Home / server / Questions / 4188
Accepted
grieve
Asked: 2009-05-05 09:46:04 +0800 CST

Preventing brute force attacks against ssh?

  • 772

What tool or technique do you use to prevent brute force attacks against your ssh port. I noticed in my Security logs, that I have millions of attempts to login as various users through ssh.

This is on a FreeBSD box, but I imagine it would be applicable anywhere.

security ssh brute-force-attacks

14 Answers

  1. I use fail2ban which will lock an IP out after several failed attempts for a configurable amount of time.

    Combine this with password strength testing (using john (John the Ripper)) to ensure brute-force attacks will not succeed.

    • 43
  2. Best Answer

    Here's a good post on that subject by Rainer Wichmann.

    It explains pros and cons on theses methods to do it :

    • Strong passwords
    • RSA authentication
    • Using 'iptables' to block the attack
    • Using the sshd log to block attacks
    • Using tcp_wrappers to block attacks
    • Port knocking
    • 27

  3. Ons small thing you can do is use something like DenyHosts:

    http://denyhosts.sourceforge.net/

    It uses the built-in hosts.allow/hosts.deny to block out SSH abusers.

    • 24
    • 16

  5. One of the easiest ways to avoid these attacks is to change the port that sshd listens on

    • 15

  6. As Chris points out, use encryption keys instead of passwords.

    Add to that:

    • use a whitelist where possible.

    How many people or locations (with floating public IPs) do you really need accessing your public ssh connections ?

    Depending on the number of public ssh hosts you are maintaining and whether you can narrow down your general connection criteria's then it may be a simpler, maintanable configuration to limit access to a few external hosts.

    If this works for you, it can really simplify your administration overhead.

    • 12

  7. In addition to the other good suggestions, one really easy thing to do is rate-limit incoming connections. Limit to 3 connections per minute per IP:

    iptables -A INPUT -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
    • 12

  8. Use the "AllowUsers" option in sshd_config to ensure only a small set of users can log in at all. All others will get rejected, even if their username and password are correct.

    You can even restrict users to logins from a particular host.

    e.g.,

    AllowUsers user1 [email protected]

    This will reduce the search-space and avoid those old users which have accidentally been left laying around or enabled (although these of course should be disabled anyway, this is an easy way to stop them being used for an SSH-based entry).

    This doesn't entirely stop the brute-force attacks, but helps reduce the risk.

    • 6

  9. Use something like that with PF:

    table <ssh-brute> persist
    block in quick log from label ssh_brute
    pass in on $ext_if proto tcp to ($ext_if) port ssh modulate state \
    (max-src-conn-rate 3/10, overload flush global)

    • 3

  10. Port-knocking is a pretty solid way to keep this sort of thing out. Slightly fiddly, sometimes annoying, but it definitely makes the issue go away.

    • 2