Date: Wed, 7 Mar 2018 16:56:19 +0000 From: tech-lists <tech-lists@zyxst.net> To: freebsd-questions@freebsd.org Subject: Re: Increased abuse activity on my server Message-ID: <45bb7ffb-c11e-6664-827e-7e2e6a31ad93@zyxst.net> In-Reply-To: <20180307071944.GA30971@ymer.bara1.se> References: <20180307071944.GA30971@ymer.bara1.se>
next in thread | previous in thread | raw e-mail | index | archive | help
On 07/03/2018 07:19, User Hasse wrote: > Hello All > I belive I see an increased amount of abuse attempt on my server by several 100% > in the last couple of months. Anybody else noticed ? You'll get that especially if you run on the standard port. You need a layered approach. man 5 sshd_config. 1. put ssh on a non-standard port [but this won't stop some scanners scanning all ports until they get a ssh response] Make sshd log auth attempts to a file that gets cleared every week because you don't want to be DOSed by your log files filling up. Compress your logs daily. 2. if you can, allow only certain users in /etc/ssh/sshd_config via the AllowUsers statement. 3. if you can, wrap those sshd users to known ips using the same AllowUsers statement. Syntax is user@192.168.1.0/24 for example. I think, but am not sure, that you can have multiple statements for the same (and other) users. There's also AllowGroups if you want to group your ssh users. There's DenyUsers for logins like root you want to specifically protect. 4. make sshd listen on only one interface [because sshd by default listens to them all] 5. if you're dual-stack, make sshd either inet or inet6 [by default it'll listen on both] 6. make ssh access via public key only. I think (though I haven't tried) to make only certain logins able to log in with a (tunneled) password, and all others public key only. 7. RSA keys are becoming depreciated. I think ed25519 is the most modern. This is what I do, anyways. I'm sure you can fine tune this more. -- J.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?45bb7ffb-c11e-6664-827e-7e2e6a31ad93>