1

I would like to make it impossible to make more than a single remote log-in attempt in a number of seconds regardless the client IP address (except some trusted white-listed addresses perhaps). So that if, for example, an SSH user enters a bad password no other remote client can log in until the interval passes.

The purpose is to protect the system from distributed (botnet) brute force password attacks.

Is this possible?

PS: I know I can just use certificates and disable password-only log-in but I am still curious.

  • It should be possible with a pam module, but you may need to write it. I am not aware of any that meet this exact criteria. Most people are fine with pam_faildelay. – jordanm Jul 25 '14 at 0:32
  • You want to greatly facilitate denial of service attacks on your server? Then turn off the SSH service, which guarantees that no one will be able to get in that way even if they know a user's password. – Gilles Jul 25 '14 at 7:04
1

Use fail2ban which uses the firewall to disable access to ssh (and optionally, other services) after a certain number of failed attempts. By default, it blocks for 30 minutes after 3 failed attempts, but is configurable using (I believe) the maxretry value.

  • fail2ban would only disable clients from the culprit IP address, which is not what the question asks for, but which is the right thing (inasmuch as a DoS facilitator is right at all). – Gilles Jul 25 '14 at 7:05
  • @Gilles - Can you elaborate on the last part of your comment? The 'inasmuch as DoS facilitator is right at all' bit. – garethTheRed Jul 25 '14 at 7:24
  • fail2ban blocks an IP address if it makes too many failed login attempts. This will also prevent legitimate users coming from the same IP address. You trade off a risk of an attacker guessing a password by brute force for an increased risk that an attacker can prevent legitimate users from logging in. – Gilles Jul 25 '14 at 7:59
0

If you use shorewall as your firewall, you can do this with connection rate limiting.

Here is a sample configuration and explanation:

############################################################################################################################
#ACTION         SOURCE           DEST            PROTO   DEST    SOURCE          ORIGINAL        RATE            USER/   MARK
#                                                        PORT    PORT(S)         DEST            LIMIT           GROUP
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW

ACCEPT          net:192.168.1.11 $FW             tcp     ssh
ACCEPT          net              $FW             tcp     ssh     -               -               1/min:1

There are two rules in the above.

The first rule always allows SSH connections from the whitelist IP address 192.168.1.11.

The second rule will rate limit SSH connections from all addresses. The rate limiting is set at 1 connection per minute. The link above describes how to configure the rate limit.

According to the shorewall rules documentation, the ordering of the rules does matter:

For any particular (source,dest) pair of zones, the rules are evaluated in the order in which they appear in this file and the first terminating match is the one that determines the disposition of the request. All rules are terminating except LOG and COUNT rules.

That is if the first rule fires, then the second (rate-limiting) rule should not fire.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.