Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like:

  • one attempt to log as root is a ban
  • three attempts to log as a nonexistent user in a day is a ban
  • a port scan is a ban (this i know there are tools for this like psad)

i'm wondering if there is a tool that allows this, also, you think its feasible to keep such an ever growing lists or there are better approaches for this?

Given the levels of brute-force ssh traffic i get, i'm tempted to filter everything by default and whitelist specific client ips (i don't host web so it is an option) but i would like to hear other approaches for this matter

thanks!

share|improve this question
    
For what operating system? –  this.josh Jul 15 '11 at 17:50
    
ubuntu linux 10.10 –  lurscher Jul 15 '11 at 18:45
add comment

4 Answers

Fail2ban has different defaults, but I think you could probably configure it meet your desires. I personally think the 10 bad logins per IP default is more than sufficient to keep resources down and avoid locking yourself out by typo or brainfart.

share|improve this answer
1  
+1 fail2ban is what I use. To confirm, it does allow you to customise your rules including ban length, number of failures and any IP addresses that should be ignored/have different rules. –  user2213 Jun 6 '11 at 19:25
    
I agree. Definitely prefer more than 3 fails to instigate a ban. 10 is better. a brute force would typically have hundreds so you aren't losing security for this slight gain in user-friendliness. –  Rory Alsop Jun 6 '11 at 19:25
    
It includes functions for whitelisting IPs, adjusting ban length, and selecting the number of failures among lots of other goodies. I don't think it includes the ability to set a different number of attempts based on differing criteria, though. –  Jeff Ferland Jun 6 '11 at 19:35
    
What I'm seeing is anywhere between 8-20 on the aggregate once to twice daily with some outliers once or twice a week in the dozens. (80-90 or so) –  Ori Jun 8 '11 at 2:04
add comment

Look into using OSSEC.

You can build custom rules based on OSSEC's default ruleset. For example, OSSEC by default alerts on the following SSH events:
http://www.ossec.net/doc/rules/rules/50_sshd_rules.xml.html

An example of a custom rule:

<rule id=“100005” level=“10” frequency=“3” timeframe=“600”>
<if_matched_sid>100124</if_matched_sid>
<description>3 Failed passwords within 10 minutes</description>
</rule> 

You can create customized active responses (e.g. call a script to add iptables rules or to add the source IP to a flat file or database):
http://www.ossec.net/doc/manual/ar/ar-custom.html

share|improve this answer
add comment

DenyHosts is ssh attack mitigation software that uses a shared database to identify and prevent ssh attacks. It has good configurable settings and is written in Python, so it is moderatly portable. Plus, it has a beautiful statistics page.

share|improve this answer
add comment

Or configure the sshd

  • to permit keypair-based login
  • not to permit password-based login
  • not to permit root login
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.