topic Is this an ssh brute force attack? in Network Security

Is this an ssh brute force attack?

rweir0001 — Tue, 12 Mar 2019 05:51:18 GMT

My ASA is sending these alerts to my syslog server and I was hoping that someone could either confirm or deny that this may be an ssh brute force attack. I do realize that it may be indicative of some other separate problem, but the excessive use of failed login names makes me suspicious (this is only about a third of them):

6|Apr 28 2015|12:51:02|315011|72.167.47.43||||SSH session from 72.167.47.43 on interface outside2 for user "administraator" disconnected by SSH server, reason: "Internal error" (0x00)

6|Apr 28 2015|12:50:57|315011|72.167.47.43||||SSH session from 72.167.47.43 on interface outside2 for user "sql" disconnected by SSH server, reason: "Internal error" (0x00)

6|Apr 28 2015|12:50:52|315011|72.167.47.43||||SSH session from 72.167.47.43 on interface outside2 for user "sshd" disconnected by SSH server, reason: "Internal error" (0x00)

6|Apr 28 2015|12:50:47|315011|72.167.47.43||||SSH session from 72.167.47.43 on interface outside2 for user "admin" disconnected by SSH server, reason: "Internal error" (0x00)

6|Apr 28 2015|12:50:42|315011|72.167.47.43||||SSH session from 72.167.47.43 on interface outside2 for user "info" disconnected by SSH server, reason: "Internal error" (0x00)

6|Apr 28 2015|12:50:37|315011|72.167.47.43||||SSH session from 72.167.47.43 on interface outside2 for user "root" disconnected by SSH server, reason: "Internal error" (0x00)

6|Apr 28 2015|12:50:32|315011|72.167.47.43||||SSH session from 72.167.47.43 on interface outside2 for user "root" disconnected by SSH server, reason: "Internal error" (0x00)

Check these below 2 of them

Mark Malone — Wed, 29 Apr 2015 07:56:11 GMT

Check these below 2 of them supply potential fixes one states its a bug for certain platform , 2 of them are related to 8.4 are you running that ios, have you checked the caveats in the release guide for your platform to match against known bugs ?

http://networkengineering.stackexchange.com/questions/1438/why-do-i-get-a-timeout-when-i-connect-via-ssh-to-a-cisco-asa-even-though-manage

https://ccieplayground.wordpress.com/2014/04/20/asa-ssh-internal-error-and-misleading-messages/

https://tools.cisco.com/bugsearch/bug/CSCul04610/?referring_site=bugquickviewclick

HTH

Hi,I would not necessarily

Vibhor Amrodia — Wed, 29 Apr 2015 08:39:41 GMT

Hi,

I would not necessarily say that this might be a defect.

I think what you should try to do is to check for the logs for the ip address of the source which is creating the SSH connection to the ASA device.

Check if that is legitimate. If yes , narrow down the SSH on that specific interface to specific hots only.

ssh <Ip address> <mask> <interface>

Thanks and Regards,

Vibhor Amrodia

Thanks, markmalone2008! We

rweir0001 — Wed, 29 Apr 2015 15:51:46 GMT

Thanks, markmalone2008! We are running v8.2 ans our aaa authentication looks like it is configured correctly.

Thanks, Vibhor. We get

rweir0001 — Wed, 29 Apr 2015 16:00:17 GMT

Thanks, Vibhor. We get slammed with brute ssh force attacks from different IPs indicated by message event IDs like 113005 and 611102. I'm keeping a lookout for offending IPs like the one that generated the 315011 logs above to see if they also generate logs that clearly indicate an ssh attack. If they do, I'll probably just assume that the 315011 events are due to ssh attacks as well.

My other question would be how to remedy the problem of all these ssh brute force attacks? I'm not sure if I want to configure aaa lockouts on the ASA, and blacklisting multiple IPs doesn't seem practical....

Hi,In case you see a SSH

Vibhor Amrodia — Wed, 29 Apr 2015 16:28:19 GMT

Hi,

In case you see a SSH Attack , the best and most effective solution would be to only allow specific IP addresses to allow to ssh on the ASA device interface as this should only be open to the ADMINS and on the secured interface as a best practice.

We can create specific rules(COntrol Plane ACL to block port 22) for the Attacker IP/Subnets.

Thanks and Regards,

Vibhor Amrodia

Thanks. That is a good idea.

rweir0001 — Wed, 29 Apr 2015 16:31:12 GMT

Thanks. That is a good idea. I'll look into that.