Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I see following attempts in /var/log/auth.log which I was told by some one could be port scanning attempts.(Not sure though)

Nov 18 23:50:19 server sshd[21716]: Did not receive identification string from <some IP>
Nov 19 00:05:57  server sshd[24056]: Did not receive identification string from <some IP>

How can I block above such attempts?

share|improve this question
    
Consider not having ssh (or any non public services) open to the world. –  3molo Nov 19 '10 at 6:35

4 Answers 4

If you use Linux, you can use fail2ban.

"Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address."

share|improve this answer

I am assuming you are using linux vs FreeBSD - however the suggestions for both are close to the same.

If you are running any of the following:

  • RedHat v7.3, v8.0, v9.0
  • RedHat Enterprise v3, v4, v5 (32/64 bit)
  • CentOS v3, v4, v5 (32/64 bit)
  • Fedora Core v1 to v12(32/64 bit)
  • Gentoo
  • openSUSE v10, v11
  • Debian v3.1, v4.0, v5.0
  • Ubuntu v6.06 LTS, v8.10, v9.10, v10.04 LTS
  • Mandriva 2009, 2010
  • Slackware v12.2

I would suggest using a great FREE product from ConfigServer called CSF. CSF has a great user interface if you are on a cPanel server - but will work for any of the aforementioned linux versions

there are other alternatives such as APF and BFD from R-Fx networks as well - Google the following: APF (Advanced Policy Firewall) BFD (Brute Force Detection) or just visit the R-FX Network website for additional details.

There is also the method of Security by Obscurity - however that is not a FIX - but rather just hiding.

First - move your SSH Port to something other than 22. Second - use an ssh key exchange only - and forget about passwords. Third - only allow SSH version2
Fourth - if you have a static IP - than limit the addresses allowed to even ssh into your system via iptables and/or a firewall.

If you want some help doing any of those - please do not hesitate to ask.

share|improve this answer
    
Thanks for the detailed reply.I do understand that SSH running on a port other than 22 is better option but the people with whom I work do not understand so I am helpless at that aspect. –  Bond Nov 21 '10 at 15:35
    
Did this help? I hope so... just wondering how things are fairing with your issues now. –  Glenn Kelley Nov 24 '10 at 5:32

As with fail2ban, denyhosts is good for blocking hosts after failed login attempts, although it updates /etc/hosts.deny for the given service, rather than modifying firewall rules.

Moving your SSH server to a high port can reduce a lot of this sort of traffic, but as Glenn says, it's not inherently more secure.

If that time separation there is indicative of the rate at which you're seeing the attempts, I'd simply ignore it as background noise. However, if you really want to hide your service from the general internet, consider portknocking: http://www.portknocking.org/

share|improve this answer

There is another one option (but not that popular). You have to buy another one connection (lets say adsl) with a static ip (or dyndns). Setup a firewall, move the ssh port to a high number, and connect that router in the network you want to give access to. if you have physical access on machines, you can turn on/off router when needed.

By this way you can keep the door open only whenever you want without having to worry about your main connection.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.