Date: Tue, 9 May 2006 16:24:02 +0100 From: Daniel Bye <freebsd-questions@slightlystrange.org> To: FreeBSD Questions <freebsd-questions@freebsd.org> Subject: Re: System Intrustion Detection Message-ID: <20060509152402.GD1517@catflap.slightlystrange.org> In-Reply-To: <20060509145403.71699.qmail@web32413.mail.mud.yahoo.com> References: <20060509145403.71699.qmail@web32413.mail.mud.yahoo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--IU5/I01NYhRvwH70 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, May 09, 2006 at 07:54:03AM -0700, M. Goodell wrote: > More and more each day I am seeing my root emails contain hundreds of ent= ries like this: > =20 > May 8 02:23:35 warpstone sshd[26092]: Failed password for root from 22= 2.185.245.208 port 50519 ssh2 > May 8 16:37:41 warpstone ftpd[34713]: FTP LOGIN FAILED FROM 211.44.250.1= 52, Administrator > =20 > Basically, people are attemtpting to hack into my server often with=20 > a few thousands of attempts each day. What measures can I take to stop=20 > these attempts? Is there a way I can detect these attacks and=20 > automatically cut them off? Are any of the security ports effective=20 > against this? Don't feel too bad - the little bastards try it on anywhere and everywhere. There are a few things you can do to stop them in their tracks. From what I gather, the pf firewall provides some neat table functionality that can be put to use in this situation. I have never used pf, so will not say more of it here. I use Denyhosts, which is intended to stop brute force ssh attacks, but which can be used to deny unwanted/unwelcome connections to any or all services. It's in the ports, is easy to set up and works really well. There is a synchronisation server from which it can download IP addresses that have been logged trying to mount attacks, and allows your DenyHosts to upload addresses that have tried to crack you. There are a couple of things you can do to protect your sshd. First, allow only public key authentication. This may not be practical in all situations, but it is a very good way of preventing dictionary attacks from succeeding! Secondly, set AllowGroups or AllowUsers in your sshd.config, so that only explicitly permitted users or groups can request a login. HTH Dan --=20 Daniel Bye PGP Key: ftp://ftp.slightlystrange.org/pgpkey/dan.asc PGP Key fingerprint: D349 B109 0EB8 2554 4D75 B79A 8B17 F97C 1622 166A _ ASCII ribbon campaign ( ) - against HTML, vCards and X - proprietary attachments in e-mail / \ --IU5/I01NYhRvwH70 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (FreeBSD) iD8DBQFEYLQSixf5fBYiFmoRAsyWAJ4gpRySpS8llh3KC/gxyXYRHFnVKQCg1mRM GKj/N2MHai0bUnCgenHU3uI= =9+lU -----END PGP SIGNATURE----- --IU5/I01NYhRvwH70--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060509152402.GD1517>