My server is getting a lot of various failed authentication attempts for various accounts. The most common one (that I've seen ) or the root account.

I have since enabled Fail2Ban and ran several rootkit / malware checks to ensure I wasn't compromised. Is there anything else I should do? I only have three accounts enabled, and SSH access for only two. I have a full 48hr ban on anyone making more then six failed SSH login attempts. I do not have FTP enabled.


if you are using public/private key pairs you have almost nothing to worry about, with the brute force login attempts. if you have password authentication disabled, that is.

you can run ssh on a non-standard port, like 2222 but you will, in short time, start seeing attempts on those ports, too, as a lot of the botnets run port scanners as well.

another thing you can look into setting up is port-knocking, which is a pain, but would lock down ssh to only people issuing the proper "knock", http://en.wikipedia.org/wiki/Port_knocking

  • Can you elaborate how I would setup port knocking server side? – Josh K May 18 '10 at 4:36
  • +1 on port knocking. – theist Sep 7 '10 at 6:52

Disable password authentication and root logins by adding/changing the following lines in your sshd_config file (typically located at /etc/ssh/sshd_config)

PasswordAuthentication no
PermitRootLogin no

What you're seeing is normal - it has been happening on the open Internet for years now and will never stop.

You will need to get public key authorization figured out before turning off passwords, if you haven't done this already.

  • Already have public key auth, but I keep a password login on one account as I haven't yet committed my private key to memory. – Josh K May 19 '10 at 4:33

I get those all the time, they never end. The best thing is just to make sure you arent using generic accounts that have generic passwords.

I also use fail2ban, and it has worked fine. (But most of the time, I get hit by all different hosts, so it doesn't help too much)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.