shown below is snapshot of too many illegal attempts to login to my server from a suspicious hacker. this is taken from the "/var/log/auth.log". my question is, how do i automatically block an IP address if it is attempting to guess my login usernames? can i configure the firewall to check the instances a certain IP has attempted to access/ssh the sevrer, and if it has failed to login for about "x" number of attempts, it will be blocked automatically?
This question is asked on the list ever so often - see the archives for suggestions. These are automated attacks, they come regularly as crackers, black hats or script kidies scan across the net.
You can avoid the automated scanning by chaning port, but this won't stop the determined cracker - he will scan all your ports and identify which services are running on which ports.
Ask yourself a few questions:
* Do you need to allow ssh from anywhere? If not, restrict to the relevant ip blocks.
* Do you need to allow password based authentication? If not, disable it and use only ssh keys, in sshd_config:
PasswordAuthentication no
PubkeyAuthentication yes* Do all users need to have ssh access? If not, restrict to specific groups of users, in sshd_config, eg:
AllowGroups staff
* Is it a problem appart from the log messages? Trying to login with a nonexistent username is usually not a problem.
Other tips: Disable ssh1, reduce the number of simultaneous non-authen- ticated connections, set timeouts etc.
Cheers, Erik -- Ph: +34.666334818 web: http://www.locolomo.org S/MIME Certificate: http://www.locolomo.org/crt/2004071206.crt Subject ID: A9:76:7A:ED:06:95:2B:8D:48:97:CE:F2:3F:42:C8:F2:22:DE:4C:B9 Fingerprint: 4A:E8:63:38:46:F6:9A:5D:B4:DC:29:41:3F:62:D3:0A:73:25:67:C2 _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
