how to block incoming ssh from locations outside usa at my home server? (ubuntu 10.04)

Question

Is there a 'step by step' or canned-package to block incoming ssh attempts from anywhere not in the USA?

No one but me or a handful of coworkers should be trying to ssh into my desktop at home; of course life is not so nice and my /var/log/auth.log is full of attempted root log-ins from all over the world...

A complicated solution would be to somehow grab the IP, look it up on the web via scripted http lookup, then decide on action... is there a canned script or package that blocks by country?

(note: I have installed denyhosts, works well to block after an attempt, but there are just so many attempts from a wide range of IPs!)

related question: http://superuser.com/questions/171406/game-server-how-can-i-block-connections-from-other-countries

Answer 1

In don't think thera are any precanned solutions. For various reasons they would only be partially effective.

Install a good firewall. (I use Shorewall to build mine.)

Consider using port knocking to keep the port closed unless it is required. Open ssh to addresses you know need to use it. For users on dynamic addresses you can use whois to determine the likely size of the block they are in. The open rules need to go before the port knocking rules.

Consider using fail2ban to block addresses which scan you.

Answer 2

one easy thing to thwart ssh attacks is to change your ssh port. you can also whitelist certain ips using denyhost or authfail.

Answer 3

If you or your coworkers will have static IPs, you can use the /etc/hosts.allow and /etc/hosts.deny files.

For example in /etc/hosts.allow, you could put...

SSHD: 13.45.75.78

And for /etc/hosts.deny...

SSHD: ALL

That denies all ssh access except by 13.45.74.78. You can also use wildcards if needed.

Answer 4

I agree with yanokwa but want to add a bit.

I agree with both the use of an alternated SSH port and whitelisting IPs. Minimal effort but significant gain.

The problem you get there is if home users don't have static IP's which most ISPs don't provide. An alternative would be a hybrid approach. You can leave port 22 as your standard port and whitelist IPs for that port such as anything on your own subnet and a few "trusted" IPs (which could probably be spoofed if they really cared). Then, use iptables to use another port (one above 1024) to listen and forward internally to port 22.

Therefore, port 22 has a significantly smaller attack surface and you can still connect from any IP such as if you needed to connect from your local wifi hotspot.