BayuSenoAdji.Com

Kemarin ada hacker yang masuk di salah satu server customer saya...dengan password root lagi....fiuh.

hacker tersebut create username admin dan meletakkan script ssh scan dan brute force ke server yang lain.

Ini Lognya

Sep  8 02:06:16 join2 sshd[5331]: Accepted password for root from 182.0.208.23 port 49169 ssh2

Lalu dia login sebagai admin dan menjalankan script ssh scan

Sep  8 07:08:34 join2 sshd[14256]: Accepted password for admin from 77.28.155.222 port 1488 ssh2

Dia menjalankan script yang menjalankan ssh-can sampai 600 connection

Akhirnya saya ganti password root dengan passowrd lebih complex dan menghapus user admin

Ini log saat user admin mencoba login lagi untuk login setelah user saya hapus

Sep  8 16:34:55 join2 sshd[23760]: input_userauth_request: invalid user adminSep  8 16:34:55 join2 sshd[23760]: Failed none for invalid user admin from 77.28.155.222 port 3433 ssh2Sep  8 16:34:59 join2 sshd[23760]: Failed password for invalid user admin from 77.28.155.222 port 3433 ssh2Sep  8 16:35:08 join2 last message repeated 2 timesSep  8 16:35:14 join2 sshd[23760]: Connection closed by 77.28.155.222Sep  8 16:35:24 join2 sshd[23896]: Invalid user admin from 77.28.155.222Sep  8 16:35:24 join2 sshd[23896]: input_userauth_request: invalid user adminSep  8 16:35:24 join2 sshd[23896]: Failed none for invalid user admin from 77.28.155.222 port 3434 ssh2Sep  8 16:35:28 join2 sshd[23896]: Failed password for invalid user admin from 77.28.155.222 port 3434 ssh2

Secara default username length dari OS AIX 5.3 adalah 9 karakter. Dalam tulisan ini akan di ubah username length menjadi 30 karakter

Berikut langkah-langkahnya

1.       Login as root,

2.       Lakukan command seperti di bawah:

 

#smitty chgsys

 

Change / Show Characteristics of Operating System

 

Type or select values in entry fields.

Press Enter AFTER making all desired changes.

 

                                                        [Entry Fields]

  System ID                                           0X0475A018B8AB8500

  Partition ID                                        0X0475A018B8AB8501

  Maximum number of PROCESSES allowed per user       [2048]                                                                +#

  Maximum number of pages in block I/O BUFFER CACHE  [20]                                                                  +#

  Maximum Kbytes of real memory allowed for MBUFS    [0]                                                                   +#

  Automatically REBOOT system after a crash           true                                                                 +

  Continuously maintain DISK I/O history              false                                                                +

  HIGH water mark for pending write I/Os per file    [0]                                                                   +#

  LOW water mark for pending write I/Os per file     [0]                                                                   +#

  Amount of usable physical memory in Kbytes          3932160

  State of system keylock at boot time                normal

  Enable full CORE dump                               false                                                                +

  Use pre-430 style CORE dump                         false                                                                +

  Pre-520 tuning compatibility mode                   disable                                                              +

  Maximum login name length at boot time             [30]                                                                  +#

  Stack Execution Disable (SED) Mode                  select                                                               +

  NFS4 ACL Compatibility Mode                         secure                                                               +

  ARG/ENV list size in 4K byte blocks                [128]                                                                 +#

  CPU Guard                                           enable                                                               +

  Processor capacity increment                        1.00

  Partition is capped                                 true

  Partition is dedicated                              true

  Entitled processor capacity                         2.00

  Minimum potential processor capacity                1.00

  Maximum potential processor capacity                2.00

  Variable processor capacity weight                  0