Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My server is getting a lot of various failed authentication attempts for various accounts. The most common one (that I've seen ) or the root account.

I have since enabled Fail2Ban and ran several rootkit / malware checks to ensure I wasn't compromised. Is there anything else I should do? I only have three accounts enabled, and SSH access for only two. I have a full 48hr ban on anyone making more then six failed SSH login attempts. I do not have FTP enabled.

share|improve this question
add comment

3 Answers 3

Disable password authentication and root logins by adding/changing the following lines in your sshd_config file (typically located at /etc/ssh/sshd_config)

PasswordAuthentication no
PermitRootLogin no

What you're seeing is normal - it has been happening on the open Internet for years now and will never stop.

You will need to get public key authorization figured out before turning off passwords, if you haven't done this already.

share|improve this answer
    
Already have public key auth, but I keep a password login on one account as I haven't yet committed my private key to memory. –  Josh K May 19 '10 at 4:33
add comment

if you are using public/private key pairs you have almost nothing to worry about, with the brute force login attempts. if you have password authentication disabled, that is.

you can run ssh on a non-standard port, like 2222 but you will, in short time, start seeing attempts on those ports, too, as a lot of the botnets run port scanners as well.

another thing you can look into setting up is port-knocking, which is a pain, but would lock down ssh to only people issuing the proper "knock", http://en.wikipedia.org/wiki/Port_knocking

share|improve this answer
    
Can you elaborate how I would setup port knocking server side? –  Josh K May 18 '10 at 4:36
    
+1 on port knocking. –  theist Sep 7 '10 at 6:52
add comment

I get those all the time, they never end. The best thing is just to make sure you arent using generic accounts that have generic passwords.

I also use fail2ban, and it has worked fine. (But most of the time, I get hit by all different hosts, so it doesn't help too much)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.