Date: Wed, 06 Apr 2005 12:07:10 +0200 From: =?ISO-8859-1?Q?Erik_N=F8rgaard?= <norgaard@locolomo.org> To: "Edwin D. Vinas" <xmisoy@gmail.com> Cc: freebsd-questions@freebsd.org Subject: Re: too many illegal connection attempts through ssh Message-ID: <4253B4CE.6070504@locolomo.org> In-Reply-To: <36f5bbba050406001514562df7@mail.gmail.com> References: <36f5bbba050406001514562df7@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Edwin D. Vinas wrote:
> shown below is snapshot of too many illegal attempts to login to my
> server from a suspicious hacker. this is taken from the
> "/var/log/auth.log". my question is, how do i automatically block an
> IP address if it is attempting to guess my login usernames? can i
> configure the firewall to check the instances a certain IP has
> attempted to access/ssh the sevrer, and if it has failed to login for
> about "x" number of attempts, it will be blocked automatically?
This question is asked on the list ever so often - see the archives for
suggestions. These are automated attacks, they come regularly as
crackers, black hats or script kidies scan across the net.
You can avoid the automated scanning by chaning port, but this won't
stop the determined cracker - he will scan all your ports and identify
which services are running on which ports.
Ask yourself a few questions:
* Do you need to allow ssh from anywhere? If not, restrict to the
relevant ip blocks.
* Do you need to allow password based authentication? If not, disable it
and use only ssh keys, in sshd_config:
PasswordAuthentication no
PubkeyAuthentication yes
* Do all users need to have ssh access? If not, restrict to specific
groups of users, in sshd_config, eg:
AllowGroups staff
* Is it a problem appart from the log messages? Trying to login with a
nonexistent username is usually not a problem.
Other tips: Disable ssh1, reduce the number of simultaneous non-authen-
ticated connections, set timeouts etc.
Cheers, Erik
--
Ph: +34.666334818 web: http://www.locolomo.org
S/MIME Certificate: http://www.locolomo.org/crt/2004071206.crt
Subject ID: A9:76:7A:ED:06:95:2B:8D:48:97:CE:F2:3F:42:C8:F2:22:DE:4C:B9
Fingerprint: 4A:E8:63:38:46:F6:9A:5D:B4:DC:29:41:3F:62:D3:0A:73:25:67:C2
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4253B4CE.6070504>