Is there an easy way to block an IP that runs a brutforce login attack on my sshd? Maybe just an increasing time for the login prompt to appear.

I know fail2ban, but that did hang when I tried it. Also it needs semdmail, which I don't want to setup on my desktop. And I don't want to send an email over the internet when there is something happening. If fail2ban could instead use desktop notifications (D-Bus) it would be great. But I wonder why I have to install something separate just for something like this? Why can't sshd do that? (Increase the wait time when the same IP has multiple failed login attempts.)

  • I'd look into troubleshooting fail2ban. It's really about the perfect solution for what you're trying to do. – bobmagoo Sep 17 '12 at 16:44
  • I'd Look into APF (Advanced Policy-based Firewall) which has DOS (denial of service) prevention features. I usually configure SSHD to disallow password-based authentication and to operate on a high-numbered port. This helps reduce log clutter. – RedGrittyBrick Sep 17 '12 at 16:47
  • I think you just need mailx, which implements the sendmail program, which sends mail. This is not directly related to the sendmail mail transfer agent. – Eroen Sep 17 '12 at 16:59
  • Unless you are protecting a DOS attempt at the kernel level, you aren't preventing any DoS. – EdH Mar 14 '13 at 5:44

An alternative to fail2ban is DenyHosts which updates /etc/hosts.deny instead of managing netfilter rules.

| improve this answer | |
  • I use Denyhosts, mainly because I couldn't get fail2ban to work properly. – Eroen Sep 17 '12 at 17:00
  • hosts.deny is TCP Wrappers. It's deprecated. See below. – EdH Mar 14 '13 at 5:45

The best way to do this is to use netfilter's built-in capabilities. You want to timeout if the TCP port is hit too many times in a given amount of time.

There is a last seen time stamp for each host...

$ sudo iptables -A INPUT  -p tcp -m tcp --dport 22 -m state \
    --state NEW -m recent                                   \
    --update --seconds 60 --hitcount 4 --name DEFAULT --rsource -j DROP

Read the full article here. http://blog.bigdinosaur.org/securing-ssh-with-iptables/

There are also a number of more sophisticated plugins for netfilter that do this.

Don't use hosts.deny, that is old old. That's TCP Wrappers which is ancient and requires programming support.

I've used this technique on production firewalls and it works well.

| improve this answer | |
  • These rules allow an attacker to DoS arbitrary clients by sending packets with spoofed source IP address at a high-enough rate. DenyHosts OTOH will only block addresses where an authentication attempt failed. At this point the TCP connection was already established, so address spoofing is largely ruled out. – Ansgar Wiechers Mar 14 '13 at 8:25
  • uh hu... I suppose that is a risk, if your ISP and their downline routers (and their peering partners router) somehow allow spoofed IP packets. Are we back in 1994? :) - if that's going on - you have much larger problems than SSH logins. – EdH Mar 15 '13 at 17:32
  • You may find the answers to this question on IT Security enlightening. – Ansgar Wiechers Mar 15 '13 at 17:58
  • Well, try doing IP spoofing... You may find success in certain parts of the world, b/t some networks. The main issue is at the BGP level where your packets will usually get dropped b/c peering services won't pass your pack. Even if they do you will also need to nav your own ISP. Enough weird packs from an unusual interface and it will set off an IDS. But if the main point here is to keep people from breaking into SSH, then denying based on hit count is reasonable. – EdH Mar 15 '13 at 20:27
  • Would I recommend this for HTTP or some HA service? no. You would need to use an anomaly detection IDS. The issue with TCP Wrappers is that while it may be supported by that compile of OpenSSH, but when this users swaps out to say anything else - maybe Dropbear or something, or just recompiles SSH - they won't be protected. TCP Wrappers was designed for the era of super-servers. – EdH Mar 15 '13 at 20:28

You should create your own fail2ban actions and filters. Let me show an example

Simply add lines for your new desktop notify action in /etc/fail2ban/jail.conf

enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
         ssh-with-desktop-notification[title=<Title Here>, content=<Content Here>]
logpath = /var/log/secure
maxretry = 3

Crate a new file that name in /etc/fail2ban/actions.d/ssh-with-desktop-notification.conf and add any command to actionstart, actionstop events. For example ,i am assuming that you are using GNOME as a desktop environment,

actionban =  `which notify-send` <content>

After all these new lines do not forget to restart fail2ban service.

/etc/init.d/fail2ban restart

In conclusion, this new fail2ban action checks /var/log/secure log file for breaking attemps. After 3 failed actions it will run iptables with three parameters(name, port and protocol). After running iptables fail2ban will look to /etc/fail2ban/actions.d folder for ssh-with-descktop-notifications.conf file. If the file exist then it will look to file for actionban event. Then, if actionban event exist fail2ban executes actionban commands with parameters(title and content) when banning an IP.

Note : Please check commands are executed with fail2ban user rights.

| improve this answer | |

You don't give much information about your configuration, but if you're using a router, you can usually program them with an inbound filter that will cause it to block anything from a specified IP or IP range. For example, with my D-Link, I go to the Advanced Settings tab and select the Inbound Filter page.

| improve this answer | |
  • My router (speedtouch DSL modem) is pretty bad. The web interface is confusing and cumbersome and lies to me (I did block some ports through the interface but I could still be reached on those ports!). So that's why I don't use that. – panzi Mar 15 '13 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.