I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:-

  1. Locking a person for 15 minutes if they fail to login correctly three times in succession over a five minute period.

  2. Locking them out totally and making them reset their password if they fail to login correctly, say, a dozen times in succession in any one 24 hour period.

Are there any guidelines or best practices around? A search on the Internet suggests that there is a lack of guidelines on this.

  • 1
    Disable passwords all-together as the dependency for the standard-enduser to be disciplined enough to constantly stick to safe security practices is inherently flawed. I issue private keys with 4096 bits encryption (ssh-keygen -t rsa -b 4096) to all the users that need access to a server and just add their public key to the server's authorized_keys file in the .ssh folder. This adds conveniences for the enduser and better security for you. – devnull Feb 24 '15 at 13:25
  • Beware that if you make your throttling too tight, it makes denial of service likely. Your suggested values are definitely too tight. – Gilles 'SO- stop being evil' Feb 24 '15 at 22:23
  • @Gilles - are there any suggested values or guidelines if might are too stringent... – MichaelJohn Feb 25 '15 at 9:29
  • That's something you could ask on Information Security, with some information about your scenario (what type of users, what usage patterns, what threat model, …). – Gilles 'SO- stop being evil' Feb 25 '15 at 17:11

You use DenyHOSTS. From the blurp on their webpage:

enyHosts is a script intended to be run by Linux system administrators to help thwart SSH server attacks (also known as dictionary based attacks and brute force attacks).

If you've ever looked at your ssh log (/var/log/secure on Redhat, /var/log/auth.log on Mandrake, etc...) you may be alarmed to see how many hackers attempted to gain access to your server. Hopefully, none of them were successful (but then again, how would you know?). Wouldn't it be better to automatically prevent that attacker from continuing to gain entry into your system?

DenyHosts attempts to address the above... and more.

The more includes recording of all failed attempt for a user and offending host, and when a host reaches a certain threshold, blacklisting that host.

| improve this answer | |
  • Am currently evaluating DenyHOSTS... – MichaelJohn Feb 25 '15 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.