http://ubuntuone.com/6LUt1E8ClN1HKbkzgr2CLT

I am running a few Ubuntu installations connected to the Internet. As you may know, once machine is connected to the Internet, it is subject to various hacking attempts, both automatic and manual.

The most widespread attack vector for *nix machines is SSH brute-forcing. I once became a victim of such attack and now all my machines are using SSH public key authentication only. I was curious what passwords the attackers were using so I came up with a simple idea of password collection.

If you wanted to have it the quick way, using PAM storepw, then this is not going to work that good, you will need to create a local account for every account used to brute-force you. This can end up being a lot of work.

Alternatively you can patch OpenSSH to store the passwords in the log files. Since I did not want to set up a new machine for the sole purpose of password logging I decided to go an easier route.

Twisted is a python-based framework for programming network applications. And it turns out that they have implemented a SSH protocol too.

So my starting point was the blog post by George Notaras about RapidSSH. I only needed the passwords to be stored so I removed chunks of code that dealt with keys and added the code that writes logins and passwords to a gdbm database.

Here's the code:

#!/usr/bin/env python import sys import gdbm from twisted.conch.unix import UnixSSHRealm from twisted.cred import portal from twisted.cred.credentials import IUsernamePassword from twisted.cred.checkers import ICredentialsChecker from twisted.cred.error import UnauthorizedLogin from twisted.conch.ssh import factory, userauth, connection, keys, session from twisted.internet import reactor, defer from zope.interface import implements from twisted.python import log # Logging was disabled # log.startLogging(sys.stderr) # Server-side public and private keys. These are the keys found in # sshsimpleserver.py. Make sure you generate your own using ssh-keygen! publicKey = 'ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEArzJx8OYOnJmzf4tfBEvLi8DVPrJ3/c9k2I/Az64fxjHf9imyRJbixtQhlH9lfNjUIx+4LmrJH5QNRsFporcHDKOTwTTYLh5KmRpslkYHRivcJSkbh/C+BR3utDS555mV' privateKey = """-----BEGIN RSA PRIVATE KEY----- MIIByAIBAAJhAK8ycfDmDpyZs3+LXwRLy4vA1T6yd/3PZNiPwM+uH8Yx3/YpskSW 4sbUIZR/ZXzY1CMfuC5qyR+UDUbBaaK3Bwyjk8E02C4eSpkabJZGB0Yr3CUpG4fw vgUd7rQ0ueeZlQIBIwJgbh+1VZfr7WftK5lu7MHtqE1S1vPWZQYE3+VUn8yJADyb Z4fsZaCrzW9lkIqXkE3GIY+ojdhZhkO1gbG0118sIgphwSWKRxK0mvh6ERxKqIt1 xJEJO74EykXZV4oNJ8sjAjEA3J9r2ZghVhGN6V8DnQrTk24Td0E8hU8AcP0FVP+8 PQm/g/aXf2QQkQT+omdHVEJrAjEAy0pL0EBH6EVS98evDCBtQw22OZT52qXlAwZ2 gyTriKFVoqjeEjt3SZKKqXHSApP/AjBLpF99zcJJZRq2abgYlf9lv1chkrWqDHUu DZttmYJeEfiFBBavVYIF1dOlZT0G8jMCMBc7sOSZodFnAiryP+Qg9otSBjJ3bQML pSTqy7c3a2AScC/YyOwkDaICHnnD3XyjMwIxALRzl0tQEKMXs6hH8ToUdlLROCrP EhQ0wahUTCk1gKA4uPD6TMTChavbh4K63OvbKg== -----END RSA PRIVATE KEY-----""" class NullDatabase: """Authentication/authorization backend using nothing """ credentialInterfaces = IUsernamePassword, implements(ICredentialsChecker) def __init__(self): self.db = gdbm.open("/home/rtg/twisted-ssh-passwords.db", "cus") def requestAvatarId(self, credentials): key = "%s:%s" % ( credentials.username, credentials.password) if key in self.db: count = int(self.db[key]) else: count = 0 self.db[key] = str(count + 1) return defer.fail(UnauthorizedLogin("invalid password")) class UnixSSHdFactory(factory.SSHFactory): publicKeys = { 'ssh-rsa': keys.Key.fromString(data=publicKey) } privateKeys = { 'ssh-rsa': keys.Key.fromString(data=privateKey) } services = { 'ssh-userauth': userauth.SSHUserAuthServer, 'ssh-connection': connection.SSHConnection } # Components have already been registered in twisted.conch.unix portal = portal.Portal(UnixSSHRealm()) portal.registerChecker(NullDatabase()) UnixSSHdFactory.portal = portal if __name__ == '__main__': reactor.listenTCP(5022, UnixSSHdFactory()) reactor.run()

As you can see, the database is created in /home/rtg/ which is my home directory, you will want to change the path.

The script itself runs on port 5022 and I redirected the access to 22 port on the router to go to port 5022 and redirected the real SSH port on WAN. This way my LAN machines are still able to access the regular SSH port.

The database is created but it is in a binary form, we need to make it readable:

#!/usr/bin/env python import gdbm import sys from datetime import datetime print """# Updated: %s # SSH creds for attack attempts on my server. # If your password is listed here, CHANGE IT RIGHT NOW #""" % (datetime.now().isoformat()) db = gdbm.open(sys.argv[1]) print "# %d entries\n#" % (len(db.keys()), ) for key in sorted(db.keys()): print "%s" % (key, )

This outputs the whole database in a plaintext format, the usage is simply

$ dump-passwords.py /path/to/passwords.db > passwords.txt

And this is what gets into passwords.txt:

# Updated: 2012-02-19T01:00:01.626648
# SSH creds for attack attempts on my server.
# If your password is listed here, CHANGE IT RIGHT NOW
#
# 16508 entries
#
!@#$%:!@#$%
!@#$%^&*:!@#$%^&*
!@#$%^&:!@#$%^&
!@#$%^:!@#$%^
*:*
.com:.com
.http:.http
0987654321:0987654321
0:0
100:100

This file is updated every day with the new entries of user:password that were attempted on my fake SSH server. Feel free to use this list for any purpose (e.g. compiling a cracklib dictionary).

while not keypressed

SSH attack passwords