1

My server is under attack. I am logging this kind of attempts:

Sep 22 06:39:11 s1574**** sshd[16453]: Failed password for invalid user amber from        64.215.17.4 port 35182 ssh2
Sep 22 04:39:11 s1574**** sshd[16454]: Received disconnect from 64.215.17.4: 11: Bye Bye
Sep 22 06:39:11 s1574**** sshd[16457]: Invalid user amber from 64.215.17.4
Sep 22 04:39:11 s1574**** sshd[16458]: input_userauth_request: invalid user amber
Sep 22 06:39:11 s1574**** sshd[16457]: pam_unix(sshd:auth): check pass; user unknown
Sep 22 06:39:11 s1574**** sshd[16457]: pam_unix(sshd:auth): authentication failure;     logname= uid=0 euid=0 tty=ssh ruser= rhost=dns2.rsd.com 
Sep 22 06:39:11 s1574**** sshd[16457]: pam_succeed_if(sshd:auth): error retrieving     information about user amber
Sep 22 06:39:14 s1574**** sshd[16457]: Failed password for invalid user amber from 64.215.17.4 port 35842 ssh2
Sep 22 04:39:14 s1574**** sshd[16458]: Received disconnect from 64.215.17.4: 11: Bye Bye

What can i do to block this kind of access attempts, something like blocking ip when more than 3 denie

6
  1. You can limit number of login attempts per minute with iptables. Such rules will block IP for one minute after three login attempts (taken from Diary of a geek – Mitigating against SSH brute force attacks using Netfilter and the recent module):

    iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
    iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSH_WHITELIST
    iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
    iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP
    
  2. If you want more configurable sikytion, you can use fail2ban or DenyHosts for analyzing SSHd logs and blocking suspicious IP addresses.

| improve this answer | |
  • thanks for the reply, is there a way to do the same thing adding a denied_hosts file where iptables can read from ? – spacebiker Sep 22 '12 at 19:12
  • iptables themselves can't read anything from file. It is possible to write a script which parses file and adds/removes iptables rules. You can, however, use /etc/hosts.deny which directly affects sshd. – aland Sep 22 '12 at 19:18
  • additionally i installed denyhosts which adds attacker's ips to hosts.deny, it works like a charm ! – spacebiker Oct 5 '12 at 16:31
1

the best pratice way is to block all un needed ports with iptables and setup your ssh to use a private key for login. I know that Putty and MobaXterm (both free ssh clients) support private key login. then inside your /etc/ssh/sshd_config remove the

PermitRootLogin yes

and add:

PermitRootLogin without-password

this will make it that even if you know the root password it will not allow you to login with it.

you can use the iptables rules to throttle them so they don't bog down your server as well

| improve this answer | |
1

Install the software Denyhosts. It will automatically list such hacker IPs to the hosts.deny. The package is available on the epel repository.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.