https://wiki.cifprodolfoucha.es/index.php?action=history&feed=atom&title=Ataques_de_contrasinal_contra_servizo_SSH 2026-10-18T09:14:21Z Historial de revisiones de esta página en el wiki MediaWiki 1.34.2 https://wiki.cifprodolfoucha.es/index.php?title=Ataques_de_contrasinal_contra_servizo_SSH&diff=24369&oldid=prev 2026-02-10T20:13:11Z

<p><span dir="auto"><span class="autocomment">Refernecias</span></span></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="es"> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">← Revisión anterior</td> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">Revisión del 20:13 10 feb 2026</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l282" >Línea 282:</td> <td colspan="2" class="diff-lineno">Línea 282:</td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>PENDENTE!</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>PENDENTE!</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'>−</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>= <del class="diffchange diffchange-inline">Refernecias </del>=</div></td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>= <ins class="diffchange diffchange-inline">Evidencias e reflexións =</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">== Evidencias ==</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Un ataque destas características deixa unha pegada bastante clara. Sen embargo, esta pegada tan clara pode pasar desapercibida no caso de que ninguén revise os logs do sistema. Se entramos na máquina atacada e revisamos o log /var/log/auth.log veremos que está cheo de liñas avisando de erros de autenticación:</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">&lt;pre&gt;</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline"> $ grep -i ssh /var/log/auth.log | grep -i &quot;failed password&quot;</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">...</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1627]: Failed password for asir04 from 192.168.100.100 port 42650 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1622]: Failed password for asir04 from 192.168.100.100 port 42622 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1626]: Failed password for asir04 from 192.168.100.100 port 42638 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1624]: Failed password for asir04 from 192.168.100.100 port 42626 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1630]: Failed password for asir04 from 192.168.100.100 port 42666 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1626]: Failed password for asir04 from 192.168.100.100 port 42638 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1627]: Failed password for asir04 from 192.168.100.100 port 42650 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1630]: Failed password for asir04 from 192.168.100.100 port 42666 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1632]: Failed password for asir04 from 192.168.100.100 port 42682 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1627]: Failed password for asir04 from 192.168.100.100 port 42650 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1634]: Failed password for asir04 from 192.168.100.100 port 42686 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1630]: Failed password for asir04 from 192.168.100.100 port 42666 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1636]: Failed password for asir04 from 192.168.100.100 port 42690 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1632]: Failed password for asir04 from 192.168.100.100 port 42682 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1634]: Failed password for asir04 from 192.168.100.100 port 42686 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1637]: Failed password for asir04 from 192.168.100.100 port 42696 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1636]: Failed password for asir04 from 192.168.100.100 port 42690 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1632]: Failed password for asir04 from 192.168.100.100 port 42682 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1636]: Failed password for asir04 from 192.168.100.100 port 42690 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1634]: Failed password for asir04 from 192.168.100.100 port 42686 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1637]: Failed password for asir04 from 192.168.100.100 port 42696 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1640]: Failed password for asir04 from 192.168.100.100 port 42700 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1637]: Failed password for asir04 from 192.168.100.100 port 42696 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1642]: Failed password for asir04 from 192.168.100.100 port 42704 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1640]: Failed password for asir04 from 192.168.100.100 port 42700 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1642]: Failed password for asir04 from 192.168.100.100 port 42704 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1640]: Failed password for asir04 from 192.168.100.100 port 42700 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1646]: Failed password for asir04 from 192.168.100.100 port 42730 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1647]: Failed password for asir04 from 192.168.100.100 port 42732 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Jan 31 12:27:33 serverssh sshd[1650]: Failed password for asir04 from 192.168.100.100 port 42742 ssh2</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">...</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">&lt;/pre&gt;</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">== Reflexións erróneas ==</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Chegados a este momento, un pode pensar que o escenario está ben, incluso que é espectacular; pero non deixa de ser iso, un espectáculo programado, onde todo está orquestado para funcionar como debe. </ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Algunhas consideracións a ter en conta no mundo real.</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">=== A miña organización usa firewalls...===</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Usa firewalls, con servidores separados en redes DMZ, regras verificadas dende o interior e o exterior da organización e limitando o acceso únicamente ós servizos que realmente se necesitan.</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Esto pode levar a unha sensación de total seguridade e invulnerabilidade. Sensación errónea; xa que se nun firewall permito o acceso ó servizo ssh, pasarán todas as comunicacións dese tipo. Pasarán tanto os intentos lexítimos de autenticación como as probas dun ataque de diccionario. Ben é certo que é posible limitar o número de conexións simultáneas, o número de conexións abertas nun determinado período de tempo e os equipos dende onde se pode conectar. Sen embargo, estas medidas ralentizarían o ataque, non o impedirían, xa que os Network Level Firewall non analizan o contido dos paquetes a nivel de aplicación e ademais hai unha capa de cifrado que o impediría.</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">=== A miña organización non usa conta de root... ===</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Efectivamente, distribucións como Ubuntu teñen a conta de root desactivada e os traballos de administración fanse con sudo. Que Ubuntu (e derivadas) sexa unha das distribucións Linux máis usadas non significa que todas as distribucións Unix/Linux desactiven a conta de root e tampouco significa que non rematemos traballando nun sistema onde un administrador anterior habilitou ó usuario root. Se nun servidor a conta de root foi activada e habiliado o acceso por ssh, é un obxectivo. </ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Os comandos que permiten activar/desactivar a conta de root en Ubuntu son os seguintes:</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Para habilitar a conta de root:</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline"> $ sudo passwd root</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Para deshabilitar a conta de root:</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline"> $ sudo passwd -dl root</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Desactivar a conta de root e usar unha conta de superusuario de nome pouco habitual é un paso para protexernos, pero hay que pensar no seguinte:</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">* A seguridade dunha conta protexida por contrasinal non está no nome de usuario, está no contrasinal. Usar nomes &#039;raros&#039; facilita en certa maneira a seguridade (seguridade por escuridade) mentras ese nome non sexa coñecido.</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">* Os ordenadores non son os únicos sistemas nunha organización e a gran maioría de dispositivos de internetworking (switches, routers, puntos de acesso wifi, ...), cámara IP, impresoras de rede, ...,  soen ter unha única conta de administración coñecida (figura nos manuais dos aparellos). Neste tipo de aparellos non só é coñecido o nome de usuario, tamén é o contrasinal; e para máis complicacións, na maioría dos casos non se pode cambiar o nome de usuario nin desactivalo.</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">usuarios e passwords dos equipos LinksysFig. Usuario e contrasinais por defecto de equipos Linksys. Fonte: http://www.routerpasswords.com/</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">E por certo, no escenario centrámonos no servizo ssh pero medusa, hydra e semellantes permiten atacar AFP, Asterisk, CVS, Firebird, FTP, HTTP, HTTP-FORM, HTTP-PROXY, ICQ, IMAP, IRC, LDAP, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, PC-NFS, POP3, PostgresSQL, RDP, RLOGIN, Rsh, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP, SOCKS, SSH, Subversion, Teamspeak, Telnet, VMware-Auth, VNC,  XMPP, etc.</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Como anécdota, hai uns anos nunha reportaxe sobre o príncipe William:</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Ou en [https://qz.com/1181763/hawaiis-emergency-management-agency-accidentally-revealed-an-internal-password Hawai].</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">= Referencias </ins>=</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>* [https://github.com/lanjelot/patator patator]</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>* [https://github.com/lanjelot/patator patator]</div></td></tr> </table>

Joselv https://wiki.cifprodolfoucha.es/index.php?title=Ataques_de_contrasinal_contra_servizo_SSH&diff=24368&oldid=prev 2026-02-10T20:06:11Z

<p><span dir="auto"><span class="autocomment">Hydra</span></span></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="es"> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">← Revisión anterior</td> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">Revisión del 20:06 10 feb 2026</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l278" >Línea 278:</td> <td colspan="2" class="diff-lineno">Línea 278:</td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Como pode verse na parte inferior da imaxe aparece o comando para executarse na liña de comandos no caso de non ter contorna gráfica.</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Como pode verse na parte inferior da imaxe aparece o comando para executarse na liña de comandos no caso de non ter contorna gráfica.</div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">== patator ==</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">PENDENTE!</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">= Refernecias =</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">* [https://github.com/lanjelot/patator patator]</ins></div></td></tr> </table>

Joselv https://wiki.cifprodolfoucha.es/index.php?title=Ataques_de_contrasinal_contra_servizo_SSH&diff=24367&oldid=prev 2026-02-10T20:04:46Z

<p></p> <a href="https://wiki.cifprodolfoucha.es/index.php?title=Ataques_de_contrasinal_contra_servizo_SSH&amp;diff=24367&amp;oldid=24366">Mostrar los cambios</a>

Joselv https://wiki.cifprodolfoucha.es/index.php?title=Ataques_de_contrasinal_contra_servizo_SSH&diff=24366&oldid=prev 2026-02-10T19:57:01Z

<p>Página creada con « = Escenario = Este escenario ten como principal obxectivo demostrar cun exemplo práctico como o sistema de autenticación por contrasinais, a pesar de ser o máis empreg…»</p> <p><b>Página nueva</b></p><div><br /> = Escenario =<br /> <br /> Este escenario ten como principal obxectivo demostrar cun exemplo práctico como o sistema de autenticación por contrasinais, a pesar de ser o máis empregado polos usuarios, non é o máis seguro.<br /> <br /> Escenario <br /> <br /> Ó longo deste escenario traballaremos coa ferramenta [[medusa]] para lanzar un ataque de diccionario sobre o servizo ssh correndo nun equipo Linux Ubuntu. <br /> <br /> Pódense probar outras alternativas a medusa: no equipo pirata están dispoñibles [[hydra]] e [[patator]].<br /> <br /> Comprobaremos que o uso deste tipo de ferramentas permite automatizar este tipo de ataques e servirá para demostrar que o sistema de autenticación por contrasinal non é o suficientemente seguro para usarse en contornos críticos.<br /> <br /> == Creación automatizada do escenario 4D ==<br /> <br /> A máquina serverssh é un contedor LXD correndo Linux Ubuntu Server co servizo ssh instalado e correndo. Ademais este máquina está configurada de xeito que:<br /> * Ven cunha serie de usuarios do sistema xa creados para que se poidan facer ataques contra máis dun usuario.<br /> * SSH está configurado para aceptar autenticación por contrasinais.<br /> * SSH está configurado para aceptar un número máis elevado de intentos simultáneas de autenticación para acelerar o proceso de ataque.<br /> <br /> En primeiro lugar hai que descargar e descomprimir o arquivo script_esc_4D.zip:<br /> <br /> $ unzip script_esc4D.zip <br /> &lt;pre&gt;<br /> Archive: script_esc4D.zip<br /> creating: script_esc4D/<br /> inflating: script_esc4D/config_pirata.yml <br /> inflating: script_esc4D/config_serverssh.yml <br /> inflating: script_esc4D/contras.txt <br /> inflating: script_esc4D/escenario_4D.sh <br /> inflating: script_esc4D/network_PLANTILLA.yml <br /> inflating: script_esc4D/profile_LAN <br /> &lt;/pre&gt;<br /> $ chmod 755 escenario_4D.sh <br /> $ ls -lhF<br /> &lt;pre&gt;<br /> total 24K<br /> -rwxr-xr-x 1 asir asir 1,5K ene 31 12:36 config_pirata.yml*<br /> -rwxr-xr-x 1 asir asir 2,0K ene 31 12:36 config_serverssh.yml*<br /> -rwxr-xr-x 1 asir asir 372 abr 30 2024 contras.txt*<br /> -rwxr-xr-x 1 asir asir 2,4K ene 31 12:37 escenario_4D.sh*<br /> -rwxr-xr-x 1 asir asir 260 mar 27 2024 network_PLANTILLA.yml*<br /> -rwxr-xr-x 1 asir asir 190 mar 27 2024 profile_LAN*<br /> &lt;/pre&gt;<br /> $ ./escenario_4D.sh<br /> &lt;pre&gt;<br /> ----- Escenario SSH - fail2ban -----<br /> Seleccionar operación:<br /> 1. Crear escenario<br /> 2. Parar contenedores escenario<br /> 3. Arrancar contenedores escenario<br /> 4. Borrar escenario<br /> ------<br /> 1<br /> Crear escenario<br /> Error: Network &quot;lan&quot; already exists<br /> Error: Error inserting &quot;LAN&quot; into database: The profile already exists<br /> ------------------------------<br /> creando servidor SSH <br /> ------------------------------<br /> Launching serverssh<br /> ------------------------------<br /> creando pirata <br /> ------------------------------<br /> Launching pirata<br /> <br /> +------------+---------+------------------------+-------------+-----------+----------------------+<br /> | NAME | STATE | IPV4 | PROFILES | SNAPSHOTS | LAST USED AT |<br /> +------------+---------+------------------------+-------------+-----------+----------------------+<br /> | pirata | RUNNING | 192.168.100.100 (eth0) | LAN | 0 | 2026/01/31 13:15 CET |<br /> +------------+---------+------------------------+-------------+-----------+----------------------+<br /> | serverssh | RUNNING | 192.168.100.101 (eth0) | LAN | 0 | 2026/01/31 13:15 CET |<br /> +------------+---------+------------------------+-------------+-----------+----------------------+<br /> &lt;/pre&gt;<br /> <br /> No meu caso o profile e a rede lan xa estaban creadas e por iso saen as mensaxes de erro. No caso de non estar, o script procedería á crealas.<br /> <br /> No ficheiro contras.txt hai unha listaxe de hashes e contrasinais asociados ós usuarios asir01, asir02, asir03 e asir04 presentes na máquina serverssh.</div>

Joselv