securing sshd

[Leonidas Tsampros]

Jamie Griffin <Jamie at fantomatic.co.uk> writes:

> Hello
>
> I've been reading up on securing sshd after being bombarded with attempted logins. 
>
> The steps i've taken so far to make things more secure are:
>
> * changed the encryption method for passwords in /etc/login.conf from md5 to blowfish and changed all the passwords to ridiculously obscure ones (at least as obscure as I could think of).
>
> * changed /etc/ttys secure entries to insecure to prevent root logins on the console
>
>   (the above are not really sshd specific i know.)
>
> * Disabled root login by ssh in /etc/ssh/sshd_config
>
> * Set myself as the only user able to login by ssh
>
> * Disabled password logins completely, and to only allow public key authentication
>
> * Changed the default ssh port from 22 to something much higher
>
> I'm the only user that will ever need to log into the machine. I wondered, does this setup seem ok and are there any other methods used by anyone on list that might help me to secure remote logins even further?

Hi,

I'm using the following pf snippet in order to "protect" myself and my
system's logs against brute force attemps on sshd:

#
# Block them all
#
block log quick from <bruteforce_ssh>

#
# connection rate the incoming ssh connections and fill the bruteforce
# table
#
pass in log inet proto tcp from any to any port = 22 \
     flags S/SA keep state \
     (max-src-conn 10, max-src-conn-rate 5/4, \
     overload <bruteforce_ssh> flush global)

For more information on how this works, take a look at pf.conf(5).

I don't know if it's complete (or even good practice), but a) I think it
works for me and b) it does not depend on a port-provided solution.

> Thanks for any help.
>
> Jamie
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"