Protect SSH From Hackers
add a comment09-Mar-2008 10:44
Your best bet if you're serious about protecting your SSH terminal from hackers is to set up SSH keys and then remove the ability to log in with a password. It also saves you from needing to type in your password every time you connect, since you type it in once to unlock your private key, and then you're all set for the rest of your session.
10-Jan-2008 04:36
Also, a simple application that do the same thing : fail2ban
03-Aug-2007 13:33
I picked this up from someone else. It's really slick. It includes rate limiting and banning for people that connect too frequently.
/sbin/iptables -N SSH
/sbin/iptables -N SSH_ABL
/sbin/iptables -A SSH -m recent --name SSH_ABL --update --seconds 3600 -j REJECT
/sbin/iptables -A SSH -m recent --name SSH --rcheck --seconds 60 --hitcount 5 -j SSH_ABL
/sbin/iptables -A SSH_ABL -m recent --name SSH_ABL --set -j LOG --log-level warn --log-prefix "ABL: +SSH: "
/sbin/iptables -A SSH_ABL -j REJECT
/sbin/iptables -A SSH -m recent --name SSH --rcheck --seconds 2 -j LOG --log-level warn --log-prefix "RATE: "
/sbin/iptables -A SSH -m recent --name SSH --update --seconds 2 -j REJECT
/sbin/iptables -A SSH -m recent --name SSH_ABL --remove -j LOG --log-level warn --log-prefix "ABL: -SSH: "
/sbin/iptables -A SSH -m recent --name SSH --set -j ACCEPT
/sbin/iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 22 -j SSH
28-Jul-2007 13:36
WHere or what files does this iptables command go into?
Kevin
02-Jul-2006 10:48
Here's a simple iptables method to achieve roughly the same result:
iptables -A INPUT -m recent --update --seconds 40 --hitcount 5 --name SSH --rsource -j DROP
iptables -A INPUT -m recent --set --name SSH --rsource -j ACCEPT
If the rules detect 5 attempts to connect to SSH from any given IP address within 40 seconds, it will prevent further connections to SSH from that IP address. If attempts are continued, the counter is reset, thus prolonging the black hole for that IP address.
I've set this up on my server, and it performs really well. Feel free to check your system logs and tweak the timing and the count...
16-Nov-2005 16:52
Another very good tool to deal with this problem is: http://www.pettingers.org/code/sshblack.html
Nice site!
15-Nov-2005 13:10
Slight typo in this starter script - swatchrc should read swatch.rc
Otherwise works great - thanks guys!
14-Sep-2005 20:53
Thanks for a great system. I used to rely on obscure passwords. Now I've added this as an additional layer. Also.... I wrote up a swatch start file for fedora/redhat/centos and thought I should share it. This system stripped out the tabs and extra spaces... so the formatting is shot, but it should still run.
# !/bin/sh
#
# swatch This shell script takes care of starting and stopping
# swatch.
#
# chkconfig: 2345 81 31
# description: Swatch is a System WATCHdog program that we are
# using here to block repeated failed ssh logins.
# processname: swatch
RETVAL=0
test -x /usr/bin/swatch || exit 0
start(){
echo "Starting swatch"
# Spawn a new swatch program
/usr/bin/swatch --config-file=/etc/swatchrc --tail-file=/var/log/secure --awk-field-syntax --tail-args "-F" &
echo $PID
return $RETVAL
}
stop () {
# stop daemon
echo "Stopping swatch:" $PROG
killall swatch
return $RETVAL
}
restart () {
stop
start
RETVAL=$?
return $RETVAL
}
case "$1" in
start)
start
;;
stop)
stop
;;
restart)
restart
;;
*)
echo "Usage: $0 {start|stop|restart}"
RETVAL=1
esac
exit $RETVAL