Ok, this post is purely based on a home machine that runs the pfctl firewall on a FreeBSD 6.1 system. This machine runs ftp, ssh, and Apache which all can be accessed by the Internet.
When I set up my original machine, a 5.3 FreeBSD system. I noticed in my auth.log a boat load of brute force attacks. This was before I had put in place the pfctl firewall. After some reading, I put in place some firewall rules and also wrote a shell script to parse my auth.log looking for brute force attacks which then loads what I call an idiotblocker blacklist.
Watching the auth and the new entries to the blacklist, I found that almost every attempt was coming from an Asian country. Korea/China. I started doing some digging on the net, and found an article which basically backed up what I seen on my home machine. Except this person was explaining, that almost all of the spam he received was from these countries. This person had been inundated so much, that he blacklisted both china and Korea. He started a web page with a list of the cidr’s from these nations which he updated on a regular basis. There something like 800 of these cidr’s now.
Being of sound mind and body, and in that this is a home machine and not a business. I modified my script to download updates to this list every night and place the cidr’s in my black list. Now, I check my pfctl log every day. And every day, I have attempts from one of those ip’s from my idiot black list. Meaning, if I did not do the preventive cover my ass. I would have had a brute force attempt against me.
I’ve shut down my ssh so that you can only use public/private keys to log in. My ftp area’s, I have set up as read only and actually created a group id of ftp only so that those accounts can’t ssh in at all.
My question is. Am I the only one seeing this trend? The majority of probes and attacks generating from these countries/nations? If I was a business, I would seriously consider doing what I am doing now and only allow specific ip’s in that I know that I have dealings with.
Dan