6

I would like to limit failure retries on my Fedora machine to 5. I think I can accomplish it with PAM. But was unable to to do this.

I have referred to this article to do this

http://www.puschitz.com/SecuringLinux.shtml

Please provide suggestions

Improve this question

5 Answers 5

Reset to default
18

You might be interested in fail2ban.

Improve this answer
4
  • 4
    I second this. If you want to secure your box, you do not just want to limit loging retries. You want to block the attempting IP for a prolonged period of time. Fail2ban does this automatically and just plain rocks at it. Try it out.
    – wzzrd
    May 19, 2010 at 10:34
  • 2
    Even more.. it's not limited to ssh. Actually it's not limited at all! With this handy tool you can do the same for FTP, Apache, and whatever you want (read - whatever provides logs).
    – Andrejs Cainikovs
    May 19, 2010 at 16:10
  • agree, this is a very good tool for this
    – Sverre
    Jul 15, 2014 at 8:20
  • denyhosts is a simple and good alternative github.com/denyhosts/denyhosts
    – Sergei G
    Oct 4, 2017 at 4:49
8

Simply modify your /etc/ssh/sshd_config file; add

MaxAuthTries 5

and restart sshd.

Improve this answer
2
  • but which one will have overrding effect? PAM or MaxAuthTries in sshd_config ?
    – nitin
    May 19, 2010 at 10:26
  • I think the lowest comes first :)
    – wazoox
    May 20, 2010 at 13:44
6

I use an iptables rule that limits SSH connections to no more than 10 per minute. After 10 connections (or attempts), new incoming connections from that IP are dropped, which is usually enough to make the would-be crackers go away.

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --rttl --name SSH -j DROP

Improve this answer
2
  • I like the iptables approach. Mainly because after awhile denyhosts and similiar tools get huge databases which takes, in some cases, dire CPU cycles. iptables is much more efficient this way. In 150 days, denyhosts has taken 37 cpu hours on a machine with 7k plus entries in its database.
    – artifex
    May 19, 2010 at 14:33
  • looks like this answer, in conjunction with serverfault.com/questions/143323/limiting-failed-ssh-logins/… would be pretty good
    – warren
    Jul 21, 2010 at 13:42
5

Another dynamic connection blocker based on failed login attempts is DenyHosts. It functions similarly to fail2ban, but specifically targets ssh login attempts. The last time I set it up, I found it very easy to configure.

Improve this answer
1
  • +1 DenyHosts has worked for me too.
    – Sharjeel Aziz
    May 19, 2010 at 14:45
0

There is no excuse for having a server that will accept many failed login attempts from the same IP, or within a defined time period! That is just sloppy management. (Or, it could be argued, sloppy Linux server code. :-)

I have some python scripts on my dedicated LAMP servers that does this, and more. I also have some IPTABLES entries that act much faster for specific ports.

Once per minute (cron job), several python scripts each scan several log files for malicious activity (such as the phrase "failed password" or "unknown user"). The IP address that generated the errors is temporarily blocked (usually for 2 weeks). This not only works for failed SSH logins, but for many other malicious attacks, such as failed e-mail logins or attempts to get the server to send spam.

It's too complicated to post the entire solution here, but the above should get someone's brain cells working in the right direction.

Improve this answer
2
  • As the accepted answer says, fail2ban is the goto solution for this.
    – user9517
    Jul 15, 2014 at 7:51
  • Thanks. What I have is much simpler, but I'll give fail2ban a closer look.
    – Mike Waters
    Jul 16, 2014 at 7:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .