Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My server is currently being attacked from another server. This is my log:

root@my-server:/var/log# tail -f auth.log
Feb 19 11:53:08 my-server sshd[3745]: Disconnecting: Too many authentication failures for root [preauth]
Feb 19 11:53:08 my-server sshd[3745]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.32.114.181  user=root
Feb 19 11:53:08 my-server sshd[3745]: PAM service(sshd) ignoring max retries; 6 > 3
Feb 19 11:53:39 my-server sshd[3747]: Address 125.32.114.181 maps to 181.114.32.125.adsl-pool.jlccptt.net.cn, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Feb 19 11:53:41 my-server sshd[3747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.32.114.181  user=root
Feb 19 11:53:44 my-server sshd[3747]: Failed password for root from 125.32.114.181 port 1680 ssh2
Feb 19 11:53:57  sshd[3747]: last message repeated 5 times
Feb 19 11:53:57 my-server sshd[3747]: Disconnecting: Too many authentication failures for root [preauth]
Feb 19 11:53:57 my-server sshd[3747]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.32.114.181  user=root
Feb 19 11:53:57 my-server sshd[3747]: PAM service(sshd) ignoring max retries; 6 > 3

What are the first steps in preventing such kind of attacks?

share|improve this question

3 Answers 3

up vote 8 down vote accepted

Considering he's doing full tcp-ip handshakes, installing a HIDS like OSSEC or fail2ban should work quite nicely to autmatically drop this traffic.

share|improve this answer

Moving SSH to an alternate port is not a bad idea. While it won't protect you from a determined attacker who takes the time to run a full portscan, it will in fact prevent 99.9999% of all attacks.

The vast majority of all public web servers will never even see a single determined attacker who would take the time to find your SSH port. However, all servers on the Interent can expect to have port 22 attacked, typically some tens of thousands of times per day, every day.

These SSH scans are automated, impersonal, and typically try a very limited number of passwords -- somewhere on the range of 10 to 10,000 attempts per attacker. So as long as all your SSH passwords are long and unpredictable, you should have nothing to worry about.

Nonetheless, SSH keys are always better than passwords. Particularly for root, password authentication should be disabled altogether. Either disable direct login as root (preferred) or disable password authentication for root using PermitRootLogin without-password in your sshd_config file.

share|improve this answer
    
actually different port was my answer ;c) but I appreciate the ssh key solution... +1 –  Dee Feb 20 at 7:49

First simple solution is to ban IP address from where the attack is coming. This could be done on router or server itself. Usually afterwards the IP changes and attacks continues.

Updated: Another simple solution could be IP filtering. This could be done on router and on server firewall. This is applicable when you use SSH from certain destination only. Usually there could be some another machine used just as a doorway for multiple servers. Server would be just unreachable on that port for another IP's.

Another very simple solution could be to place SSH to different port number (as 9022, etc.) and leave 22 "empty". This is "security by curiosity". Updated: Server would be unreachable on port 22, but you are still vulnerable, when someone scans your ports.

To prevent brute force on server you can use SSHGuard which protects several services or another similar utility, as fail2ban mentioned before. Update: These tools will edit firewall rules automatically, usually according to parsing log files... and they can do a lot more.

share|improve this answer
1  
Moving service to another port will just postpone the attack. If attacker has a purpose of attack, he will change the port immediately. Security by obscurity is not a best solution :) –  boleslaw.smialy Feb 19 at 14:44
3  
@boleslaw: surprisingly security by curiosity stops all attacks on my servers on SSH port. Most attacks are not targeted on your server, they just search for vulnerability on common ports by prepared script/exploit and if there is no sucess, they choose another IP. For targeted attacks surely some advanced solution is necessary. –  Dee Feb 19 at 16:29
    
@Dee Which one is more preferable SSHGuard or fail2ban? Or can I use both of them? –  torayeff Feb 19 at 16:54
    
Actually for SSH both do the same and I would not even test it together. Therefore decision is up to you, if you need something just for ssh, take fail2ban with easy setup, if you could use protection of other services, use SSHGuard with more complicated setup but higher value. –  Dee Feb 20 at 7:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.