Subj : Re: Hacker making all Mystic nodes "BUSY"
To   : Gandalf
From : Warpslide
Date : Tue Feb 14 2023 03:18 am

On 13 Feb 2023, Gandalf said the following...
 
 Ga> Greetings and Salutations!  I am having an issue with a hacker who trys
 Ga> to crack my system password eventually making all of my nodes busy so
 Ga> that users cannot login.

 Ga> something I can do other than removing the system password prompt to
 Ga> keep this from happening?

Check out botcheck.mps in your mystic/themes/default/scripts directory:

[ begin quote botcheck.mps ]
BOTCHECK.MPS: Example script to force users to immediately press ESCAPE
              twice upon connection within 15 seconds or else their
              connection will be closed.

To install: Copy this as "connect.mps" in your theme's script directory
and then use MPLC to compile it (mplc -T will compile all theme scripts)
[ end quote botcheck.mps ]

You may want to paste this in right after "Begin" in the script:
  If ACS('OS') Then break

This will skip asking people to press ESC twice if they connect via SSH as they'd already be authenticated.


I have this in place along with blocking a bunch of countries with iptables:

ipset create block4 hash:net
ipset create block6 hash:net family inet6
iptables -A INPUT -m set --match-set block4 src -j DROP
iptables -A OUTPUT -m set --match-set block4 dst -j DROP
ip6tables -A INPUT -m set --match-set block6 src -j DROP
ip6tables -A OUTPUT -m set --match-set block6 dst -j DROP


[ begin geoip.sh ]
#!/bin/bash
tmpdir=`mktemp -d`
cd $tmpdir

countries=("ru" "ua" "by" "bg" "br" "cn" "hk" "kr" "kp" "ir")

for i in ${countries[@]}; do
  curl -f -s -k https://www.ipdeny.com/ipblocks/data/aggregated/$i-aggregated.zone >>  block4.zone
  curl -f -s -k https://www.ipdeny.com/ipv6/ipaddresses/aggregated/$i-aggregated.zone >>  block6.zone
done

ipset flush
for i in $( cat block4.zone ); do ipset -A block4 $i; done
for i in $( cat block6.zone ); do ipset -A block6 $i; done

ipset save > /etc/iptables/ipsets

rm -f $tmpdir/*
rmdir $tmpdir
[ end geoip.sh ]


Jay

.... When cheese gets its picture taken, what does it say?

--- Mystic BBS v1.12 A49 2023/01/27 (Linux/64)
 * Origin: Northern Realms | bbs.nrbbs.net | 289-424-5180 (21:3/110)

.