2

I'd like to automatically block the IPs of requests that are providing a fake ssh certificate or key

ssh_dispatch_run_fatal: Connection from XX.XXX.XXX.XX port XXXXX: Connection corrupted [preauth]

Is there a way to ban it or filter it automatically? Actually I'm processing it manually.

Improve this question
5
  • 1
    How do you get the message ssh_dispatch_run_fatal , do you run a command or cat some file? Because I think about monitoring the incoming requests and if the message ssh_dispatch_run_fatal is present than parse it to get the IP and block it.
    – Edgar Magallon
    Dec 2, 2022 at 23:39
  • I'm supposing someone tries to log in through ssh using a fake certificate, and that's how this message is being added to the auth.log
    – mario ruiz
    Dec 6, 2022 at 2:51
  • 1
    It would be interesting if some command/app could monitor the ssh logs and trigger some script/action when a condition is found. I searched for something like this but did not found anything.
    – Edgar Magallon
    Dec 6, 2022 at 5:19
  • 1
    I don't know much about ssh so I'm not sure how can I get ssh_dispatch_run_fatal. But I can watch ssh logs by using tail -f /var/log/auth.log or sudo journalctl --system --follow -u ssh.service. So I guess you can pipe the journal output and search for ssh_dispatch_run_fatal like this: sudo journalctl --system --follow -u ssh.service | while read -r line; do [[ echo "$line" | grep ssh_dispatch_run_fatal ]] && ..... ; done
    – Edgar Magallon
    Dec 6, 2022 at 5:23
  • 1
    If [[ echo "$line" | grep ssh_dispatch_run_fatal ]] is true then you should parse the line to get only this section XX.XXX.XXX.XX and proceed to block it
    – Edgar Magallon
    Dec 6, 2022 at 5:28

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .