A way to solve SSH attacks problem 1

[QatQat]

Hi everyone,

several posts have come up on this forum, including one of mine

http://www.tek-tips.com/viewthread.cfm?qid=1093086

concerning SSH attacks.

Another one with several (good) solutions

http://www.tek-tips.com/viewthread.cfm?qid=1276751

Browsing the internet on a lazy Saturday morning I found a very interesting one.

http://www.soloport.com/iptables.html

I hope you will find it useful and if so, don't forget to thank whoever is the author.

Cheers

QatQat



Life is what happens when you are making other plans.

 

[Changlinn]

Another good one to look for is denyhosts a simple daemon that runs that keeps an eye on logins and then blocks the ip of someone who fails to login 3 or so times, depending on what you set it to. This has never steered me wrong.

 

[robbieguy2003]

As changlinn says, use a script to block users. I notice in the article that the author says this will create a big list of blocked IP's.

Also change the SSH port to something obscure as well - this will stop bots which cause most of the log entries - if not all.

If you want to do it properly though, the box should be firewalled and only allow traffic through a VPN really.

I wish someone would just call me Sir, without adding 'Your making a scene'.

Rob

 

[Changlinn]

don't really need a vpn for ssh, it is secure enough, as long as you have a long enough, complex enough password, and disable the root login. Or you can do key based authentication, not likely that someone is going to generate the same 2048bit ssh key for logging in to your ssh server, or guess your 10 character username and 20+ character ascii password.

 

[robbieguy2003]

Certainly not, however when running internet facing servers it can be wise to Firewall everything with a seperate Hardware Firewall and only allow access to specific services (i.e. 80 & 443) unless your on VPN.

Admittedly its OTT for most things but i've been in several scenarios where its essential.

I wish someone would just call me Sir, without adding 'Your making a scene'.

Rob