1

i am running centos. how can i best avoid a brute force attack on my ssh server?

I found this list:

DenyHosts is a Python based security tool for SSH servers. It is intended to prevent brute force attacks on SSH servers by monitoring invalid login attempts in the authentication log and blocking the originating IP addresses.
Explains how to setup DenyHosts under RHEL / Fedora and CentOS Linux.
Fail2ban is a similar program that prevents brute force attacks against SSH.
security/sshguard-pf protect hosts from brute force attacks against ssh and other services using pf.
security/sshguard-ipfw protect hosts from brute force attacks against ssh and other services using ipfw.
security/sshguard-ipfilter protect hosts from brute force attacks against ssh and other services using ipfilter.
security/sshblock block abusive SSH login attempts.
security/sshit checks for SSH/FTP bruteforce and blocks given IPs.
BlockHosts Automatic blocking of abusive IP hosts.
Blacklist Get rid of those bruteforce attempts.
Brute Force Detection A modular shell script for parsing application logs and checking for authentication failures. It does this using a rules system where application specific options are stored including regular expressions for each unique auth format.
IPQ BDB filter May be considered as a fail2ban lite.

anyone got any experience with any of those?

Improve this question
3
  • Maybe you want to have a look at the SSH-Tag over at Server Fault. They have such questions covered.
    – Bobby
    Oct 23, 2012 at 14:09
  • I'd recommend that you use iptables as in this link hostingfu.com/article/…. The article shows a nice example on how to limit access to SSH to 3 connection attemps every 60 sec, otherwise blacklisting the IP during 60 sec. Adapt the example to your needs.
    – jaume
    Oct 23, 2012 at 20:31
  • security.stackexchange.com
    – faintsignal
    Dec 18, 2016 at 17:25

3 Answers 3

Reset to default
3

Fail2Ban is great for automatically banning hosts that make multiple failed attempts to access some service with the use of iptables. Even if you do end up banning yourself somehow you can still get a new IP (a phone with an ssh client will work fine) and un-ban yourself.

Guides found via a search engine like Google should help you set it up quickly.

As HayekSplosives noted in his answer, switching to a non standard, high port helps a lot, since most attackers run basic port scans to save time when scanning a large IP range. I've seen huge drops in access attempts switching to port 40000+ from 22.

Improve this answer
1
  • With fail2ban you can also specify a timeout, so that connection attempts from an IP address are blocked for X minutes, so if you do end up accidentally locking yourself out, you can re-try after X minutes have elapsed - 10 is enough time to make a cuppa.
    – FreudianSlip
    Oct 25, 2012 at 7:30
2

CentOS has iptables.

http://wiki.centos.org/HowTos/Network/IPTables

1.) You can configure CentOS to drop packets from anyone but a trusted (yours) ip address.

2.) You can configure ssh to listen to a non-standard port. Most attacks are coming from automated scripts on other compromised systems. Edit this in /etc/ssh/sshd_config

3.) You can set password authentication to "no" and install your machine's ssh key on the server.

Improve this answer
3
  • what happens if i do number 3 (ssh keys ONLY) and forget my key? would i have to get my host to actually go to the machine and reset it manually?
    – user166707
    Oct 23, 2012 at 18:06
  • Yes. If you forget your private key password (if you set one) or lose one of the both keys (and can't recover it) you have to generate a new key pair on your computer and manually replace your public key on the server.
    – jaume
    Oct 23, 2012 at 20:26
  • Do you have instructions for option 3?
    – John Deer
    Oct 12, 2020 at 9:51
0

Have a look at pam_shield. It completely blocks IP addresses from which there are too many unsuccessful login attempts.

Improve this answer

You must log in to answer this question.