On 10/3/2009 7:18 AM, olli hauer wrote: >>> http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers >>> provides a >>> reasonably useful list of ports NOT to choose for an obscure ssh >>> port. >> >> In practice, you have no choice but to use someting like 443 or 8080, >> because corporate firewalls often block everything but a small number >> of >> ports (usually 20, 22, 80, 443, 8080, and odds are that 20, 80 and >> 8080 >> go through a transparent proxy) > > This may work if the firewall does only port and no additional protocol > filtering. For many products used in corporate envirion it is even > possible to filter ssh v1, skype, stunnel, openvpn with a verry high > success rate within the first packet's on the wire. > > In case for the ssh server take a look into this parameters > - LoginGraceTime > - MaxAuthTries > - MaxSessions > - MaxStartups
The absolute best way to filter out the attacks is to disable authentication methods other than public keys. Obviously this isn't possible in all situations, but it's very effective. Most attack bots will just disconnect when they attempt login, and it's almost impossible to crack a key and gain access.
signature.asc
Description: OpenPGP digital signature
