Preventing brute force attacks

Question

What are the best tools to prevent Brute force attacks against ssh and FTP on Linux servers ?

Answer 1

It's not to everyone's tastes but I really like DenyHosts for broad-brush blocking of automated probes to sshd :

http://denyhosts.sourceforge.net/

I use it in a very paranoid mode, if you trip it - you get an entry in hosts.deny with an ALL: prefix, not just an SSH: one. You can allow denyhosts to purge the deny list on a periodic basis if you so wish.

Answer 2

Check out fail2ban. http://www.fail2ban.org/wiki/index.php/Main_Page it's very handy to prevent bruteforce attacks on http, ftp, stmp servers etc.

Answer 3

On SSH, tips:
- Set PermitRootLogin no
- Set MaxStartups 1
- Set MaxAuthTries 3 (or less)

That for password authentication. I would avoid the brute force attack using RSAAuthentication with public keys with a good passphrase only available for the users I want.

Also change the default port used for SSH and use another one distinct to 22 in the free available range and set iptables to filter the in traffic.

Answer 4

You can also use iptables to do rate limiting for any port you want. It's very flexible.

Answer 5

I've been using OSSEC, which is not terribly hard to install and configure.

Answer 6

I haven't used it myself but ssh guard looks interesting.

Answer 7

use Netfilter's 'recent' module and nip it in the bud at the kernel level. Also this solution is not application specific (i.e. does not rely on application configuration)

see http://blog.andrew.net.au/2005/02/16

Answer 8

Try reading through Linux Security HOWTO from TLDP and then possibly refine your question if it does not provide the answer already.

EDIT (after question update): In addition to all of the above (most classifiable as intrusion detection) there is also port knocking.

It does not prevent brute force attacks, but it hardens the system in several ways

• makes system less interesting (due to ports appearing closed)
• adds another layer of protection increasing the difficulty of a successful attack (possible combinations for 10 port knocks over possible 256 ports is 256^10 > 94^10 where 94 is number of all ascii printable characters)
• makes an attack 'loud' (easier to catch with intrusion detection systems)
• early adopters get benefits of getting out of 'low-hanging-fruit' zone (similarly like using strong passwords simply makes you stop being a target for certain attackers)

I found this reply to critique of the system quite informative.