Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My server is under attack. I am logging this kind of attempts:

Sep 22 06:39:11 s1574**** sshd[16453]: Failed password for invalid user amber from        64.215.17.4 port 35182 ssh2
Sep 22 04:39:11 s1574**** sshd[16454]: Received disconnect from 64.215.17.4: 11: Bye Bye
Sep 22 06:39:11 s1574**** sshd[16457]: Invalid user amber from 64.215.17.4
Sep 22 04:39:11 s1574**** sshd[16458]: input_userauth_request: invalid user amber
Sep 22 06:39:11 s1574**** sshd[16457]: pam_unix(sshd:auth): check pass; user unknown
Sep 22 06:39:11 s1574**** sshd[16457]: pam_unix(sshd:auth): authentication failure;     logname= uid=0 euid=0 tty=ssh ruser= rhost=dns2.rsd.com 
Sep 22 06:39:11 s1574**** sshd[16457]: pam_succeed_if(sshd:auth): error retrieving     information about user amber
Sep 22 06:39:14 s1574**** sshd[16457]: Failed password for invalid user amber from 64.215.17.4 port 35842 ssh2
Sep 22 04:39:14 s1574**** sshd[16458]: Received disconnect from 64.215.17.4: 11: Bye Bye

What can i do to block this kind of access attempts, something like blocking ip when more than 3 denie

share|improve this question
    
Welcome to the Internet. –  techie007 Sep 22 '12 at 18:35
add comment

3 Answers

up vote 2 down vote accepted
  1. You can limit number of log in attempts per minute with iptables. Such rules will block IP for 1 minute after 3 login attempts: (taken from here):
    iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT
    iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j LOG --log-prefix "SSH_brute_force "
    iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP
  1. If you want more configurable sikytion, you can use fail2ban or DenyHosts for analyzing SSHd logs and blocking syspicious IPs.
share|improve this answer
    
thanks for the reply, is there a way to do the same thing adding a denied_hosts file where iptables can read from ? –  Xabier Arrabal Sep 22 '12 at 19:12
    
iptables themselves can't read anything from file. It is possible to write a script which parses file and adds/removes iptables rules. You can, however, use /etc/hosts.deny which directly affects sshd. –  aland Sep 22 '12 at 19:18
    
additionally i installed denyhosts which adds attacker's ips to hosts.deny, it works like a charm ! –  Xabier Arrabal Oct 5 '12 at 16:31
add comment

Install the software Denyhosts. It will automatically list such hacker IPs to the hosts.deny. The package is available on the epel repository.

share|improve this answer
add comment

the best pratice way is to block all un needed ports with iptables and setup your ssh to use a private key for login. I know that Putty and MobaXterm (both free ssh clients) support private key login. then inside your /etc/ssh/sshd_config remove the

PermitRootLogin yes

and add:

PermitRootLogin without-password

this will make it that even if you know the root password it will not allow you to login with it.

you can use the iptables rules to throttle them so they don't bog down your server as well

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.