2

Is there a way in Linux to delay, for example double the delay time, of the ssh root access every time an ssh root login fails from a given IP and them let the delay expire after X minutes of no login attempts or success?

The aim is to mitigate brute force ssh/root access attacks to my servers.

I'm using Debian and Ubuntu.

Thank you.

15
  • 2
    As this is a specific Linux configuration question, I'm voting to migrate to SuperUser.
    – schroeder
    Apr 20, 2015 at 18:04
  • Just to be sure - can you use fail2ban? fail2ban.org/wiki/index.php/Main_Page there is no exponential backoff, but simply blocks an IP after N-attempts.
    – ninjajesus
    Apr 20, 2015 at 18:10
  • 3
    @schroeder I disagree as any security question applicable to Linux will involve some kind of Linux configuration unless it is a purely theoretical question (example security.stackexchange.com/questions/21027/…)
    – Wulfire
    Apr 20, 2015 at 18:18
  • Exactly. Your question has security implications, but the heart of it is a specific configuration/tool question, which is off topic here and better suited for SuperUser.
    – schroeder
    Apr 20, 2015 at 18:20
  • I had migrated it to unix SE. But also I think this question has enough security focus to remain here, maybe unix SE is more better place for him (finally I voted with schroeder, only because I think migration is a good thing, but unix SE migration path doesn't exist).
    – peterh
    Apr 20, 2015 at 18:20

1 Answer 1

0

My answer is primarily Linux configuration, not really security. It addresses your aim but doesn't provide for resetting the timeout on a correct password or incrementing it while already banned. That probably has to be out of band, using some other event as a key.

This answer links to an article showing how to deal with repeat offenders once, and this shows how to perform an incrementing ban. Since just linking is bad I'll try to rephrase what it's doing.

In effect, you want to create several configuration blocks that use nearly identical names; the author uses "f2b-loop2", "f2b-loop3", and so on. The DEFAULT block is the driver.

Each loop step uses the same filter. That filter ignores all loop-named bans but continues counting the DEFAULT bans over the scantime, effectively making level determine "How many times has DEFAULT banned this IP in my scan period/findtime?". The total attempts that trigger successively higher bantimes are therefore a multiplication of DEFAULT's maxtimes and the loop level's maxtimes.

You can continue this pattern to end with a negative bantime to permanently ban.

1
  • * I also voted to relocate this question because it feels very administrative. Apr 20, 2015 at 22:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .