Re: repeated ssh login attempts/failure/break-in attempts from kiddy script

On 3/31/06, Nathan Vidican <nvidican@xxxxxxxxx> wrote:
Noted recently in auth.log, a string of connection attempts repeated/failed over
and over from one host - looks like a script someone's running, tries all kinds
of various usernames, etc... attempts like 100-200 logins, fails and goes away.

Few hours go by, and another such attempt, from a different IP comes in. If I'm
here and just happen to notice them - simple ipfw add deny... does the trick,
but is there not a way to limit the login attempts for a certain period of time?

ie: after 4 failed attempts from IP _BLANK_ in less than _BLANK_ minutes, deny
all attempts and drop connection from said IP... possible?

Any suggestions/ideas? Thus far, no one has managed to login (there are only
three accounts which even have a shell or can login via ssh... but still not the
point). I'd just like to get rid of the problem and save my auth.log file for
perhaps something more useful ;)

[snip]

This pf.conf rule will stop them:

block drop log quick on xl0 proto tcp from any os "Linux" to any port = ssh
_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Read & Exec by default - RH9 - why?
    ... Give him the last login time, and he's even better off - now ... if using LDAP ls -l /home will indeed show usernames. ... you gained nothing in terms of security since the user can *still* ... In other words, what happens when it fails, how much ...
    (RedHat)
  • ssh pub-key login failes randomly
    ... I have a very strange problem: Since a few days SSH public-key logins from ... everything always worked great and I didn't update OpenSSH / OpenSSL ... Login fails and prompts for password. ...
    (comp.security.ssh)
  • Re: SSH login automation, get stuck at the last step.
    ... The ssh server that I am copying the public key to is not a typical ... The user "root" to login this box can not access the ... puts stderr "EXP username requested and sent " ...
    (comp.lang.tcl)
  • Re: sshd brute force attempts?
    ... ssh is not a public service like http or smtp where you need anyone to be able to connect. ... Disable direct root login, in the article more than a third attempted to login as root. ... Use a scheme for choosing usernames that avoids common names like "james" and avoid publishing usernames on web-sites, e-mail may differ from the username. ... This is really only a problem if the traffics saturates your connection, or your log files grow so much that you run out of diskspace. ...
    (freebsd-questions)
  • SUMMARY: how to set correct path?
    ... ven if we login with ssh. ... For BASH login shell, place the system wide ENV variables, such as PATH, ... You can set Use_login in the sshd_config to yes and restart sshd. ...
    (SunManagers)