Re: SSHD: Limit login attempt rate

bmearns <mearns.b@xxxxxxxxx> writes:

I'm running an sshd on Fedora 8, and have recently been getting
swamped with people trying to log in (i.e., break in). It's configured
to only allow three authentication attempts per connection, but they
just keep reconnecting: probably some script kiddies with port
sniffers and password testers. Is there a way to configure it so that
there's a timeout after failed attempts? For example, if a particular
address tries and fails three times to authenticate, that address is
blocked for three hours, or something similar?


I have a script which looks at the logs and if it finds too many failed
login attempts from the same machine it puts the address into
/etc/hosts.allow with a deny flag

sshd: your.special.machine otehr.good.machine 192.168.0 :allow
sshd: bad.machine.com other.bad.machine 10.9.8.1 :deny
sshd: ALL :allow

sshd read through the table from teh top and the first rule applies. Thus
special machines are allowed from that first line. bad machines are denied
as is 10.9.8.1
and everything else is allowed. The script looks for bad logins and if
there are to many in say a week it puts the address into the deny line. I
just leave the addresses in there. I donot trust people who let their
machines be hijacked.

The first allow line is to make sure that you do not lock yourself out by
way getting the password wrong too often.


.

Relevant Pages

  • Re: ADSI Problem
    ... Right I've got the script working now with my ASP applications by passing the ... If you are doing forms authentication using ADSI (which it sounds like you ... Restarting IIS usually gets it working again. ... Dim strUserName ...
    (microsoft.public.windows.server.active_directory)
  • Re: Automating password change
    ... All the machines are set up differently from each other ... > use telnet, others I can rlogin or remsh, and still others I can ssh. ... it would not be practical to try to write a complex script ... > to write a simple script to wrap around passwd that would run on each ...
    (comp.unix.solaris)
  • Re: Automating password change
    ... All the machines are set up differently from each other ... > use telnet, others I can rlogin or remsh, and still others I can ssh. ... it would not be practical to try to write a complex script ... > to write a simple script to wrap around passwd that would run on each ...
    (comp.unix.shell)
  • Re: ADSI Problem
    ... I have now managed to get this script working by having 2 ... If you are doing forms authentication using ADSI (which it sounds like ... Restarting IIS usually gets it working again. ... Dim strUserName ...
    (microsoft.public.windows.server.active_directory)
  • Re: Kerberos machine authentication - apparent authentication fail
    ... until a user logon event. ... the Netdiag utility will show the Kerberos error in this scenario ... On these machines I ... me a plausible starting point to solve my Kerberos authentication problem. ...
    (microsoft.public.windows.server.security)