nion's blog

A lot of people used to configure their ssh servers to listen to a port different from 22 to prevent their logs getting filled with login attempts by script kiddies. I just stumbled over sslh which is a very nice alternative to that in case you have a webserver running which supports ssl. sslh is also a good choice if you are behind a corporate firewall and ssh is filtered while SSL is probably not (and this is simpler than tunneling).

The idea is pretty simple but cool. The daemon listens on port 443 and depending on whether the client has written something into the socket (SSL) or not (SSH) after connecting the daemon "forwards" the connection to the listening service running on the same host. In case of SSL/HTTPS the client will send a request after the handshake and in case of ssh it won't. Pretty simple. I just did a quick test on one of my hosts and it seems to work great. The tool is written in C, consists of < 500 SLOC and the code looks clean to me. If you're using Debian you can just apt-get install it.

ssh is one of the programs I didn't really every read the manpage of (only to lookup stuff which I already knew is possible but forgot how). However there are some nice features you miss if you don't. Besides ControlMaster I just stumbled over another feature.

It is possible to add port forwarding on the fly without the need to open a new terminal and ssh connection.
ssh provides some escape characters to do some stuff in your current connection.
In the default setup the basic escape character is ~ (you can specify this by using EscapeChar in your configuration).

If you follow this by # character (and thus type ~#) you get a list of all forwarded connections.
Using ~C you can open an internal ssh shell that enables you to add and remove local/remote port forwardingsSome other more or less usefull escape sequences, have a look at man 1 ssh -> ESCAPE CHARACTERS

I just released a new version of yacpi. yacpi displays various ACPI information like batteries, ac status, thermal zones, fans and some information about CPU.

The new release is a complete rewrite based on libacpi (yacpi is now the 3rd tool using libacpi).
For those of you already using yacpi here are the relevant changes:

• yacpi now depends on libacpi, compile, install, ldconfig


• -m option removed, default is to display just the present batteries, use -n if you want to see not found items too


• Removed interactive delay input in ncurses interface, restart yacpi if you feel like changing it


• Samples are not needed anymore, I rewrote the algorithm to compute remaining time in libacpi


• Immediate reaction on user input in ncurses interface, thanks select(2), fuck halfdelay(3)


• New options for every feature, the default is to print everything but you can now decide what you exactly want to see, check yacpi -h for new parameters.

Quite some things changed so if you use yacpi in shell scripts, check for the new command line options.

Ncurses:


Plain-Text (yacpi -p):
| BAT0 = 100% discharging rtime 04:49 h | ac = off-line | THRM = 50 C | gov = ondemand | cpu = 600/1500 mhz

Have fun: http://www.ngolde.de/download/yacpi-3.0.tar.gz, http://www.ngolde.de/download/libacpi-0.2.tar.gz.

There are many servers using tools like fail2ban, denyhosts or blockhosts to defend their machine from different brute force attacks especially on ssh.

It is old news that this can lead to dangerous results because of stuff like IP spoofing.

The following paper on http://www.ossec.net/en/attacking-loganalysis.html which came across full-disclosure today shows how to do DoS attacks on a server running these tools using a technique very similar to SQL injections, called log injection.

This shows another time that it might be very self-desctructive if you use such tools.
So if you use one of the services, patch them, this attack can be run by everyone capable of open a shell and use netcat/telnet/foo.