UNIX for Dummies Questions & Answers

Hi, there. I am using Red Hat 9 to run my web server. Recently I found lots tempts from different IP addresses tried to login into my system. I am not sure if they are the same person or not. Since this server is only for web hosting purpose for couple of my friends and myself, so it is very easy found out other people tried to get in.

My situation is like this: I have to run the ssh, but those tempts are really annoying. So could anyone show me how to block an IP address after 5 fail login, just for couple hours.

Thanks in advance,

HOUSCOUS

HOUSCOUS,

Good question. I typically use VPN and don't allow outside ssh to key systems. However, it would be a simple enough exercise to author a PAM module that kept count and updated /etc/hosts.deny based on failed attempts. I'll look at it further and see how simple it would be to do.

If you login from a perdictable number of networks, you could just use a deny all rule and then allow specific networks. You'll need to have ssh compiled to support TCP_WRAPPERS.

Cheers,

Keith

You're probably seeing the results of this new automated ssh login tool that is discussed at length here:

http://seclists.org/lists/fulldisclo.../Jul/1109.html

I found it after I noticed many attempts from people to log in to my ssh server as either "root", "guest", "test" or "admin". The first thing I made sure was that my /etc/ssh/sshd_conf had "PerminRootLogin no" and that the line was uncommented. (I'm not in the habit of ever logging in as root, even from the console - su and sudo are my friends). Since I don't have the other 3 users on that system, there's not much to worry about from the morons who are running the ssh script.

But to get rid of the annoying attempts, I just added those IPs to a table of blocked IPs for in my (OpenBSD/PF) firewall. You can use sed and awk to parse your authlog for "Failed" or "Illegal", extract the IP from those lines, and automate something like this, depending on the firewall you use...or add them to /etc/hosts.deny. But be careful when automating this, it's easy to block valid IPs using such tools too.