Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite
1

Is there an easy way to block an IP that runs a brutforce login attack on my sshd? Maybe just an increasing time for the login prompt to appear.

I know fail2ban, but that did hang when I tried it. Also it needs semdmail, which I don't want to setup on my desktop. And I don't want to send an email over the internet when there is something happening. If fail2ban could instead use desktop notifications (D-Bus) it would be great. But I wonder why I have to install something separate just for something like this? Why can't sshd do that? (Increase the wait time when the same IP has multiple failed login attempts.)

share|improve this question
I'd look into troubleshooting fail2ban. It's really about the perfect solution for what you're trying to do. – bobmagoo Sep 17 '12 at 16:44
I'd Look into APF (Advanced Policy-based Firewall) which has DOS (denial of service) prevention features. I usually configure SSHD to disallow password-based authentication and to operate on a high-numbered port. This helps reduce log clutter. – RedGrittyBrick Sep 17 '12 at 16:47
I think you just need mailx, which implements the sendmail program, which sends mail. This is not directly related to the sendmail mail transfer agent. – Eroen Sep 17 '12 at 16:59
Unless you are protecting a DOS attempt at the kernel level, you aren't preventing any DoS. – EdH Mar 14 at 5:44

3 Answers

up vote 1 down vote

An alternative to fail2ban is DenyHosts which updates /etc/hosts.deny instead of managing netfilter rules.

share|improve this answer
I use Denyhosts, mainly because I couldn't get fail2ban to work properly. – Eroen Sep 17 '12 at 17:00
hosts.deny is TCP Wrappers. It's deprecated. See below. – EdH Mar 14 at 5:45
up vote 0 down vote

You don't give much information about your configuration, but if you're using a router, you can usually program them with an inbound filter that will cause it to block anything from a specified IP or IP range. For example, with my D-Link, I go to the Advanced Settings tab and select the Inbound Filter page.

share|improve this answer
My router (speedtouch DSL modem) is pretty bad. The web interface is confusing and cumbersome and lies to me (I did block some ports through the interface but I could still be reached on those ports!). So that's why I don't use that. – panzi Mar 15 at 0:29
up vote -1 down vote

The best way to do this is to use netfilter's built-in capabilities. You want to timeout if the TCP port is hit too many times in a given amount of time.

There is a last seen time stamp for each host...

$ sudo iptables -A INPUT  -p tcp -m tcp --dport 22 -m state \
    --state NEW -m recent                                   \
    --update --seconds 60 --hitcount 4 --name DEFAULT --rsource -j DROP

Read the full article here. http://blog.bigdinosaur.org/securing-ssh-with-iptables/

There are also a number of more sophisticated plugins for netfilter that do this.

Don't use hosts.deny, that is old old. That's TCP Wrappers which is ancient and requires programming support.

I've used this technique on production firewalls and it works well.

share|improve this answer
These rules allow an attacker to DoS arbitrary clients by sending packets with spoofed source IP address at a high-enough rate. DenyHosts OTOH will only block addresses where an authentication attempt failed. At this point the TCP connection was already established, so address spoofing is largely ruled out. – Ansgar Wiechers Mar 14 at 8:25
uh hu... I suppose that is a risk, if your ISP and their downline routers (and their peering partners router) somehow allow spoofed IP packets. Are we back in 1994? :) - if that's going on - you have much larger problems than SSH logins. – EdH Mar 15 at 17:32
You may find the answers to this question on IT Security enlightening. – Ansgar Wiechers Mar 15 at 17:58
Well, try doing IP spoofing... You may find success in certain parts of the world, b/t some networks. The main issue is at the BGP level where your packets will usually get dropped b/c peering services won't pass your pack. Even if they do you will also need to nav your own ISP. Enough weird packs from an unusual interface and it will set off an IDS. But if the main point here is to keep people from breaking into SSH, then denying based on hit count is reasonable. – EdH Mar 15 at 20:27
Would I recommend this for HTTP or some HA service? no. You would need to use an anomaly detection IDS. The issue with TCP Wrappers is that while it may be supported by that compile of OpenSSH, but when this users swaps out to say anything else - maybe Dropbear or something, or just recompiles SSH - they won't be protected. TCP Wrappers was designed for the era of super-servers. – EdH Mar 15 at 20:28
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.