In a recent whitedust article[1] about the current ssh brute force
attacks, they discuss ways to prevent the spread of these worms. One of
the counter-measures is "tattle"[2], a program to automatically report
brute-force attempts to the abuse address of the netblock of the
attacker. The other is an "anomaly detection driver". Would be nice if
these were added to  the openssh-server package and tattle configured to
run and automatically mail the sysadmin, who would then forward abuse
reports as s/he saw fit.

1. http://www.whitedust.net/article/27/Recent%20SSH%20Brute-Force%20Attacks/
2. http://sodaphish.com/files/tattle
3. http://www.ranum.com/security/computer_security/code/

Please note that there have been security issues in tattle versions
before 0.3.0 as reported by b0iler on Bugtraq [1].

An updated release of tattle which fixes this issue is available on the
new website [2] of its developer, Mr. C.J. Steele.

Though much has been improved since the initial release, some
shortcomings remain in the current 0.4.0 release ([3], [4], script does
not define default variable values outside of its configuration section).

Nevertheless tattle would make a nice addition to the Debian pool,
though, preferrably, as a standalone package. A recommendation to
install it could be added to the openssh-server dependencies once it is
generally considered both reliable and using a good reporting approach.

I thus recommend to reassign this a bug against wnpp twice, once with
title 'tattle', once with title 'never seen before' (if still of interest).

Moritz

[1]
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2005-06/0057.html
[2] http://intertrusion.com/files/tattle
[3]
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2005-06/0059.html
[4]
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2005-06/0061.html

Hello,

Good morning,

We have gone through your samples from a partner and Here is our  Order
List. Please do bear in mind that we are very much in  need of this
order, quote your competitive prices.

Kindly send the Order confirmation.

Your early reply will be much appreciated.

Best Regards,

Maryanah Erwin.

PT FINDORA INTERNUSA

Jln Pahlawan 66 Kec. Arjawinangun

45162 CIREBON West-Java INDONESIA

tel : +62 231 357334

fax: +62 231 357260

email: marketing@findora.com