2010/3/17 Michał Piotrowski <mkkp4x4(a)gmail.com&gt;: > Hi, > > I recetly had 30 hours of ssh brute force attack on my system. I'm > using strong passwords, but still can be geneated from /dev/random, so > I switched to rsa authentication. What's your favourite way to deal > with such attacks? Please describe pros and cons. > > Regards, > Michal > -- > devel mailing list > devel(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/devel > 1. Change SSH port

2. Disable access to root via SSH

3. Install HIDS eg: fail2ban is included in fedora OR BFD (http://www.rfxn.com/projects/brute-force-detection/)

-- Athmane Madjoudj -- devel mailing list devel(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel

Hi, I recetly had 30 hours of ssh brute force attack on my system. I'm using strong passwords, but still can be geneated from /dev/random, so I switched to rsa authentication. What's your favourite way to deal with such attacks? Please describe pros and cons.

Hi, I recetly had 30 hours of ssh brute force attack on my system. I'm using strong passwords, but still can be geneated from /dev/random, so I switched to rsa authentication. What's your favourite way to deal with such attacks? Please describe pros and cons. Regards, Michal

2010/3/17 Eric Sandeen&lt;sandeen(a)redhat.com&gt;: > Michał Piotrowski wrote: >> Hi, >> >> I recetly had 30 hours of ssh brute force attack on my system. I'm >> using strong passwords, but still can be geneated from /dev/random, so >> I switched to rsa authentication. What's your favourite way to deal >> with such attacks? Please describe pros and cons. >> >> Regards, >> Michal > > Aside from not allowing password logins, I throttle them, they usually > get tired and go away to an easier target. > > -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m limit --limit 1/minute --limit-burst 2 -j ACCEPT If I understand correctly - this limits ssh connections to two connections per minute. I tried it before on my devel server without success. I tried it now with your configuration also without success. I used -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m limit --limit 2/minute --limit-burst 2 -j ACCEPT and I still can connect to ssh as many times as I want.