0

Is there such a script that blocks IPs that try more than 3-4 times to access root? Because everytime I open the server (CentOS) i get the message that root has been brute forced (bots obviously). I have their IPs but I don't want to manually ban them with iptables -A INPUT -s IP-ADDRESS -j DROP.

Improve this question
5
  • 5
    best option : Disable root login. Other : fail2ban or DenyHosts is your friend
    – Rahul
    Jul 20, 2016 at 9:15
  • 3
    And if you want to go on with banning, something like fail2ban should do the trick.
    – zagrimsan
    Jul 20, 2016 at 9:19
  • Used fail2ban and it worked.
    – Schneejäger
    Jul 20, 2016 at 10:14
  • or instead of disabling root login entirely, restrict it to authorized_keys only with PermitRootLogin prohibit-password in /etc/ssh/sshd_config. Alternatively, use forced-commands-only and have different keys in ~root/.ssh/authorized_keys to run different things as root. remote root access without going via a user and sudo can be useful.
    – cas
    Jul 21, 2016 at 3:12
  • IMO the only time you should use a password for an ssh login is when you're first adding your public key(s) to ~/.ssh/authorized_keys.
    – cas
    Jul 21, 2016 at 3:15

1 Answer 1

Reset to default
2

The standard tool for the job is fail2ban. It bans for a certain time an IP address that tried to login unsuccessfully, and it is highly configurable.

It is not available on the standard CentOS repositories, you have to install the EPEL repo first.

On CentOS 6:

yum install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

On CentOS 7:

yum install http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-1.noarch.rpm

and then:

yum install fail2ban

Note: it is highly recommended that you disable root login (this is done in the configuration of sshd).

Improve this answer
1
  • Worked like a charm with it. Also works if you install it by Plesk web host edition.
    – Schneejäger
    Jul 20, 2016 at 10:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .