SSH hacking attempts

Cyker · Veteran Joined: 15 Jun 2006 Posts: 1427

Is it me or has it been intensifying?

I checked my logs for the first time in a while and it was 15MB!

The biggest annoyance is that my brute-force blocker script is no longer effective as they're using distributed IP's (Darn you botnets, darn you to heck!), and while nothing has^H^H^H SEEMS to have gotten in yet, the sheer number of attempts is just scary (And this is with MaxStartups 1!!)

eccerr0r · Advocate Joined: 01 Jul 2004 Posts: 2212 Location: USA

Apparently it's not just you. I can't see how this can't affect internet traffic, this must really use up a considerable amount of bandwidth to do this crap.

Anyway here's my recent OTW post about it, seems at least some people are noting the same thing:

http://forums.gentoo.org/viewtopic-t-811613-highlight-.html
_________________
Core2Quad 9550S/4GB/4x500G RAID5/RadeonHD 5770
What the heck am I advocating?

Cyker · Veteran Joined: 15 Jun 2006 Posts: 1427

Doh, for some reason that thread didn't appear in my search-a-roo o.O

I think this once can be merged

d2_racing · Posted: Mon Jan 18, 2010 1:16 pm Post subject:

You can reduce the attempt on your box with a specific iptables rules that can reduce the number of attempt of a specific ip.

But, if it's a botnet, then the ip source will be spoofed and you go anywhere.

Is there a way to counter a botnet attack that target a ssh connection on your own server ? I know that I can block the port, but is there any more elegant way to do so ?
_________________
Sysadmin of Funtoo-Québec.org
Wiki
Signature
IRC on Freenode : #funtoo-quebec

eccerr0r · Advocate Joined: 01 Jul 2004 Posts: 2212 Location: USA

It's hard...only way is to band with a few people to share banned host lists...
otherwise it will make things inconvenient ... at least that's the conclusion drawn.
_________________
Core2Quad 9550S/4GB/4x500G RAID5/RadeonHD 5770
What the heck am I advocating?

Travisher · n00b Joined: 18 Jan 2010 Posts: 1

SSH attacks are intensifying. Try using a iptables or shorewall rule that limits access to a few specific IP addresses.

Or switch to using ssh keys only. This won't stop them trying but you can sleep at night.
I blagged the following from our internal wiki, I hope this helps.

If you don't use passwords, but only RSA keys for authentication, a brute force search for a valid password will obviously be useless.

(1) Generate an RSA key with ssh-keygen -t rsa. This will create the files /home/username/.ssh/id_rsa (the private key) and /home/username/.ssh/id_rsa.pub (the public key).

mikegpitt · Advocate Joined: 22 May 2004 Posts: 3140

On the one server I have facing the world, I use openvpn to connect and firewall off connections from ip's outside the internal LAN. Even while following glsa's I'd be worried about a 0-day unreported attack... this approach helps me sleep soundly, but might not be appropriate for all.

Shining Arcanine · Veteran Joined: 24 Sep 2009 Posts: 1110

Two tips:

Configure sshd to disallow root logins.
Change sshd's port to an uncommonly used port, most likely above 5000.

d2_racing · Posted: Tue Jan 19, 2010 1:35 am Post subject:

In fact, for my concern, I use ssh port = 5999 and basically my ssh is only available via my lan network, so basically I'm ok.

But if you want that your box is expose to the net, then changing the port is a pretty good idea.
_________________
Sysadmin of Funtoo-Québec.org
Wiki
Signature
IRC on Freenode : #funtoo-quebec

eccerr0r · Advocate Joined: 01 Jul 2004 Posts: 2212 Location: USA

It looks like the attempts have died down for now once again, and life goes on with virtually no changes as most changes would be more painful than the attacks (remote firewalls, etc.)... back down to the usual few per day.

A huge list of bad hosts was collected...
_________________
Core2Quad 9550S/4GB/4x500G RAID5/RadeonHD 5770
What the heck am I advocating?

timeBandit · Posted: Tue Jan 19, 2010 3:03 am Post subject:

Moved from Networking & Security to Duplicate Threads.

SSH brute force attacks, the botnets that drive them, the defenses against them and the evolution of bots to counter the defenses are all very old news. If the simple expedients of "move the SSH port" and "use public-key authentication" are insufficient, study prior art for more ideas.

If you simply wish to vent about the latest uptick in activity, please do so in "Hail Mary SSH" is at it again.
_________________
Plants are pithy, brooks tend to babble--I'm content to lie between them.
Super-short f.g.o checklist: Search first, strip comments, mark solved, help others.