I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to 8 brute force attempts daily to access SSH as either root or just brute force trying different names and this is on a server with no public reputation (its not running any big websites etc). Because of the way I have my SSH server configured I'm pretty sure these attempts will also fail, but I really dont like letting people try.
I have of course also set up connection rate limiting for the more sensitive services including SSH.
What I'm doing at the moment:
I can see from my auth.log that PAM does get the remote IP address of those trying to login and I'm currently using a script which periodically scans for these failed attempts and adds an IP block the fire wall.
What I'd like to do:
What I want to do is make this IP banning process much quicker to respond. That is rather than waiting for the polling script to pick it up, I want a PAM module to count successive failed attempts from an IP (not a service or user) and take some action either such as:
- refuse all future login attempts from that IP
- fire a command which will add a rule to the firewall to ban the IP completely
Is there already a good PAM module which can take note of the IPs failing authentication or do I need to write my own?