Securing SSH

[Richard Emberson]

Another option:
http://www.hexten.net/pam_abl/

Provides auto blacklisting of hosts and users responsible for repeated 
failed authentication attempts. Generally configured so that blacklisted 
users still see normal login prompts but are guaranteed to fail to 
authenticate.


Guillermo Garron wrote:
> I can also recommend denyhosts
> 
> yum install denyhosts
> 
> when you fail n time the login via SSH your IP will be added to the 
> /etc/hosts.deny/ you can configure the "n" ...
> 
> you can also configure it to avoid adding the IP of your office to the 
> /etc/hosts.deny/ even if you fail the logging, no matter how many times.
> 
> This should mantain the hacker out of your system if you have a strong 
> password for all your users, and limit the "n"to a small number no 
> dictionary attack should have success.
> 
> hope it helps.
> 
> regards,
> 
> guillermo.
> 
> 
> jdow escribió:
>> From: "Brian D. McGrew" <brian at visionpro.com>
>>
>>> Good morning,
>>>
>>> I'm looking to tighten up my ssh configuration.  I have to have SSH open
>>> on the box at home so I can get to it from the office.  I've found
>>> several articles on securing ssh that include deny root access and
>>> require 'wheel' group membership for su.
>>>
>>> Is changing the port to something non-standard a good idea?  What else
>>> can I do; can someone point me to a good write up on it?
>>
>> At the risk of being tendentious about it this is the trick I found
>> works very well:
>>
>> ===8<---
>> $IPTABLES -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack 
>> --set
>> $IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
>>  --rcheck --seconds 120 --hitcount 3 -j LOG --log-prefix 'SSH REJECT: '
>> $IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
>>  --rcheck --seconds 120 --hitcount 3 -j REJECT --reject-with tcp-reset
>> ===8<---
>>
>> Modify it to match your defines and names. I built my own set of rules
>> that have some special capabilities in them that I need. (I open a video
>> streaming hole when needed from another host on the system, for example.)
>>
>> What this does is prevent any site from making more than two tries in
>> 120 seconds. So far all attacks have been steady streams at VERY high
>> rates of connection attempt. They all get blocked after the first two.
>> Barring a cosmic accident with the right password being guessed right
>> off there's no chance of a break in even with ABCDefg as a password
>> before the Earth is engulfed by the Sun as the Sun ages. Even if they
>> get the 120 second rythmn going a decent password would be good just
>> an awesome long time. So it's not worth their efforts.
>>
>> {^_^}   Joanne
>>
> 


-- 
This email message is for the sole use of the intended recipient(s) and
may contain confidential information.  Any unauthorized review, use,
disclosure or distribution is prohibited.  If you are not the intended
recipient, please contact the sender by reply email and destroy all
copies of the original message.