Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to block (slow down) brute force attacks on my sshd server. I'm following this guide http://www.rackaid.com/resources/how-to-block-ssh-brute-force-attacks/ which basically says I need to just enter the 2 commands below.

sudo iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
sudo iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent  --update --seconds 60 --hitcount 4 -j DROP

My sshd port is 6622, so I changed the entries from "22" to "6622", and put those commands in. Then I attempted to simply test the new iptables. I went to another pc and purposefully put in the wrong login password several times. Unfortunately, the new rules don't seem to be stopping me from trying as much as I want. Listed below are my current rules. What am I doing wrong?

# iptables --list

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --  anywhere             anywhere             tcp dpt:6622 state NEW recent: UPDATE seconds: 60 hit_count: 4 name: DEFAULT side: source
           tcp  --  anywhere             anywhere             tcp dpt:6622 state NEW recent: SET name: DEFAULT side: source

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain LOGDROP (0 references)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere             LOG level warning
DROP       all  --  anywhere             anywhere            
share|improve this question
3  
I recommend fail2ban to handle blocking IPs that are showing brute force attempts. It's easy to install and configure. I know it doesn't answer your question directly, but it might save you a few holes in the drywall. –  Banjer Oct 15 '13 at 1:17
    
Concur with @Banjer -- forget that rackaid link, set up fail2ban. –  Shadur Oct 15 '13 at 6:53
    
Any chance tweaking MaxStartups might help on the daemon side? –  peterph Oct 15 '13 at 7:18
1  
@peterph Only if you want to turn a brute force breakin attempt into a denial of service. –  Shadur Oct 15 '13 at 9:47

4 Answers 4

As @banjer pointed out in his comment, you're trying the wrong solution for your actual problem.

What you need to do is set up fail2ban. It uses iptables in the background to automatically block connection attempts from hosts that generate failed access attempts from various sources. It's incredibly versatile and lets you add and modify different tresholds, patterns to look for and banning methods; you'll have to tweak its default ssh jail slightly to account for the nonstandard port you're using but that shouldn't be hard.

share|improve this answer

I use rules like this to slow things down:

iptables -A DDoS -m limit --limit 12/s --limit-burst 24 -j RETURN
iptables -A DDoS -j LOG --log-prefix "[DDos Attack?] "
iptables -A DDoS -j DROP

In other places I limit things like this:

LOGLIMIT="50/h"
LOGLIMITBURST="10"
iptables -A IANA -p tcp -m limit --limit $LOGLIMIT --limit-burst \
     $LOGLIMITBURST -j DROP
share|improve this answer

Did you read man page?

man sshd_config:

 MaxAuthTries
         Specifies the maximum number of authentication attempts 
         permitted per connection.  Once the number of failures 
         reaches half this value, additional failures are logged. 
         The default is 6.
 MaxSessions
         Specifies the maximum number of open sessions permitted 
         per network connection.  The default is 10.
 MaxStartups
         Specifies the maximum number of concurrent unauthenticated
         connections to the SSH daemon.  Additional connections
         will be dropped until authentication succeeds or 
         the LoginGraceTime expires for a connection. The default is 10:30:100.

         Alternatively, random early drop can be enabled by specifying
         the three colon separated values “start:rate:full” (e.g.
         "10:30:60").  sshd(8) will refuse connection attempts with a
         probability of “rate/100” (30%) if there are currently “start”
         (10) unauthenticated connections.  The probability increases
         linearly and all connection attempts are refused if the 
         number of unauthenticated connections reaches “full” (60).
share|improve this answer
2  
Doesn't help. SSH bruteforce attacks tend to be used by distributed bot networks nowadays, so each connection would make only three or four attempts, but you'd have hundreds of connections from different hosts. –  Shadur Oct 15 '13 at 9:47

I just tried the two rules solution and I had the same issue when I checked it. Then, I remark that published rules have -i eth0 option ! I changed it to the good network interface and it finally started to work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.