Prevent BREAKIN ATTEMPT!

[IKShadow]

Hi

I have a lot of breakin attempts on my server (you can see few exemples bellow).

Is it possible to set some kind of auto ban for IP's after invalid user or password is entered 10 times.

Nov 17 14:59:57 krneki sshd[20092]: Address 202.83.173.146 maps to ntc.net.pk, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT!
Nov 17 14:59:59 krneki sshd[20096]: Address 202.83.173.146 maps to ntc.net.pk, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT!
Nov 17 15:00:00 krneki sshd[20098]: Address 202.83.173.146 maps to ntc.net.pk, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT!
Nov 18 02:14:50 krneki sshd[19207]: Invalid user kernel from 88.198.22.107
Nov 18 02:14:50 krneki sshd[19209]: Invalid user july from 88.198.22.107
Nov 18 02:14:50 krneki sshd[19211]: Invalid user juliet from 88.198.22.107
Nov 18 02:14:51 krneki sshd[19213]: Invalid user kernel from 88.198.22.107

[falko]

Originally Posted by IKShadow

Is it possible to set some kind of auto ban for IP's after invalid user or password is entered 10 times.

Have a look here: http://www.howtoforge.com/preventing...with_denyhosts

[IKShadow]

Originally Posted by falko

Have a look here: http://www.howtoforge.com/preventing...with_denyhosts

Thank you for quick reply.

[domino]

It's not uncommon to see a lot of entries in your logs. i have BFD installed and my logs show many. Just make sure you use a really hard password numbers, and chars.

If you really want to make it a little harder, change the root shell port to anything other than 22 and create 2 logins. a dummy login and then the root login. It wont make your server impenitrable, but it can make it a little harder for intruders.

[edge]

Originally Posted by domino

If you really want to make it a little harder, change the root shell port to anything other than 22 and create 2 logins. a dummy login and then the root login. It wont make your server impenitrable, but it can make it a little harder for intruders.

Or just create a firewall rule with IPTABLES for the IP (yours) that is okay to access the server with SSH

[domino]

well that would be a problem with jailed users that request shell. And I would imagine it would be anoying if you and your clients have a dynamic IP.

[edge]

Originally Posted by domino

well that would be a problem with jailed users that request shell. And I would imagine it would be anoying if you and your clients have a dynamic IP.

That is true!

An other nice way is by using Port Knocking
Again.. Not a nice way for your users...