2007-09-22T17:13:00Ztag:blog.limedaley.com,2018:/isso/thread/post/using-tcpd-wrappers-with-pure-ftpdtag:blog.limedaley.com,2018:/isso/582/25352007-09-22T17:13:00ZJon Daley<p>I have to do regular FTP, because it is harder for most people to figure out how to do scp or sftp. I never use ftp myself, but most of my customers do. I suppose that Microsoft may have done the security world a favor by breaking FTP in the latest version of Internet Explorer - people will get used to using other clients, and then sftp or scp are about the same, from the non-technical user's viewpoint.</p> <p>The return value for them is the same whether they get a wrong password or wrong username. The trouble is that hackers have basically unlimited resources (by hacking into unprotected machines all over the world (probably mostly in the US) and then using those hacked machines as a large network of coordinated attack machines).</p> <p>When I said they occasionally get good usernames, that means out of all of their random guessing (and sometimes not so random - like &quot;salemsattic&quot;, or &quot;limedaley&quot;, etc.) sometimes they get real usernames, and then I have to count on the strength of my customers' passwords. If the hacker has a wrong username, I don't really care how many times he tries to login, as long as the CPU load stays low.</p> <p>Denyhosts is great because it only allows so many attempts before blocking the IP. I no longer have to even think about ssh hack attempts, because the hacker has about 15-30 seconds at most to guess a username and valid password. If he guesses wrong usernames (or worse, privileged usernames (that wouldn't have ssh access anyway, so it is kind of silly to guess those), he only has one attempt before his ip is blocked forever (and broadcast to a blacklist, so he will be blocked before he even tries anything on other people's machines).</p> <p>I'll try sending you an email, but I thought you didn't accept non-secured email, and I am not sure if I have the floppy with your key on it... :)</p>tag:blog.limedaley.com,2018:/isso/582/25342007-09-22T15:33:30Zmdrew<p>I think the bigger problem here is that there is apparently a way for hackers to guess something and determine from your server's behavior useful information like 'valid username'. I don't understand why it fails differently depending on whether a correct username is entered (assuming a bad password).</p> <p>P.S. send me an email so I can contact you.</p>tag:blog.limedaley.com,2018:/isso/582/25332007-09-22T15:14:22Zmdrew<p>Are you trying to server *really* big files? Why not scp or sftp?</p>tag:blog.limedaley.com,2018:/isso/582/25322007-09-19T20:34:05Zjondaley<p>For documentation purposes, my first attempts at the regular expressions were:</p> <p>SSHD_FORMAT_REGEX=.* (sshd.*:|\[sshd\]|pure-ftpd:) (?P.*)</p> <p>USERDEF_FAILED_ENTRY_REGEX=(?@(?P.*)) \[WARNING\] Authentication failed for user \[(?P.*)\]</p>