From owner-freebsd-questions@FreeBSD.ORG Fri Oct 8 00:24:41 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6461E16A4CE for ; Fri, 8 Oct 2004 00:24:41 +0000 (GMT) Received: from mail.cableone.net (scanmail1.cableone.net [24.116.0.121]) by mx1.FreeBSD.org (Postfix) with ESMTP id EEC0143D2F for ; Fri, 8 Oct 2004 00:24:38 +0000 (GMT) (envelope-from v.velox@vvelox.net) Received: from vixen42.24-119-122-191.cpe.cableone.net (unverified [24.119.122.25]) by smail1.cableone.net (SurgeMail 1.9b) with ESMTP id 20987829 for multiple; Thu, 07 Oct 2004 17:24:29 -0700 Date: Thu, 7 Oct 2004 19:23:49 -0500 From: Vulpes Velox To: LukeD@pobox.com Message-ID: <20041007192349.36120317@vixen42.24-119-122-191.cpe.cableone.net> In-Reply-To: References: X-Mailer: Sylpheed-Claws 0.9.12b (GTK+ 1.2.10; i386-portbld-freebsd4.10) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Server: High Performance Mail Server - http://surgemail.com cc: freebsd-questions@freebsd.org cc: luked@pobox.com Subject: Re: Protecting SSH from brute force attacks X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Oct 2004 00:24:41 -0000 On Thu, 7 Oct 2004 15:15:25 -0700 (PDT) Luke wrote: > There are several script kiddies out there hitting my SSH server > every day. Sometimes they attempt to brute-force their way in > trying new logins every second or so for hours at a time. Given > enough time, I fear they will eventually get in. > Is there anything I can do to hinder them? > > I'd like to ban the IP after 50 failed attempts or something. I'd > heard that each failed attempt from a source was supposed to make > the daemon respond slower each time, thus limiting the usefulness of > brute force attacks, but I'm not seeing that behavior. I forget where in /etc it is, but look into setting up something that allows a certian number of failed logins before locking that IP/term out for a few minutes.... and if it is constantly from the same place look into calling their ISP or the like. Or in a few cases, like I have done in a few cases, and a deny from any to any for that chunk of the net... man login.conf for more info :)