Re: SSHD: Limit login attempt rate

Thanks for all the great recommendations. I'm especially interested in
iptable rate-limiting and port-knocking, which I will be looking more
into. Moe Trin mentioned that port-knocking doesn't block out remote
hosts who can't connect on obscure ports, but I don't see how? This is
also my main reason for not moving the server to another port: I need
to be able to access it from a handful of networks that lock down all
but standard ports (i.e., from within these networks, you can't
connect to remote hosts on ports other than, say, 80, 8080, 22, and
maybe a few others), so I'm not clear on how port knocking would be
any different in this aspect?

White-listing the addresses is similarly not a very practical option
for me. I wouldn't exactly call my self a "world traveler", but I do
have a tendency to connect back home from a wide variety of locations,
so I'd like to not blow off my "wobbly bits" as Moe Trin put it so
beautifully =).

As of last night, I implemented PKA-only access to ssh and have
whitelisted just a few users who are actually allowed to connect, all
of which have fairly obscure usernames that aren't likely to be
guessed by random strangers. Seems to me like a pretty good set of
authentication options, but if anyone has feedback, I'd love to hear
it. I will still be looking into some of the other options mentioned
above for black-listing attackers, as well.

Finally, just so we can all have a good laugh: The specific incident
that triggered all this was that my logwatch reported 1300 attempts to
login with my username (again, not exactly a common "oh this is
probably a username" guess that most script kiddies are likely to
try), and what's more, the source IP was my wireless router (which has
loopback). To paraphrase a well known horror movie: The call was
coming from inside the network, leading me to believe that someone in
the building had hacked my wireless network and was now trying to hack
the systems behind it. But here's the funny part: I had apparently
setup a myentunnel service on my windows laptop, set to open a tunnel
back home whenever the system started. I vaguely recall doing this
now, but totally forgot about it in the meantime. So after changing my
ssh password, this service was no longer able to connect, but boy did
it try. Hence the 1300 failed authentication attempts from inside the
network. I've disabled that service now, but I guess it all worked out
for the best, since it got me thinking about security.

-Brian
.

Relevant Pages

  • Re: 2 pc network - cant see host files from pc 2 on pc 1
    ... Assuming that you have firewall protection via your internet router try ... workgroup because it will be needed for the network to work correctly. ... see if you can access TCP ports 139 and 445 on computer one of which at ... permissions. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: PC Tools Firewall Question
    ... So, it's to be assumed that the two machines that are connected to your router, the LAN or Local Area Network, are never to share resources or network between the two, which are the ports you're blocking below with the PFW. ...
    (comp.security.firewalls)
  • Re: Setting up Remote Desktop web connection in winxp mce to work
    ... Its possible her office network admins are blocking the outgoing ports. ... Also check to see your using the correct public IP for your router and make sure the router is configured to disable remote management. ... > anyway to test the remote connection, other than trying to connection> from ...
    (microsoft.public.windowsxp.work_remotely)
  • Re: How to spoof MAC-address in SuSE Linux?
    ... > that in their contracts and they threatened the customers and stuff. ... ran more then one PC on the network while it was not allowed to do so. ... Here there are several providers that close all ports till 1024 and some ... support you think you are going to get is gone. ...
    (alt.os.linux.suse)
  • Re: When do I choose for OUTBOUND or INBOUND in a protocol?
    ... Ori YosefiISA Server Team ... > tab I only checked the external network. ... >> If you want to allow access to iSpQ on the internal network, you should>> create a publishing rule that publishes these ports to the external> network. ...
    (microsoft.public.isa)