0

At some point in the past I had a small (physical) webserver. From day 1 there were brute force attacks to ssh.

I looked it up a bit and I set up iptables to block IPs that try to connect to ssh more than twice in a 2 minute period. This lead to distributed brute force attacks from whore ranges of IP addresses.

Eventually I solved my problem by allowing only an other computer that I had an account on to connect to my ssh. However the question remains. If login only with keys is for whatever reason inconvenient, how can one defend against brute force attacks to ssh?

  • 2
    Just whitelist your IP that is IMO the best defence – Ludisposed Jun 6 '17 at 15:03
  • Yes, but I didn't have static IP at home. But this doesn't solve the problem. I whitelisted the IP of a university server I had access to. There I would just log in with my username and password from any IP. Which just shifts the problem to someone else than me. – tst Jun 6 '17 at 15:37
5

The best defenses I have found for the host machine are these:

  1. Disable Admin login
  2. Disable password login for users, RSA keys only, if you need more security look at ECDSA.
  3. Disable ICMP if you can (Considering you're a web server...)
  4. UFW and IPTable rules doing what you specified and make sure IPtables is logging the incidents.
  5. Fail2ban - Install, configure, etc.
  6. Denyhosts - Install, configure, etc.
  7. Install logwatch with verbose output to maintain a clean view of your logs at a moments notice.

Network/router rules can allow white-listing which, if deployed properly, is very very effective.

  • Agree on all points, and would also suggest changing the default port from 22 to something more esoteric. That eliminated 95% of the automated attacks I've seen across the board. – Ivan Jun 6 '17 at 16:11
  • I am not sure I understand correctly but don't Fail2Ban and Denyhosts assume that the attacker uses only few IPs? Which can be dealt with using just iptables? What if it is a distributed attack? – tst Jun 6 '17 at 19:29
  • 1
    You will never truly be able to mitigate an attack but, you can mitigate the attack vectors by using layered security. The reason I recommend these tools, as do most info-sec persons, is because you need to take a layered security approach. Many brute Force attacks come from the same IP addresses every single day, blocking those mitigates the unnecessary burden of having to mark that IP and remember it for later. It also allows you to focus on other attack vectors not so easily defeated by common rules and software packages. – Joshua Faust Jun 6 '17 at 19:51
  • #2 will defend against 99.9+% of attacks. – multithr3at3d Jun 6 '17 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.