Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My server is under attack. I am logging this kind of attempts:

Sep 22 06:39:11 s1574**** sshd[16453]: Failed password for invalid user amber from port 35182 ssh2
Sep 22 04:39:11 s1574**** sshd[16454]: Received disconnect from 11: Bye Bye
Sep 22 06:39:11 s1574**** sshd[16457]: Invalid user amber from
Sep 22 04:39:11 s1574**** sshd[16458]: input_userauth_request: invalid user amber
Sep 22 06:39:11 s1574**** sshd[16457]: pam_unix(sshd:auth): check pass; user unknown
Sep 22 06:39:11 s1574**** sshd[16457]: pam_unix(sshd:auth): authentication failure;     logname= uid=0 euid=0 tty=ssh ruser= 
Sep 22 06:39:11 s1574**** sshd[16457]: pam_succeed_if(sshd:auth): error retrieving     information about user amber
Sep 22 06:39:14 s1574**** sshd[16457]: Failed password for invalid user amber from port 35842 ssh2
Sep 22 04:39:14 s1574**** sshd[16458]: Received disconnect from 11: Bye Bye

What can i do to block this kind of access attempts, something like blocking ip when more than 3 denie

share|improve this question
Welcome to the Internet. – Ƭᴇcʜιᴇ007 Sep 22 '12 at 18:35
up vote 4 down vote accepted
  1. You can limit number of log in attempts per minute with iptables. Such rules will block IP for 1 minute after 3 login attempts: (taken from here):
    iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT
    iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j LOG --log-prefix "SSH_brute_force "
    iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP
  1. If you want more configurable sikytion, you can use fail2ban or DenyHosts for analyzing SSHd logs and blocking syspicious IPs.
share|improve this answer
thanks for the reply, is there a way to do the same thing adding a denied_hosts file where iptables can read from ? – spacebiker Sep 22 '12 at 19:12
iptables themselves can't read anything from file. It is possible to write a script which parses file and adds/removes iptables rules. You can, however, use /etc/hosts.deny which directly affects sshd. – aland Sep 22 '12 at 19:18
additionally i installed denyhosts which adds attacker's ips to hosts.deny, it works like a charm ! – spacebiker Oct 5 '12 at 16:31

Install the software Denyhosts. It will automatically list such hacker IPs to the hosts.deny. The package is available on the epel repository.

share|improve this answer

the best pratice way is to block all un needed ports with iptables and setup your ssh to use a private key for login. I know that Putty and MobaXterm (both free ssh clients) support private key login. then inside your /etc/ssh/sshd_config remove the

PermitRootLogin yes

and add:

PermitRootLogin without-password

this will make it that even if you know the root password it will not allow you to login with it.

you can use the iptables rules to throttle them so they don't bog down your server as well

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.