Cybersecurity · NAS Security Attack & Defense Lab · Lab 1 — SSH Brute Force Attack

Lab 1 — SSH Brute Force Attack

Attack: SSH brute-force from Kali against a TrueNAS 13.1 host. Defense: detect in logs and block the attacker with pf.

Scenario

A TrueNAS server and a Kali Linux host run on a segmented lab network. Kali performs reconnaissance, finds SSH (port 22) open, and launches a brute-force attempt with the ssh-brute NSE script. On defense, the activity is detected in /var/log/auth.log and the source IP is immediately blocked with the system firewall.

Offensive

Port 22 (SSH) Discovered Open

Nmap results showing port 22 open on the target
Nmap shows SSH exposed on the target host.

Brute-force with NSE ssh-brute

Nmap NSE ssh-brute configuration/command
Configuring the ssh-brute NSE script.
ssh-brute attack running against the target
Brute-force in progress from Kali.

Defensive

Incident Detection

Review authentication logs on the server to confirm repeated failures and the source IP.

Viewing /var/log/auth.log entries with repeated failures
Auth log review shows repeated SSH failures.
Additional log view showing usernames tried
Usernames attempted from attacker IP.
Concatenated log showing multiple brute-force attempts
Concatenated view highlights the brute-force pattern.

1) Ensure pf is Enabled

# enable pf (if not already)
sudo pfctl -e

# check status / rules
sudo pfctl -sr
Verifying pf status and enabling if necessary
Confirming the firewall is active.

2) Add a Block Rule for the Attacker IP

Edit /etc/pf.conf and add a line replacing ATTACKER_IP with the source:

block in quick from ATTACKER_IP to any
Editing pf.conf to block the attacker IP
Blocking the attacker in pf.conf.

3) Load the Updated Rules and Verify

sudo pfctl -f /etc/pf.conf
sudo pfctl -sr   # confirm rule is present
Reloading pf rules and listing ruleset
Rules reloaded; the block is active.

This immediately cuts off the brute-force source while you proceed with standard IR: scoping, additional log review, credential hygiene, and hardening.

← Back to NAS Security Attack & Defense Lab