Re: Anybody getting ssh bruce force attacks?

Gerard Beekmans napisa=B3(a):
> Hey guys,
Hi
> Does anybody have other ideas? I'd like to keep ssh open for convenienc=
e
> reasons.
Well my way of solving this was to change the default port for the ssh=20
service to some high port, anyway !=3D22 which is the default in most of=20
the scans/attacks.
Additionally some iptables config according to a topic that was on the=20
[email protected] around september on "SSH Brute Force"=20
(look in the archives) so when a connection to that high port is reseted=20
more than 3 times, the IP gets blocked for some time using the=20
ipt_recent module.
Another thing is that from my logs I made a list of the most commonly=20
scanned ports and added them to a black list, so that when a connection=20
attempt is made to one of them, the IP is banned for an hour.

--=20
Best wishes
=A3ukasz Hejnak
--=20
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page