Method #1 - disable password logins
If you don't require allowing password logins, then simply disallowing them will give you the desired effect. Simply add this line to
Additionally you can limit password use to certain users using the
Match operator in
Match User root,foo,bar
Match User user1,user2
Method #2 - iptables
You can also use
iptables to track failed login attempts and drop them after a certain threshold. This is similar to your example from hostingfu but is easier to understand.
$ sudo iptables -I INPUT -p tcp --dport <YOUR PORT HERE> -i eth0 -m state --state NEW -m recent --set
$ sudo iptables -I INPUT -p tcp --dport <YOUR PORT HERE> -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
NOTE: The first line basically creates a rule that only applies to packets used for new connection attempts on the ssh port. The second line says that if there are more than 4 attempts from an IP within 60 seconds, then any traffic from that IP should be blackholed. This solution doesn't care whether or not the attempts on different user accounts.
Method #3 - use PAM
I realize you said you don't have PAM available, but if you did, this is how you could delay failed login attempts. If your intention is to simply delay ssh login failures then you could use the PAM module
pam_faildelay. This PAM module is generally included with the default mix.
On my Fedora 19 system it's part of the default installation.
Look for files related to
$ locate pam|grep -i delay
See what RPM they're provided by:
$ rpm -qf /usr/share/man/man8/pam_faildelay.8.gz
To create a delay on failure you'd simply add a line such as this to your
sshd pam config file. Again on Fedora/CentOS/RHEL systems this file is located here:
To create a 10 second delay:
auth optional pam_faildelay.so delay=10000000
A 60 second delay:
auth optional pam_faildelay.so delay=60000000
With a delay of 20 seconds using the above method, I changed my PAM
sshd config file like so:
auth required pam_sepermit.so
auth substack password-auth
auth include postlogin
auth optional pam_faildelay.so delay=20000000
account required pam_nologin.so
account include password-auth
password include password-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open env_params
session optional pam_keyinit.so force revoke
session include password-auth
session include postlogin
Now when I login:
Tue Dec 17 09:16:30 EST 2013
$ ssh blah@localhost
Permission denied, please try again.
...Control + C....
Tue Dec 17 09:16:50 EST 2013