Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the best tools to prevent Brute force attacks against ssh and FTP on Linux servers ?

share|improve this question
Brute force against what particular service? SSH connections, web connections, FTP connections? – Chris Thorpe Jun 1 '10 at 9:08
Mainly against SSH and FTP – nitins Jun 2 '10 at 6:44
You already asked pretty much this same question (and received the same answers) 3 weeks ago: – Ophidian Jun 2 '10 at 14:16
I asked tht question to know how use PAM for this. Though the answers were similar. – nitins Jun 3 '10 at 8:59

11 Answers 11

up vote 6 down vote accepted

It's not to everyone's tastes but I really like DenyHosts for broad-brush blocking of automated probes to sshd :

I use it in a very paranoid mode, if you trip it - you get an entry in hosts.deny with an ALL: prefix, not just an SSH: one. You can allow denyhosts to purge the deny list on a periodic basis if you so wish.

share|improve this answer
Installed Denyhosts. Thanks for the suggestion. – nitins Jun 2 '10 at 12:33

Check out fail2ban. it's very handy to prevent bruteforce attacks on http, ftp, stmp servers etc.

share|improve this answer

On SSH, tips:
- Set PermitRootLogin no
- Set MaxStartups 1
- Set MaxAuthTries 3 (or less)

That for password authentication. I would avoid the brute force attack using RSAAuthentication with public keys with a good passphrase only available for the users I want.

Also change the default port used for SSH and use another one distinct to 22 in the free available range and set iptables to filter the in traffic.

share|improve this answer

You can also use iptables to do rate limiting for any port you want. It's very flexible.

share|improve this answer

I've been using OSSEC, which is not terribly hard to install and configure.

share|improve this answer

First, check if the module is there or not /lib/security/

To protect the User from Brute force attack: Then, edit /etc/pam.d/system-auth

Add at the last line:

auth required deny=3 unlock_time=3600
account required

Open another terminial and check using user name and wrong password.

To lock a Particular User: edit /etc/pam.d/system-auth Add at the last line

auth required deny=3 unlock_time=3600 even_deny_root
account required

Open another terminial and check using user name and wrong password.

pam_tally2 -> this command is used to store the number of failure records
pam_tally2 -u kannan -> see only kannan user failure records
pam_tally2 -u username –r -> reset manually locked user

share|improve this answer

"You could also consider protecting your domain from the DNS level. Something like CloudFlare "

We actually can't proxy traffic on these ports (SSH, ftp) because we work only on web traffic (ports like 80 and 443). You might want to look at something like Dome9.

share|improve this answer

I haven't used it myself but ssh guard looks interesting.

share|improve this answer

use Netfilter's 'recent' module and nip it in the bud at the kernel level. Also this solution is not application specific (i.e. does not rely on application configuration)


share|improve this answer

You could also consider protecting your domain from the DNS level. Something like CloudFlare Or Incapsula.

They both offer free plans, but ultimately they are paid for services.

I use the free service for my website. It does not block all attacks, but it is all about the layers of security.

share|improve this answer

Try reading through Linux Security HOWTO from TLDP and then possibly refine your question if it does not provide the answer already.

EDIT (after question update): In addition to all of the above (most classifiable as intrusion detection) there is also port knocking.

It does not prevent brute force attacks, but it hardens the system in several ways

  • makes system less interesting (due to ports appearing closed)
  • adds another layer of protection increasing the difficulty of a successful attack (possible combinations for 10 port knocks over possible 256 ports is 256^10 > 94^10 where 94 is number of all ascii printable characters)
  • makes an attack 'loud' (easier to catch with intrusion detection systems)
  • early adopters get benefits of getting out of 'low-hanging-fruit' zone (similarly like using strong passwords simply makes you stop being a target for certain attackers)

I found this reply to critique of the system quite informative.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.