding?

Improve this question
3
  • I don´t know what do you want exactly so I could give you only some advises: 1. Don´t connect a server directly to the internet - install a firewall in front of the server (different system, different operating system) and only allow the ports do you want to be accessible from the internet. 2. If you need to connect your server directly to the internet (again: bad decision) configure your firewall like Apple described in their support file 3. If you need to get the ssh and screensharing port (for example) from the internet let´s have a look at fail2ban -
    – UsersUser
    Commented Apr 22, 2014 at 10:33
  • 1
    Matt - I'll ping the SF mods, but unless they want it back, it might need to get promoted / hosted / answered here. I've edited out some of the "meta" of the question. Welcome to the site, the SE way is to document what precicely you know/think so that others can help you over a sticking point. Asking for options / tools or votes generally is not seen as helpful.
    – bmike ♦
    Commented Apr 25, 2014 at 21:53
  • OK - since it was closed already on SF, it would be a bit of an uphill battle to get that community to want it back. Let's see how it fares after a week and maybe I can put a bounty on it if it doesn't get a better answer than mine.
    – bmike ♦
    Commented Apr 25, 2014 at 22:26

3 Answers 3

Reset to default
4

If your server is on the public internet, it will get hundreds of automated log in attempts on whatever ports it listens. You will want to either set up an external firewall, use the existing ipfw/pfctl tools Apple ships or perhaps get a package like fail2ban which can be installed easily if you already have the homebrew tool.

You can test with ipfw and pfctl yourself and block a test IP from ssh and verify that there is no interference from Apple's firewall rules, but I've not experienced anyone that knows how to use the command line from breaking things if they have local access and know how to unconfigure a ruleset that has unintended consequences.

That would allow you to to have the firewall block repeated attempts after a threshold of failed attempts in a time range. It's not perfect, but can reduce the size of your log files and reduce the change someone will brute force an account or guess a common password.

This would be a good way to secure things if you can't use VPN or another firewall to reduce the number of listening ports your OS X server exposes to the internet in general.

Improve this answer
2
  • 1
    fail2ban is one of the best tool to reply to automatic attacks, There is another one which gives me a very high ROI: simply change the ssh port. I'm using this deception method since Lion with an astounding success. Look here to start with: serverfault.com/a/67616 .
    – athena
    Commented Jul 5, 2014 at 19:17
  • @danielAzuelos Even better is a proper network firewall where you only allow known IP ranges in or translate from non-standard ports to standard ones, but your comment is an excellent second step. I’ve even seen systems algorithmically shift the port on which ssh listens - sometimes as rapidly as every minute to 5 and automate a lookup for known good requesters to know on which door to knock at any specific moment.
    – bmike ♦
    Commented Jun 15, 2019 at 16:33
0

I don´t know what do you want exactly so I could give you only some advises:

  1. Don´t connect a server directly to the internet - install a firewall in front of the server (different system, different operating system) and only allow the ports do you want to be accessible from the internet.

  2. If you need to connect your server directly to the internet (again: bad decision) configure your firewall like Apple described in their support file

  3. If you need to get the ssh and screensharing port (for example) from the internet let´s have a look at fail2ban - they have a wiki entry for OSX server

And please: edit your question to let us know what do you want exactly.

Improve this answer
1
  • You've posted this as an answer, which is only for things that directly answer the question asked.
    – bmike ♦
    Commented Apr 25, 2014 at 21:56
0

Short answer: There is no option in any firewall tools to prevent brute force attacks. A firewall tool only could block/allow/mangle a connection (as I know).

A little bit longer answer: To prevent a brute force attack you need a tool that could measure how often (and how short the pauses between every try) a biunique source will connect a special destination on your server. One of these tool is fail2ban as I wrote in (my/the) first answer (converted from bmike into a comment).

All other answers that I already gave are always valid - please first check if it will necessary that you connect your server directly to internet.

Improve this answer
1
  • I’ll I delete your other answer so people can see / vote for them. If you want to combine them and can’t delete one - please flag for assistance.
    – bmike ♦
    Commented Jun 15, 2019 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .