SSH Security Questions

[Karl]

I saw this on Planet Debian today and it reminded me of this thread.

http://blog.drinsama.de/erich/en/linux/ ... h-scanners

How to filter ssh scanners

Here's an easy recipe to filter those annoying SSH scanners at your firewall:

iptables -A FORWARD -i ethLRZ -p tcp --dport 22 -m state --state NEW \
-m recent --set --name SSH
#$iptables -A FORWARD -i ethLRZ -p tcp --dport 22 -m state --state NEW \
# -m recent --update --seconds 60 --hitcount 5 --rttl \
# --name SSH -j LOG --log-prefix "SSH_brute_force "
iptables -A FORWARD -i ethLRZ -p tcp --dport 22 -m state --state NEW \
-m recent --update --seconds 60 --hitcount 5 --rttl --name SSH -j DROP

This configuration will allow up to 5 SSH connections in a 60 second timeframe. This will usually make SSH-scanners go away after their 5th retry, and seriously slow them down otherwise.

If you have users who "rightfully" need to do more SSH connections, make them use some VPN, a "safe" source-IP-range, whatever.

To protect your firewall host, use INPUT instead of FORWARD.

Note that you can also implement port-knocking with the recent match.

[Gomer_X]

I'm learning linux by running Ubuntu 5.10 Server on an old laptop. One thing I wanted to do was be able to access it from work, the idea being to use it as a gateway to my LAN. SSH works out of the box, and I was able to successfully connect to the Ubuntu computer from work.

It strikes me that anyone who wants to break into my system would just have to connect via port 22 and start hammering on my password, as it is an out of the box installation. So I'm considering how to make this more difficult, I'm hoping some of you might know a little about this and can either confirm or disprove my beliefs on the matter.

Fedora disables root logins through SSH by default. Other than that I just use secure passwords (at least 7 characters, mix of uppercase/lowecase/digits/special cahracters). Works for me. Most of the usernames the port-scanners try don't even have passwords(mail, apache, ftp, etc.), and they can't even attack my password without a username.

[Mortuis]

IMO changing the port ssh listens on is a waste of time.

Maybe, but it certainly can't hurt. As soon as I changed my ssh port from 22 to a super high random number the number of script kiddie hits in my logs went to virtually nil. A simple change to the sshd_config file and then a corresponding port forwarding entry in my nat router was all it took. Now I just connect to that other port instead of 22 and that's it.

I've had the same experience. I must have been misreading the logs because it looked like they were trying all sorts of ports, but ever since I changed the port I haven't received an attack.

At least this way it will be easier to monitor the logs.