4

A very insistent individual is trying continuously to gain (unauthorized) access to my system for the last few days... There are a gazillion of entries, like in /var/log/auth.log:

Jun 21 03:55:15 cloudy sshd[32487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.20  user=root
Jun 21 03:55:16 cloudy sshd[32487]: Failed password for root from 116.31.116.20 port 30629 ssh2
Jun 21 03:55:19 cloudy sshd[32487]: Failed password for root from 116.31.116.20 port 30629 ssh2
Jun 21 03:55:21 cloudy sshd[32487]: Failed password for root from 116.31.116.20 port 30629 ssh2
Jun 21 03:55:21 cloudy sshd[32487]: Received disconnect from 116.31.116.20: 11:  [preauth]
Jun 21 03:55:21 cloudy sshd[32487]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.20  user=root

I would like to ask for some advice on how to block this individual from consuming resources from the computer, is there a possibility to "hard block" the IP from even opening an ssh connection? Please note, I use Debian 8 as OS.

5 Answers 5

5

From http://www.linuxquestions.org/questions/linux-newbie-8/how-to-configure-ssh-to-allow-or-deny-specify-host-ip-address-610246/

Add sshd: 116.31.116.20 to /etc/hosts.deny

1
  • 4
    This won't work for everyone. hosts.deny is part of an external library called TCP Wrappers. The SSH server will only honor this file if tcp wrapper support was included by whoever compiled it. Current versions of OpenSSH no longer contain TCP Wrapper support, although Linux distro maintainers may still be adding it back in to the OpenSSH packages that they distribute.
    – Kenster
    Jun 21, 2016 at 14:01
2

You can also use iptables

Create a file with ip addresses you want to block as blocked.ips.txt

Now create and run a script containing the following:

blocked=$(egrep -v -E "^#|^$" ./blocked.ips.txt)
for ip in $blocked
do
    iptables -I INPUT -s $ip -p tcp --dport ssh -j DROP
done

Running iptables -L should give output of dropped packets

1
  • 1
    This solution could be improved by adding >blocked.ips.txt after the iptables command runs. That clears the blocked.ips.txt file. That way IPs can be added and cleared on an ongoing basis without duplicating rules (which is what would happen each time the script is run unless the content is cleared each time). This assumes the user is keeping close track of what IP's have been added previously.
    – MJiller
    Feb 23, 2021 at 3:59
1

iptables approach is the most direct way. Erik Handriks proposed it as a script.

Two but-s: - the script would have to be started after every restart, (if tables not backed up internally with iptables). - calling the script as is, twice or more will duplicate entries.

Try simply nailing the bad guy with:

iptables -I INPUT -s BAD_IP -p tcp --dport ssh -j DROP

In most distributions, iptables has own rules-save-restore mechanism. See if '/var/lib/iptables/rules-save' is present. For your distro, it might sit somewhere else (gentoo here).

After you add every single BAD IP, try:

iptables-save > /var/lib/iptables/rules-save

After restart, check with 'iptables -L' what's out there...

0

You may want to use Fail2Ban to monitor logs and block IP automagically. It is possible to specify time period and fail count to block IP address, inform administrator, send complain to IP owner etc.

See for more info: https://www.upcloud.com/support/installing-fail2ban-on-debian-8-0/

0

On my server (Ubuntu 16.04) I use UFW (UncomplicatedFireWall), a simplification layer over iptables) which seems to be pretty much standard issue on Ubuntu servers (but should be available for other distros). For these cases I use:

ufw insert 1 deny from nnn.nnn.nnn.nnn

UFW also allows you to limit the number of connections

ufw limit ssh/tcp

Note that this also applies to successful connections, so if you use scripts that use multiple ssh command, you have to disable this limit for your IP by issuing:

ufw insert 1 allow in from nnn.nnn.nnn.nnn

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .