Preventing brute force attacks

Question

What are the best tools to prevent Brute force attacks against ssh and FTP on Linux servers ?

Answer 1

It's not to everyone's tastes but I really like DenyHosts for broad-brush blocking of automated probes to sshd :

http://denyhosts.sourceforge.net/

I use it in a very paranoid mode, if you trip it - you get an entry in hosts.deny with an ALL: prefix, not just an SSH: one. You can allow denyhosts to purge the deny list on a periodic basis if you so wish.

Answer 2

Check out fail2ban. http://www.fail2ban.org/wiki/index.php/Main_Page it's very handy to prevent bruteforce attacks on http, ftp, stmp servers etc.

Answer 3

On SSH, tips:
- Set PermitRootLogin no
- Set MaxStartups 1
- Set MaxAuthTries 3 (or less)

That for password authentication. I would avoid the brute force attack using RSAAuthentication with public keys with a good passphrase only available for the users I want.

Also change the default port used for SSH and use another one distinct to 22 in the free available range and set iptables to filter the in traffic.

Answer 4

You can also use iptables to do rate limiting for any port you want. It's very flexible.

Answer 5

I've been using OSSEC, which is not terribly hard to install and configure.

Answer 6

First, check if the module is there or not /lib/security/pam_tally2.so

To protect the User from Brute force attack: Then, edit /etc/pam.d/system-auth

Add at the last line:

auth required pam_tally2.so deny=3 unlock_time=3600
account required pam_tally2.so

Open another terminial and check using user name and wrong password.

To lock a Particular User: edit /etc/pam.d/system-auth Add at the last line

auth required pam_tally2.so deny=3 unlock_time=3600 even_deny_root
account required pam_tally2.so

Open another terminial and check using user name and wrong password.

Notes:
pam_tally2 -> this command is used to store the number of failure records
pam_tally2 -u kannan -> see only kannan user failure records
pam_tally2 -u username –r -> reset manually locked user

Answer 7

I haven't used it myself but ssh guard looks interesting.

Answer 8

use Netfilter's 'recent' module and nip it in the bud at the kernel level. Also this solution is not application specific (i.e. does not rely on application configuration)

see http://blog.andrew.net.au/2005/02/16

Answer 9

You could also consider protecting your domain from the DNS level. Something like CloudFlare Or Incapsula.

They both offer free plans, but ultimately they are paid for services.

I use the free service for my website. It does not block all attacks, but it is all about the layers of security.

Answer 10

"You could also consider protecting your domain from the DNS level. Something like CloudFlare "

We actually can't proxy traffic on these ports (SSH, ftp) because we work only on web traffic (ports like 80 and 443). You might want to look at something like Dome9.

Answer 11

Try reading through Linux Security HOWTO from TLDP and then possibly refine your question if it does not provide the answer already.

EDIT (after question update): In addition to all of the above (most classifiable as intrusion detection) there is also port knocking.

It does not prevent brute force attacks, but it hardens the system in several ways

• makes system less interesting (due to ports appearing closed)
• adds another layer of protection increasing the difficulty of a successful attack (possible combinations for 10 port knocks over possible 256 ports is 256^10 > 94^10 where 94 is number of all ascii printable characters)
• makes an attack 'loud' (easier to catch with intrusion detection systems)
• early adopters get benefits of getting out of 'low-hanging-fruit' zone (similarly like using strong passwords simply makes you stop being a target for certain attackers)

I found this reply to critique of the system quite informative.