6

I'm running a CentOS 6.3 server and currently receive emails entitled "Large Number of Failed Login Attempts from IP" from my server every 15 minutes or so.

Surely with the below configured it should mean only the person using the (my static ip) should be able to even try and log in?

If that's the case where are these remote unknown users trying to log into which is generating these emails?

Current Security Steps:

  • root login is only allowed without-password
  • StrictModes yes
  • SSH password login is disabled - PasswordAuthentication no
  • SSH public keys are used
  • SSH port has been changed to a number greater than 40k
  • cPHulk is configured and running
  • Logins limited to specific ip address
  • cPanel and WHM limited to my static ip only

sshd_config

[email protected]

hosts.allow

ALL : <Static IP>

hosts.deny

ALL : ALL

iptables

iptables -I INPUT -s <Static IP> -p tcp -m tcp --dport 22 -j ACCEPT
iptables -I INPUT -p tcp -m tcp --dport 22 -j REJECT
1
  • 1
    solve it by just one command: "yum install fail2ban" Feb 26, 2013 at 12:50

7 Answers 7

10
+50

What I would do is use Fail2Ban & point it to your ssh log file. That way if you get a specified number of failed attempts from the same IP's, fail2ban automatically adds a firewall rule to drop packets from those IP's for a period of time you specify.

6
  • Is that not the same as cphulk?
    – Dan
    Feb 27, 2013 at 17:38
  • On the surface, they seem to do the same thing, but I'm not sure what cPHulk does underneath to disable the attempt. It may be that cPHulk isn't configured correctly. I know that fail2ban uses iptables which would block access entirely.
    – churnd
    Feb 27, 2013 at 17:51
  • As I only need one ip for SSH I'm considering iptables -A INPUT -p tcp -s 1.1.1.1 --dport 22 -j ACCEPT would this be the best solution?
    – Dan
    Feb 27, 2013 at 18:03
  • Yeah I guess, but what if you lose that IP for some reason? I'd hate to have that limitation without another way in. You'd need to follow it with a reject rule so it'll drop the other IP's: iptables -I INPUT -p tcp -m tcp --dport 22 -j REJECT. Fail2Ban takes care of all that for you.
    – churnd
    Feb 27, 2013 at 20:21
  • The above reject rule doesn't seem to work? It just blocks everything including the allowed ip in the first rule?
    – Dan
    Mar 7, 2013 at 15:48
3

With that configuration, sshd will still report failed attempts along the lines of:

Dec  3 00:56:35 servername sshd[31242]: refused connect from li471-78.members.linode.com (50.116.13.78)
Dec  3 00:56:40 servername sshd[31244]: refused connect from li471-78.members.linode.com (50.116.13.78)

Perhaps your log alert is triggering on that? Check your logs to verify that this is the case.

You can make this go away by changing the sensitivity/search pattern of your alert function.

You can also make it go away by using the firewall to block all incoming SSH traffic other than from your IP address. If you use the firewall, nothing will hit sshd, and so nothing will appear in your log.

3
  • Okay the firewall sounds like a perfect solution, are there any simple tutorials you know of to implement that?
    – Dan
    Dec 3, 2012 at 16:53
  • 2
    If it's just one IP that's annoying you today, you can do something like iptables -I INPUT -s 1.1.1.1 -j DROP to block, for example, 1.1.1.1. If it's a variety of IP addresses, you can use fail2ban as an automatic way of blocking IPs. If you just want to whitelist, you can do something like (this is untested, so use carefully so you don't lock yourself out) iptables -I INPUT -s (your static ip) -j ACCEPT and then iptables -A INPUT -p tcp --dport 22 -j DROP. You can google around for iptables ssh brute force for more infor.
    – cjc
    Dec 3, 2012 at 17:01
  • 2
    You could always implement rate limiting via iptables. IPtables will block for example 10 tries in one minute. It just depends on the thresholds you want to have. google iptables rate limiting
    – Danie
    Dec 4, 2012 at 7:58
3

Up front one little detail. The log entries you see look like they're coming from hosts.deny, because sshd is "TCP-wrapped" (usually, on Linux). For detailed information check out man tcpd.

Using firewall rules you can fine-tune better what ends up in the (sys)log. So that's the place to whitelist your static IP and blacklist everybody else.

If you wanted to convert your existing rules to iptables you could use the following shell-script (replace the PORTS and MYIP with variables matching your needs):

#!/bin/bash
IPT="echo /sbin/iptables"
MYIP=1.2.3.4
PORTS="22 443 8080"
$IPT -P INPUT DROP
for port in $PORTS; do
        $IPT -I INPUT -p tcp --dport $port -s $MYIP -j ACCEPT
done

... or shorter:

#!/bin/bash
IPT="echo /sbin/iptables"
MYIP=1.2.3.4
PORTS="22 443 8080"
$IPT -P INPUT DROP
$IPT -I INPUT -p tcp -m multiport --dports ${PORTS// /,} -s $MYIP -j ACCEPT

... or in two hardcoded lines:

/sbin/iptables -P INPUT DROP
/sbin/iptables -I INPUT -p tcp -m multiport --dports 22,443,8080 -s 1.2.3.4 -j ACCEPT

Unfortunately there is no nice way of making it deduce the port numbers, so you'll likely end up hardcoding those.

Also keep in mind that you may want to flush your INPUT table before setting the policy, using iptables -X INPUT.

The above, explained in a few words, sets the default policy for the INPUT table to DROP and then allows only TCP connections to the given ports ($PORTS) from the given IP ($MYIP).


You seem to be interested in a very strict lockdown, with the exception of your own static IP, so nothing of the following may be required at all.

I have been using the following netfilter rules, as pointed out in an earlier post by me here on ServerFault: Is it normal to get hundreds of break-in attempts per day?

I am not going to repeat the rules here, because they already exist on this site. However, you have to keep in mind that you are still going to get some log messages until the IP is automatically put into the tarpit. In general I don't think you have to be worried so much about the amount of attempts, given your very sound sshd configuration. Adjust the tarpit times to confine attackers longer or act sooner, but keep in mind not to lock yourself out.

Also, in the recent past I have tested and grown quite fond of sshguard. Although many people compare it to Fail2Ban, I think its scope is much wider (also not limited to sshd). This tool can use various facilities to parse the logs (directly or after your syslog facility puts it into a file) and various facilities to block (e.g. netfilter/iptables).

Whenever people have been tenacious with their attempts, I have put in complete blocks (firewall).

If only the log entries annoy you configure your logcheck (or other tool) to filter those or change the port to which sshd binds. Security-wise, however, I consider this snakeoil.

2

You might have been hacked.

Do a rpm -Vv keyutils-libs as root on your server.

Do you see a 5? If so one of the libs has been substituted by a attacking version.

More details about the attack (probably using cPanel) can be found here.

1

I use this personnaly to limit access to some ports on my servers:

-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSHACCESS --rsource 
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 180 --hitcount 20 --name SSHACCESS --rsource -j DROP

you can play with --seconds and --hitcounts to fit you context.

Also you can use some more comlicated rules like port knocking. in this case you send requests ( could be ping, tcp, telnet or whatever you want ) and then system opens for instance SSH port for a few seconds only for that IP and you can do ssh to server. check this link to implement this with iptables

this is a simple port knocking on port 1000:

-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1000 -m recent --set --name KNOCKING --rsource
-A INPUT -p tcp -m tcp --dport 22 -m recent --rcheck --seconds 5 --name KNOCKING --rsource -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j DROP

now you can ssh to your server like this:

telnet <ip> 1000 ; ssh <ip>

if you need more help on this please let me know.

0

you could also use -m connlimit, to limit number of incorrect tries to slow attackers down, like they explain here: http://www.cyberciti.biz/faq/iptables-connection-limits-howto/.

Adding excludes and/or different timing for different IP blocks is albo possible and simple.

I'd also consider changing default sshd port to anything not common.

0

Fortunately I'm a situation with a local ISP where I know my paid for static ip will never change without notification in advance, as I only need to make changes to the server from this location I can therefore block all SSH access outside of this location via iptables and a higher ssh port.

I've therefore applied the following change in sshd_config:

#example
Port 40000

and also created an iptables entry with my static ip address and the ssh port:

iptables -A INPUT -p tcp -s 1.1.1.1 --dport 40000 -j ACCEPT

So far this seems to have done the trick!

1
  • With a static public IP address, be sure you never, ever enable Location service, or your physical address may become public knowledge...
    – hopeseekr
    Feb 24 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .