Steve wrote:
I'm one of the (many) people who has opportunists trying usernames and passwords against SSH... while every effort has been made to secure this service by configuration; strong passwords; no root login remotely etc. I would still prefer to block sites using obvious dictionary attacks against me.
The best advice I can give is to use public key authentication only. This will defend against all dictionary-based attacks, which is what you describe.
The only remaining "problem" is that your log files will be filled with unsuccessful login attempts. A simple solution is to run sshd on a non-standard, high-numbered port, e.g. in the 30'000. Bots only ever try to connect on port 22. This will *not* improve the protection of your server, but it will avoid having your logs spammed.
-- Remy
signature.asc
Description: OpenPGP digital signature
