3

This might sound like a bit of a strange question, but I've just taken a sample of over 80 IPs which have failed SSH authentication, and I've mapped them using an online mapping tool.

All of them came from China / Korea... my question is how can I block a range of IPs which would stop these countries being allowed to make SSH requests to my machine, as it's just filling up my logs and wasting traffic.

I'm using shorewall as my firewall if that helps.

7

To solve this issue people usually implement tools like sshguard or fail2ban.

Find sshguard at: http://www.sshguard.net/
Find fail2ban at: http://www.fail2ban.org/wiki/index.php/Main_Page

  • 3
    Fail2ban is SOOOOO easy and SOOOOO good – Pitto Jan 5 '12 at 10:54
  • This. You don't want to ban SSH access from 'strange foreign places' you want to block SSH access from IPs that are trying to DoS or brute force your system. – Freiheit Jan 5 '12 at 14:35
  • Remember to add few machines you have access to the whitelist – Hubert Kario Jan 16 '12 at 12:10
  • Fail2ban even work for httpd and it look promising. +1 for sharing this. – AzizSM Jun 20 '14 at 1:31
3

Use geoip. Xtables is your friend.

0

A generic solution for bruteforce denials is denyhosts. Check it out at http://denyhosts.sourceforge.net/

This will block any IP after a configured count of failed login attempts. It also works for FTP daemons and every other tool that comes with tcp wrapper support.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.