Securing your SSH server against brute force password attacks

If you run an SSH server open to the whole internet you'll soon notice many attempts to break into your system using random username and password combinations. This 'noise' in the log files is annoying and might mean you miss an important message. If you are unlucky or use a common username and password your system might be compromised by one of these brute force attacks.

One method to drastically reduce the number of cracking attempts is to restrict access to the SSH server by IP address. This can done be done either by editing the SSH config file or by using configuring iptables. However this method requires valid users to have static IP addresses, something which most home users don't have. In many cases public key authentication is a better choice.

Use public key authentication

A better method to stop attackers from using random username and passwords is to switch off password authentication entirely and require public key authentication instead. Attackers will not be able to try random username/password combinations and will not create 'noise' in the log files. Valid users will still be able to connect.

To describe how this can be set up assume we wish to protect a computer with a static IP address called server. We wish to access it from another system called laptop, (which may be using a dynamic IP address). The account on server that we will access is dave. We'll assume that the SSH configuration file is /etc/ssh/sshd_config. Adjust these names to suit your setup.

Firstly, on laptop create a public/private key pair.

ssh-keygen -t dsa

A passphrase is not required although it is a good idea. On server make sure a ~/.ssh directory exists with the correct permissions:

mkdir ~dave/.ssh
chmod go= ~dave/.ssh

Using your favourite editor (emacs of course) paste the contents of the public key into the ~dave/.ssh/authorized_keys file on server. Putty users may find the instructions at http://www.howtoforge.com/ssh_key_based_logins_putty helpful. Check that you can log into server without requiring your password. If you are going to configure server remotely ensure you can log in without needing your password, otherwise you will lock yourself out! If you set a passphrase you will need to type that.

Configure the server

The key requirement for the server configuration is that by default password authentication is turned off. Find the line in /etc/ssh/sshd_config which sets password authentication. Make sure it is set to

PasswordAuthentication no

If necessary remove any leading # character. Whilst editting /etc/ssh/sshd_config its a good idea to disable empty passwords and root logins, ensure the following lines are set

PermitEmptyPasswords no
PermitRootLogin no

If you need empty passwords or root logins from specific hosts this can be overridden later.

Enable password authentication for trusted hosts

Once password authentication is disabled users on a multi-user system will have a problems copying their keys to grant them access! Exceptions can be made for trusted static IP addresses so that users can copy their public key. Assume we trust all IP addresses in the subnet 192.168.1.0/24. Passwords can then be enabled by simply adding the following lines to the end of /etc/ssh/sshd_config

Match Address 192.168.1.0/24
PasswordAuthentication yes

Enable root logins

Suppose a root login using password authentication is required for one host only (192.168.1.123). Add the following lines to /etc/ssh/sshd_config

Match Address 192.168.1.123
PasswordAuthentication yes
PermitRootLogin yes

Summary

These simple steps keep your SSH server accessible from everywhere but greatly reduce the likelihood of a successful brute force attack. The Match keyword requires openssh version 4.4 or later.

Cloud detector: first data

Annotated plot for 2013-05-30.

The cloud detector has been operating outside for a few days now. The plot above is an example of the data I am getting, annotations added manually! The ambient temperature is the temperature of the sensor. In reality this may be a little warmer than ambient when it is exposed to direct sunlight. The sky temperature is the object temperature from the sensor. It is an average over its field of view, and in the absence of clouds it is also averaged in height. From the plot a number of features can be identified:

Clear sky
With no clouds to reflect back thermal radiation the sky temperature for a clear sky is very low, typically < -10°C. This results in a large difference (> 20°C) between ambient and sky temperatures.


Overcast sky
With the presence of clouds most thermal radiation is not lost to space but reflected back to Earth and the sensor. The difference between ambient and sky temperatures is small (< 10°C). With a uniform cloud coverage the variation in the difference is small.


Cloudy sky
A sky with partial cloud cover has an intermediate difference in ambient and sky temperatures. The cumulus clouds resulted in a large variation of the temperature difference, caused by the more sensitive central viewing area observing alternately clear sky and cloud. Complete coverage by a thin layer of cloud is expected to give an intermediate temperature difference but low variability.


Wet sensor
When the sensor is wet with rain the sky temperature is measured incorrectly since the water is not transparent to long-wave infra-red radiation and matches the ambient temperature. As wet weather implies cloud this is not a major problem although I have concerns over the time taken for the sensor to dry off.


Dew
The formation of dew is observed in the evening as the ambient temperature falls. The difference between ambient and sky temperature is reduced to less than 10°C.

Future work

Early operation shows that dew is a problem and can indicate cloud when the sky is actually clear. I have considered creative solutions such as painting the top of the box white and the bottom black in order to minimise heat lost to the sky and maximise heat absorbed from the ground. I expect this will only delay the onset when dew becomes a problem, not eliminate it. The only viable solution is to heat the sensor slightly (~2°C) above ambient, which means moving away from battery-powered operation. If a cable is used for power then wireless communications makes little sense, power-over-ethernet seems the way forward. A heated sensor will also reduce the drying time after rainfall.

I still have some concerns regarding waterproofing around the sensor. I have ordered the MLX90614ESF-DCH-000-TU-ND which features a 12° field of view. This narrower view is obtained by fitting a refractive germanium lens above the sensor. The TO-39 package has been modified to be taller than standard to accommodate the lens. The additional height should mean that the top of the sensor is above the cable gland. Water should not collect so easily and it should be possible to use silicone sealant without accidentally coating the sensor window.

Previously I tried pointing the sensor downwards and using a metal surface as a mirror to view the sky. The experiment was not successful and I think this was in part due to the wide field of  view of the sensor (90°) preventing a clear upward view without also observing the ground or enclosure. It will be worthwhile repeating the experiment with the narrow field of view sensor.

I only have basic plotting routines at present. The goal is to produce a cloud cover index, varying between 0 indicating no cloud and 1 indicating complete cloud cover. The index will be used as the basis for sending alerts.

Cloud detector progress

Microcontroller and radio communications

To minimise the time and effort required to test the cloud detector concept I am following the approach used for the AuroraWatchNet magnetometer system and reusing as much hardware from it as possible. The MLX90614 non-contact infra-red temperature sensor is located outside. To minimise the infrastructure requirements the sensor unit is battery-powered and transmits its data over a bi-directional radio link. The sensor is controlled by one of my Calunium v2 microcontroller development boards. I'm using a pair of RFM12B radio modules operating at 433MHz to emulate a transparent serial connection. One is fitted on  the Calunium board and the other radio module is connected to a Raspberry Pi via my RFM12B shield. The Pi records the data and is responsible for uploading it for general access. I am also reusing most of the AuroraWatchNet firmware, which means I already have signed data communications and the capability to deploy over-the-air firmware updates - quite a good starting position for a new project!

Waterproofing the sensor

The biggest challenge I expect to face with this project is waterproofing the sensor. Although it is hermetically sealed there is no easy way to deploy it outside. As explained in a previous post, only a few materials are transparent to long-wave infra-red emissions and the better ones are toxic, water-soluble or expensive. I am therefore trying to avoid covering the sensor window and instead keep the electrical contacts dry. My first attempt was to drill a hole in the box and attach the sensor with silicone sealant. The mechanical fixing lacked strength and I wasn't convinced I had completely sealed around the sensor. To make matters worse I ended up with sealant on the sensor window which had to be cleaned off before it set. Another approach was required.

The new approach is to fit the sensor inside a cable gland. Before doing so I had to attach wires to the sensor connectors and insulate with heat-shrink sleeving. The result is shown below.

The next step is to fit the sensor in the cable gland before fitting the cable gland to the box.

The other end of the wires can then be soldered. For the prototype the wires are soldered to a small piece of stripboard. The stripboard has two pull-up resistors for the I2C bus and a decoupling capacitor. There is also an IDC connector to link the board to the unused JTAG interface. This was the easiest way to connect to a stock Calunium v2 board. For the lowest power operation the sensor is powered from logic-level output and I am using software I2C so all connections can be grounded when the sensor is not in use. The real-time clock on Calunium is connected the the hardware I2C interface on the microntroller and can be operated independently of the sensor.

The box and cable gland are rated IP65. Hopefully the result will be waterproof  

Results

The sensor is now deployed outside and reporting back to the Raspberry Pi base station. The transmitted packets are logged by the Raspberry Pi but as yet I don't have a convenient way to extract the ambient and object temperatures for analysis. That is the next task.

An open-access cloud-detection network

Introduction

Living in the North-West of England I find that my attempts to view the aurora or astronomical events such as meteor showers, lunar eclipses and comets are often prevented by cloud. On these occasions I wonder if it is worthwhile driving somewhere to find some clear sky. But where? If only I could look at a map to see where it was clear now. Publicly-available satellite images don't appear to have the resolution needed for this purpose. Maybe I should go to bed instead and wait for an alert when the skies have cleared? Could the question of where and when to find clear skies be answered by an open-access cloud detection network operated by citizen-science volunteers?

Requirements

I've together a draft list of requirements to construct a useful network:

• Open-access. While my primary concern is with viewing the aurora I can see there are many other uses of such a network. Astronomy and obviously meteorology. Open-access enables other observers to make use of the data for their own purposes.
• Near real-time. The weather here can quickly change. Ideally measurements should be taken every few minutes and be made available without unnecessary delay.
• Use open-source hardware (OSHW). More specifically, an OSHW design should exist which allows users to contribute readings with the lowest possible cost.
• Large geographical coverage. 
• Night time operation required, day time beneficial.

The most difficult requirement to satisfy is the coverage. With ground-based sensors the viewing area might be as small as 2km diameter (cloud-base 1000m, optical viewing angle ±45°); at this size complete coverage of Great Britain would require over 57000 installations. A useful network does not require complete coverage, for auroral and astronomical purposes good results could be achieved by positioning sensors in a few viewing locations selected for low light pollution.

Remotely-sensing clouds

Perhaps the simplest method to remotely-sense cloud cover is to measure the 'sky' temperature with a non-contact infra-red (IR) thermometer. In the absence of cloud cover this is very low (say -12 to -20°C for Spring in the UK) but with cloud cover the temperature measured is warmer (0 to 4°C). These temperatures vary over the course of the year but by looking at the difference between the sky and ambient ground-level temperatures an estimate of cloud cover is possible. Some of these thermopile sensors have a digital output for interfacing directly with a microcontroller.

A camera and image-recognition software is another approach but it is more complex to develop, install and operate. It is not clear how such a system would perform at night. In order to install the maximum number of sensors I plan to concentrate on cheaper methods.

Design concept

I believe there are two key factors which limit the number of sensors in the network: cost and ease of installation. To minimise the infrastructure I plan to begin with a battery-powered unit which communicates with a Raspberry Pi (or other computer) via a low-cost, licence-free radio module. This is the same concept used by the AuroraWatchNet magnetometer sensors.

Potential problems

Precipitation (rain, snow, hail) and dew on the sensor will prevent accurate sky temperature measurements, most likely indicating cloud when it may in fact be clear. A heater to prevent dew forming is an option but the temperature gradients may cause the thermopile to give incorrect measurements. The power consumption needed is incompatible with battery operation. It may be possible to point the sensor downwards, to avoid precipitation and dew, and use a reflective metal surface to observe the sky. Tests shows the sky temperature readings are partially compromised by this approach.

Sensor

I have found a number of sensors which may be suitable:

• Melexis MLX90614. This sensor contains thermopiles for sensing both the object and ambient temperature. An SMBus interface enables direct connection to a microcontroller. It is packaged in a TO-39 metal can. The standard 3.3V operation, 90° field of view (FOV) variant is readily available in single quantities from UK hobby electronics stores for around £15 each. Other variants exist for 5V operation and with different fields of view (10°, 35°, and a dual 70° FOV). The minimum object temperature is -70°C. The only irritation is that the sleep mode requirements are not compatible with low-power operation on a I2C bus.
• Melexis MLX90615. Similar to the MLX90614 but the sleep mode requirements are compatible with low-power operation on an I2C bus. Cost is similar to MLX90614 but no UK supplier exists. Package is a TO-46 metal can. Limited to 3.3V operation and a single FOV (80° or 100° variants). The minimum object temperature is -40°C.
• Texas Instruments TMP006. Small thermopile with I2C interface for direct connection to a microcontroller. Ball-grid array package. Readily available from UK suppliers. Cost is around £3 each for single quantities.
• Thermometrics ZTP-135SR. Thermopile with analogue output in a TO-46 package, with a thermistor for ambient temperature measurement. Being an analogue output additional processing is required. Around £10 from Farnell.
• Devantech TPA81. Linear array of 8 thermopiles. Cost is around £65.
• Panasonic AMG88 Grid-EYE. An 8×8 imaging sensor in a surface-mount package. The minimum object temperature is -40°C. Available from Digikey for around $40.

For the prototype system I plan to use the Melexis MLX90614 sensor. It should be possible to work around the problems with low-power operation by using software I2C and powering the sensor from a logic output, allowing power to be completely removed when not in use.

I excluded the TMP006 because the BGA package is hard to work with; not only is it difficult to solder it will require some kind of enclosure or window to protect it from moisture. Only a few materials are transparent to long-wave infra-red emissions and the better ones are toxic, water-soluble or expensive. The other sensors may be suitable but are more expensive. The TPA-81 linear array and Grid-EYE imaging sensor could provide spatial discrimination and thus distinguish between a thin layer of complete cloud cover and denser clouds with open areas of sky.

Initial results

Initial tests with the Melexis MLX90614 sensor confirm the concept is viable. I have not noticed any ill-effects from the sun within the field of view, suggesting that daytime operation is possible. Further work is required to package the system into a usable prototype which can be deployed outside permanently. Full-time operation will indicate the frequency of measurement errors from dew and precipitation.

Other work

It would be wrong to suggest I am the first to make measurements of cloud cover in this way, useful links are listed below. I am not aware of any existing cloud detection networks.

http://bildr.org/2011/02/mlx90614-arduino/

Useful code for interfacing the MLX90614 IR thermometer with an Arduino. This code works with my Calunium Arduino clone.

http://www.kwos.org/clouds_detector.htm

Good background information.

http://kcotar.org/arduino-weather-station-1/
A weather station which uses the Melexis MLX90614 sensor for cloud detection.

http://www.noao.edu/staff/gillespie/projects/cloud-detector.html
Similar in concept but using a Peltier device (in reverse) to measure the difference between ambient ground temperature and sky temperature.

How to use the GPIO version of avrdude on the Raspberry Pi

Introduction

I previously showed an implementation of a AVR ISP programmer using the Raspberry Pi GPIO port which can be used to program Atmel's AVR range of microcontrollers with avrdude. An ISP programmer based on this design was incorporated into a shield to interface to the RFM12B radio module. This post explains how to use avrdude to actually program devices.

Software installation

Download the patched version of avrdude from http://project-downloads.drogon.net/files/. I also keep a copy in the RPi_RFM12B_ISP respository, https://github.com/stevemarple/RPi_RFM12B_ISP/tree/master/software/avrdude. You will probably want the armhf (hardware floating-point) version. Download the documentation package for avrdude too. Install the packages using "dpkg -i". For example

sudo dpkg -i avrdude_5.10-4_armhf.deb
sudo dpkg -i avrdude-doc_5.10-4_all.deb

Using avrdude over the GPIO interface is problematic for users other than root. The easiest solution is to give the avrdude binary setgroup permission:

sudo chmod g+s /usr/bin/avrdude

Usage

Selecting the GPIO programmer is simply a matter of including "-P gpio -c gpio" options; the -P option specifies that the GPIO port is used (as opposed to USB, serial or parallel interfaces) whilst the -c option selects the correct programmer type on that port.

For example, to check the signature on an ATmega328P execute the command

avrdude -P gpio -c gpio -p atmega328p

To read the fuses execute the command

avrdude -P gpio -c gpio -p atmega328 -U lfuse:r:-:h -U hfuse:r:-:h -U efuse:r:-:h

Customisation

The packages above define a single programmer called gpio which uses the gpio interface on GPIO pins 8 to 11. Since the RFM12B shield for Raspberry Pi implements two independent programmers I prefer to use gpio0 and gpio1. You can add these by creating a .avrduderc file in your home directory. The file should contain:

programmer
  id    = "gpio0";
  desc  = "Use sysfs interface to bitbang GPIO lines";
  type  = gpio;
  reset = 8;
  sck   = 11;
  mosi  = 10;
  miso  = 9;
;

programmer
  id    = "gpio1";
  desc  = "Use sysfs interface to bitbang GPIO lines";
  type  = gpio;
  reset = 7;
  sck   = 11;
  mosi  = 10;
  miso  = 9;
;

Three-axis sensor unit for AuroraWatchNet

Three-axis sensor unit. The RJ-45 connector is for power and I2C data signals, not Ethernet.

AuroraWatchNet is a network of magnetometers for auroral alerts and citizen science. Whilst the  magnetometer is intended to function with one single-axis FLC100 sensor from Stefan-Mayer Instruments I have designed the system to support 3-axis operation by mounting 3 sensor boards at 90° to each other using just standard right-angle PCB connectors. This approach avoids the requirement for external mounting hardware which would be expensive to manufacture.

The power supply (a charge-pump DC-DC converter), temperature sensor and RJ-45 connector are fitted to just one circuit board. It is possible to use only one analogue-to-digital converter (ADC) but given their low cost it was presumed they would be fitted to all boards to enable simultaneous sampling of all 3 axes. The MCP3424 converter was chosen because eight options are available for the I2C address, thus jumpers can be fitted to select a unique address for every ADC on the I2C bus. This converter also features 4 input channels. All magnetometer outputs and the temperature sensor are connected to each ADC so that the spare channels can provide some redundancy in case of an ADC failure. The SYNC connectors of all sensors are linked to synchronise their excitation frequencies.

Several single-axis units have been built and one is in active use by AuroraWatch UK. The photograph above shows the first three-axis unit to be built. Initial testing indicates it functions as intended but the performance of 3 simultaneously-powered sensors in close proximity is yet to be established.

The importance of brown-out detection

The batteries expired in one of the AuroraWatchNet test magnetometers this week. I was expecting that to happen since the magnetometer wasn't operating in its low-power mode and the battery voltage from the two 1.5V alkaline cells had been hovering around 2V for some time. The Atmel ATmega1284P microcontroller is actually powered at 3.3V using a boost power supply. What I didn't expect was for the system to not start after replacing the battery. I could tell xboot was working since the LED flashed 3 times as usual after the reset button was pressed. After that the LED stayed on but nothing else happened, not even the start-up debug messages from the serial port. I guessed the flash program memory had somehow got corrupted.

I used the AVR Dragon to extract the contents of the flash memory (avrdude -P usb -c dragon_jtag -p atmega1284p -U flash:r:flash.img:r) and compared it against the saved raw image file using the linux split and cmp commands. Sure enough, three pages of flash memory were set to 0xFF, probably from some erroneous page clear operation. Brown-out detection was disabled by the fuse settings to save power. Big mistake! What I think happened was as the voltage dipped below its valid range the microcontroller started executing random commands, including 3 SPM page clears, one of which was the first page of flash which holds the interrupt vector table. Valid execution was doomed.

What I should have done was to enable brown-out detection in the fuses, 2.7V seems the most appropriate setting for an 8MHz clock and 3.3V operation. To save power during sleeping the brown-out detection can be disabled with a call to sleep_bod_disable(). Lesson learned!