-1

My Centos 7.5 server in the past few days got thousands of incoming SSH login attempts and today I couldn't log in to my VNC clients because it just said "Too many security failures". So would like to ask what options are available for me to solve this problem? I read that tunneling can solve this but I just don't really want to use that because of its too much hassle.

  • It depends on architecture of your network. Is this server accessible from internet? You can add VPN server to your network or if it's not possible you can change SSH port to different than standard one. Also you can use fail2ban, you can allow traffic to SSH service from only specified IPs. There is a lot of options. – mrc02_kr Oct 19 '18 at 15:28
  • Change password. help.realvnc.com/hc/en-us/articles/… – Ipor Sircer Oct 19 '18 at 15:35
0

SSH

  1. Disable direct root access:

    cat /etc/ssh/sshd_config | grep PermitRootLogin
    

    shall be set to:

    PermitRootLogin no
    
  2. Enforce SSH protocol version 2:

    cat /etc/ssh/sshd_config | grep Protocol
    

    shall be set to:

    Protocol 2
    
  3. Change port to a random one, e.g. 56789:

    cat /etc/ssh/sshd_config | grep Port
    

    shall be set to:

    Port 56789
    
  4. Punch hole in firewall for it:

    sudo iptables -A INPUT -p tcp -m tcp --dport 56789 -m comment --comment "SSH custom port" -j ACCEPT
    
  5. Generate a new public / private key pair:

    ssh-keygen -t rsa -b 4096
    
  6. Add this key and verify there is no other:

    eval $(ssh-agent -s)
    ssh-add
    ssh-add -l
    

    shall result in:

    4096 SHA256:gibberish /home/fictional_user/.ssh/id_rsa (RSA)
    4096 SHA256:gibberish fictional_user@fictional_computer (RSA)
    
  7. Import the public key to your client machines, which will be maintaining the server:

    ssh-copy-id fictional_user@public_ip -p 56789
    
  8. Afterwards, disable the password authentication completely:

    cat /etc/ssh/sshd_config | grep PasswordAuthentication
    

    shall be set to:

    PasswordAuthentication no
    

VNC

You should only allow certain IP adress range, e.g. for the default local network only it would be something like (with iptables):

sudo iptables -A INPUT -p tcp -m tcp --dport 5900 -m comment --comment "VNC on desktop: local network only" -m iprange --src-range 192.168.0.1-192.168.0.254 -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.