5

i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like:

  • one attempt to log as root is a ban
  • three attempts to log as a nonexistent user in a day is a ban
  • a port scan is a ban (this i know there are tools for this like psad)

i'm wondering if there is a tool that allows this, also, you think its feasible to keep such an ever growing lists or there are better approaches for this?

Given the levels of brute-force ssh traffic i get, i'm tempted to filter everything by default and whitelist specific client ips (i don't host web so it is an option) but i would like to hear other approaches for this matter

thanks!

Improve this question
2
  • For what operating system?
    – this.josh
    Jul 15, 2011 at 17:50
  • ubuntu linux 10.10
    – lurscher
    Jul 15, 2011 at 18:45

4 Answers 4

Reset to default
8

Fail2ban has different defaults, but I think you could probably configure it meet your desires. I personally think the 10 bad logins per IP default is more than sufficient to keep resources down and avoid locking yourself out by typo or brainfart.

Improve this answer
4
  • 1
    +1 fail2ban is what I use. To confirm, it does allow you to customise your rules including ban length, number of failures and any IP addresses that should be ignored/have different rules.
    – user2213
    Jun 6, 2011 at 19:25
  • I agree. Definitely prefer more than 3 fails to instigate a ban. 10 is better. a brute force would typically have hundreds so you aren't losing security for this slight gain in user-friendliness.
    – Rory Alsop ♦
    Jun 6, 2011 at 19:25
  • It includes functions for whitelisting IPs, adjusting ban length, and selecting the number of failures among lots of other goodies. I don't think it includes the ability to set a different number of attempts based on differing criteria, though.
    – Jeff Ferland ♦
    Jun 6, 2011 at 19:35
  • What I'm seeing is anywhere between 8-20 on the aggregate once to twice daily with some outliers once or twice a week in the dozens. (80-90 or so)
    – Ori
    Jun 8, 2011 at 2:04
4

Look into using OSSEC.

You can build custom rules based on OSSEC's default ruleset. For example, OSSEC by default alerts on the following SSH events:
http://www.ossec.net/doc/rules/rules/50_sshd_rules.xml.html

An example of a custom rule:

<rule id=“100005” level=“10” frequency=“3” timeframe=“600”>
<if_matched_sid>100124</if_matched_sid>
<description>3 Failed passwords within 10 minutes</description>
</rule>

You can create customized active responses (e.g. call a script to add iptables rules or to add the source IP to a flat file or database):
http://www.ossec.net/doc/manual/ar/ar-custom.html

Improve this answer
4

DenyHosts is ssh attack mitigation software that uses a shared database to identify and prevent ssh attacks. It has good configurable settings and is written in Python, so it is moderatly portable. Plus, it has a beautiful statistics page.

Improve this answer
4

Or configure the sshd

  • to permit keypair-based login
  • not to permit password-based login
  • not to permit root login
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .