1

By mistake I have allowed loging as root through ssh, now there are several automated attempts to log as root by some malicious machine. There are so many attempts that the server is slow and my sites are not served right. I tryed disabling the root login by editing

/etc/ssh/sshd_config

with

PermitRootLogin no

and I ran

sudo usermod -p '!' root
sudo passwd -l root
sudo service ssh restart

but the log in auth.log still shows the attempts every second there is a way of blocking this if the attempts are made from several ips ?

1

I assume you use port 22 for ssh, so if this port is open you always get these kind of login attempts. These are mostly automated scans/dictionary attacks aiming on port 22. They will hammer your server regardless if you turned root login off because these are stupid scripts. All you can and should do is secure your server and monitor it constantly. Disabling root access is a good starting point and highly recommended. You can also:

  • Put ssh on a non standard port like 10222.
  • Use a tool like fail2ban and block IPs with too many login attempts. There is also DenyHosts.

This should reduce the "background noise" for a good portion.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.