1

At some point in the past I had a small (physical) webserver. From day 1 there were brute force attacks to ssh.

I looked it up a bit and I set up iptables to block IPs that try to connect to ssh more than twice in a 2 minute period. This lead to distributed brute force attacks from whore ranges of IP addresses.

Eventually I solved my problem by allowing only an other computer that I had an account on to connect to my ssh. However the question remains. If login only with keys is for whatever reason inconvenient, how can one defend against brute force attacks to ssh?

Improve this question
2
  • 2
    Just whitelist your IP that is IMO the best defence
    – Ludisposed
    Jun 6, 2017 at 15:03
  • Yes, but I didn't have static IP at home. But this doesn't solve the problem. I whitelisted the IP of a university server I had access to. There I would just log in with my username and password from any IP. Which just shifts the problem to someone else than me.
    – tst
    Jun 6, 2017 at 15:37

1 Answer 1

Reset to default
7

The best defenses I have found for the host machine are these:

  1. Disable Admin login
  2. Disable password login for users, RSA keys only, if you need more security look at ECDSA.
  3. Disable ICMP if you can (Considering you're a web server...)
  4. UFW and IPTable rules doing what you specified and make sure IPtables is logging the incidents.
  5. Fail2ban - Install, configure, etc.
  6. Denyhosts - Install, configure, etc.
  7. Install logwatch with verbose output to maintain a clean view of your logs at a moments notice.

Network/router rules can allow white-listing which, if deployed properly, is very very effective.

Improve this answer
4
  • Agree on all points, and would also suggest changing the default port from 22 to something more esoteric. That eliminated 95% of the automated attacks I've seen across the board.
    – Ivan
    Jun 6, 2017 at 16:11
  • I am not sure I understand correctly but don't Fail2Ban and Denyhosts assume that the attacker uses only few IPs? Which can be dealt with using just iptables? What if it is a distributed attack?
    – tst
    Jun 6, 2017 at 19:29
  • 1
    You will never truly be able to mitigate an attack but, you can mitigate the attack vectors by using layered security. The reason I recommend these tools, as do most info-sec persons, is because you need to take a layered security approach. Many brute Force attacks come from the same IP addresses every single day, blocking those mitigates the unnecessary burden of having to mark that IP and remember it for later. It also allows you to focus on other attack vectors not so easily defeated by common rules and software packages.
    – Joshua Faust
    Jun 6, 2017 at 19:51
  • #2 will defend against 99.9+% of attacks.
    – multithr3at3d
    Jun 6, 2017 at 20:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .