protecting ssh?

Message

Capt.Obvious · Post by **Capt.Obvious** » Fri Oct 27, 2006 5:52 am

Greetings folks, thanks for taking the time to read this...

I have a number of gentoo boxes with only the sshd daemon exposed to the Internet. Now, we all know how people love to run scripts and hammer SSHD... a while ago I saw a PAM plug-in that would essentially blacklist an IP address on some configurable parameters (>3 attempts failed in 10 seconds, etc)...

What strategies do you use to protect SSHd? (Please keep in mind I log into these boxes from virtually anywhere, so IP masking them through my firewall isn't really an option... some good tricks? PAM options?

Thank you for your time.

elgato319 · Post by **elgato319** » Fri Oct 27, 2006 6:38 am

I use denyhosts (it´s in portage) to protect my ssh. Works like a charm.

Or you can use public key authentification
http://gentoo-wiki.com/SECURITY_SSH_without_a_password

Janne Pikkarainen · Post by **Janne Pikkarainen** » Fri Oct 27, 2006 10:08 am

I prefer fail2ban.

DooMi · Post by **DooMi** » Fri Oct 27, 2006 11:18 am

Janne Pikkarainen wrote:I prefer fail2ban.

just installed it, works like a bitch.
tip of the week

Janne Pikkarainen · Post by **Janne Pikkarainen** » Fri Oct 27, 2006 11:21 am

DooMi wrote:just installed it, works like a bitch.

Metaphor of the week.

bigbob73 · Post by **bigbob73** » Fri Oct 27, 2006 11:55 am

disable password logins and root logins and use keys. Also, I move mine to a non-standard port.

Capt.Obvious · Post by **Capt.Obvious** » Fri Oct 27, 2006 1:21 pm

thanks! I'll go try some of that...

batistuta · Post by **batistuta** » Fri Oct 27, 2006 1:49 pm

could some of you guys post your ssh configuration file to check? Thanks!

bigbob73 · Post by **bigbob73** » Sun Oct 29, 2006 11:07 pm

batistuta wrote:could some of you guys post your ssh configuration file to check? Thanks!

Port 2752
Protocol 2
ServerKeyBits 2048
SyslogFacility AUTH
LogLevel DEBUG
LoginGraceTime 30
PermitRootLogin no
RSAAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no
PermitEmptyPasswords no
Compression yes
KeepAlive yes
ClientAliveInterval 30
ClientAliveCountMax 4
AllowUsers bobby sftp-dads
Subsystem sftp /user/lib/misc/sftp-server