Date: 11 Jan 2005 09:40:58 -0500 From: Lowell Gilbert <freebsd-questions-local@be-well.ilk.org> To: Gene <listmail@Bomgardner.net>, "freebsd-questions@FreeBSD. ORG" <freebsd-questions@freebsd.org> Subject: Re: High levels of breakin attempts Message-ID: <44llb0hvut.fsf@be-well.ilk.org> In-Reply-To: <41E3E02B.9080800@mindspring.com> References: <41E36115.6050003@Bomgardner.net> <41E3E02B.9080800@mindspring.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Carleton Vaughn <keebler@mindspring.com> writes: > Gene wrote: > > Over the past few months there have been a remarkably high level of > > brute force attacks logged by sshd. I was wondering, is there a way > > that sshd (or some other package) can monitor login attempts and if > > more than say 5 or 6 attempts are made to login from a particular ip > > address, temporarily block that address (perhaps at the firewall)? > > It'd be real satisfying to just dump the attackers' packets to the > > bit bucket and slow 'em down a bit. > > Not that I'm an expert (and not that that's stopping me), but this can > be done by configuring sshd to use PAM and selecting a PAM module such > as pam_abl that can blacklist sites that send too many attempts. See > http://www.kernel.org/pub/linux/libs/pam/modules.html for examples. Always remember, however, to be careful that this doesn't open you up to an easy denial-of-service attack. If all somebody has to do is try to log in a half-dozen times to lock out the IP address they're connecting from, you may be making it possible for them to attack your operation without breaking into your machine. "5 or 6" login attempts doesn't remotely constitute a "brute force" attack. From what I've seen on my own machine, these attempts seem to be trying passwords from a particular Linux distribution that shipped with default passwords on a number of accounts. Sometimes it makes me feel better to lock out such "attacks," but I don't actually kid myself into thinking that I'm either improving my own security or inconveniencing the attacker noticeably. -- Lowell Gilbert, embedded/networking software engineer, Boston area http://be-well.ilk.org/~lowell/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?44llb0hvut.fsf>