Re: ssh brute force attacks

Years ago I started filtering ssh in my firewall for this same reason. I do not think it is a "new thing." I was 
receiving ssh failed logins from groups of ip addrs (too large to filter?) multiple times. Since I did not require 
external access I was able to shut it down at the firewall.
Another trick is to change the ssh port from the standard to something that would be hard to guess.

Peace,
Allan


Ed Heron wrote:
>   What is the deal with the SSH brute force attacks?  I wasn't paying
> attention until recently, but some of my new CentOS machines are giving
> me reports of all the failed login attempts.
> 
>   Most attackers (several dozen per day) try once every 15 to 20
> minutes.  I assume to avoid automatically being banned.  Some were
> throwing thousands of attempts at me from a single IP address.  It might
> have been happening on my old servers, but I'm afraid to look.
> 
>   I didn't have any automatic banning software installed before, but I
> do now.
> 
>   However, it makes me think about SSH.  It is a secure protocol but a
> bad password could open my system up to exploitation.  This isn't a SSH
> fault but a lack of confidence in my users.  And we don't even use SSH
> from outside the private network that often (just me for maintenance).
> 
>   We recently started using OpenVPN with certificates.  I'm working on
> adding a password so it takes both a certificate and a password to
> connect a remote machine to the private network.
> 
>   I'm thinking that OpenVPN makes external SSH obsolete.  I could turn
> it off forcing me to start a whole VPN in order to get access to the
> internal interface.
> 
>   Has everybody else already gotten to this conclusion or are there lots
> of people still allowing remote SSH access?
> 
>   I'm also thinking of setting up a honey pot on my external SSH port.
> Are there any pre-configured honeypot distributions?  Would a honeypot
> that never lets anybody in because it doesn't have any valid login
> combinations be good or should it let them in and let them waste their
> time installing root kits then when they logout reset the machine.
> 
>   Any thoughts?
> 
> 
> _______________________________________________
> NMLUG mailing list
> [email protected]
> http://lists.b9.com/cgi-bin/mailman/listinfo/nmlug
> 
> 
_______________________________________________
NMLUG mailing list
[email protected]
http://lists.b9.com/cgi-bin/mailman/listinfo/nmlug