Re: [PLUG] SSH brute force attacks using PlcmSpIp

[Fred Stluka <fred@bristle.com>]

+1 for fail2ban.

I also use logwatch and tripwire.  It's a nice combination:
- logwatch -- see all the hackers trying to get in
- fail2ban -- block the persistent hackers and see much
                     smaller numbers in the logwatch reports
- tripwire -- tell me if anyone did get in
See my summary of each of these, and also port-knocking
(which I have not yet set up) at:
    http://bristle.com/Tips/Unix.htm#unix_security

By default fail2ban blocks an IP address for 10 minutes after
3 failed attempts within 10 minutes.  However, I found that
some automated brute force attacks take this into account
and time things accordingly.  They come back 11 minutes
after being blocked, try every 4 minutes or so to avoid being
blocked, etc.  Therefore, I changed the settings to block for
much longer after fewer attempts within more time.  If I or
another valid user get locked out accidentally at one IP address,
I can always come in via the IP address of another server, and
remove the block.

For those occasions when I want to block an IP permanently,
I wrote scripts:
    http://bristle.com/Tips/Unix/ipblock
    http://bristle.com/Tips/Unix/ipunblock

I also lock down ssh to disallow root login and to only allow
a couple of specific users to login.  And I configure sudo, so
that specific users can do privileged operations, and no one
ever has to su to root.  All ssh access is via keys, not
passwords, so I wrote a script to make it easy to generate keys
and/or push them a new server:
    http://bristle.com/Tips/Unix/authorize_ssh_key

--Fred
------------------------------------------------------------------------
Fred Stluka -- mailto:fred@bristle.com -- http://bristle.com/~fred/
Bristle Software, Inc -- http://bristle.com -- Glad to be of service!
Open Source: Without walls and fences, we need no Windows or Gates.
------------------------------------------------------------------------

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug