too many illegal connection attempts through ssh

[Emanuel Strobl]

Am Mittwoch, 6. April 2005 12:07 schrieb Erik Nørgaard:
> Edwin D. Vinas wrote:
> > shown below is snapshot of too many illegal attempts to login to my
> > server from a suspicious hacker. this is taken from the
> > "/var/log/auth.log". my question is, how do i automatically block an
> > IP address if it is attempting to guess my login usernames? can i
> > configure the firewall to check the instances a certain IP has
> > attempted to access/ssh the sevrer, and if it has failed to login for
> > about "x" number of attempts, it will be blocked automatically?
>
> This question is asked on the list ever so often - see the archives for
> suggestions. These are automated attacks, they come regularly as
> crackers, black hats or script kidies scan across the net.

Does anybody know what robots beeing used? And on what systems? All you 
mention later in your posting is true of course and I needn't care about 
these logs, but it's like like somebody unknown puts 10 flyers in your 
letterbox every night. I'm sure, one night you'll hide and build a trap for 
that person. I'm too lazy to enter those net-circles for finding these 
robots, but maybe some other has already done that?

-Harry

>
> You can avoid the automated scanning by chaning port, but this won't
> stop the determined cracker - he will scan all your ports and identify
> which services are running on which ports.
>
> Ask yourself a few questions:
>
> * Do you need to allow ssh from anywhere? If not, restrict to the
>    relevant ip blocks.
>
> * Do you need to allow password based authentication? If not, disable it
>    and use only ssh keys, in sshd_config:
>
>      PasswordAuthentication no
>      PubkeyAuthentication yes
>
> * Do all users need to have ssh access? If not, restrict to specific
>    groups of users, in sshd_config, eg:
>
>       AllowGroups staff
>
> * Is it a problem appart from the log messages? Trying to login with a
>    nonexistent username is usually not a problem.
>
> Other tips: Disable ssh1, reduce the number of simultaneous non-authen-
> ticated connections, set timeouts etc.
>
> Cheers, Erik
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20050406/767f53b5/attachment.bin