Is there a 'step by step' or canned-package to block incoming ssh attempts from anywhere not in the USA?

No one but me or a handful of coworkers should be trying to ssh into my desktop at home; of course life is not so nice and my /var/log/auth.log is full of attempted root log-ins from all over the world...

A complicated solution would be to somehow grab the IP, look it up on the web via scripted HTTP lookup, then decide on action... is there a canned script or package that blocks by country?

(note: I have installed denyhosts, works well to block after an attempt, but there are just so many attempts from a wide range of IPs!)

related question: Game server - How can I block connections from other countries?


In don't think thera are any precanned solutions. For various reasons they would only be partially effective.

Install a good firewall. (I use Shorewall to build mine.)

Consider using port knocking to keep the port closed unless it is required. Open ssh to addresses you know need to use it. For users on dynamic addresses you can use whois to determine the likely size of the block they are in. The open rules need to go before the port knocking rules.

Consider using fail2ban to block addresses which scan you.


If you or your coworkers will have static IPs, you can use the /etc/hosts.allow and /etc/hosts.deny files.

For example in /etc/hosts.allow, you could put...


And for /etc/hosts.deny...


That denies all ssh access except by You can also use wildcards if needed.

  • Ok so isn't there a master list of ip strings by country? How does the lookup by IP do it on the web? – peter karasev Oct 25 '10 at 17:29

one easy thing to thwart ssh attacks is to change your ssh port. you can also whitelist certain ips using denyhost or authfail.

  • To add to this, I would set up a strict IPTables-based firewall. – brandon927 Oct 25 '10 at 2:04
  • and / or port knocking. - then there's no ssh visible at all. – Sirex Oct 25 '10 at 8:41
  • Well ports 23 and 24 already forward to fileserver and laptop, and yes there are not many attempts. I just want 22 to go to the " i7 dual ssd beast" workstation so data can be uploaded for processing with less typing ;-) – peter karasev Oct 25 '10 at 17:28

I agree with yanokwa but want to add a bit.

I agree with both the use of an alternated SSH port and whitelisting IPs. Minimal effort but significant gain.

The problem you get there is if home users don't have static IP's which most ISPs don't provide. An alternative would be a hybrid approach. You can leave port 22 as your standard port and whitelist IPs for that port such as anything on your own subnet and a few "trusted" IPs (which could probably be spoofed if they really cared). Then, use iptables to use another port (one above 1024) to listen and forward internally to port 22.

Therefore, port 22 has a significantly smaller attack surface and you can still connect from any IP such as if you needed to connect from your local wifi hotspot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.