Re: [gentoo-hardened] Hardening SSHD

[Andrew Ross]

Jason Booth wrote:
> On Monday 23 October 2006 13:21, Brian Davis wrote:
>> What do you folks do to harden SSHD?  I'm looking for some pointers.

> The main thing I have noticed lately is the huge volume of brute-force
> attacks:
>
> Using DenyHosts is pretty much a necessity now.
>  app-admin/denyhosts

I disagree. With password-auth disabled (in favour of public/private
keys) there are only three things to worry about with these brute-force
attacks:

1. Log spam

2. DoS

3. Bandwidth charges

With regard to (1), any decent log analysis program will be able to
filter out the spam entries.

With regard to (2), I've yet to see any DoS effect from these attacks,
although I suppose it's possible with ancient hardware and a pitifully
small internet connection :-)

With regard to (3), bandwidth charges will be incurred regardless of any
filtering performed at your machine, since the traffic still reaches
your box (as far as your upstream provider is concerned).

Obviously, it would be nice to reduce the volume of log spam and the
total volume of attack traffic being sent to your box, but there are
much simpler ways to achieve these - using denyhosts just complicates
things and provides serious attackers (ie. those using exploits, rather
than password brute-forcing) with another avenue of attack. Any
application that parses log files containing data supplied by an
attacker is potentially vulnerable to an exploit - particularly when the
application in question runs with root privileges and/or modifies a
firewall.

I've seen many recommendations for port knocking, but I feel that's
unnecessarily complex when compared to simply changing the port sshd
listens on. While the use of port knocking no doubt further decreases
your exposure over an alternate sshd port, the difference is only a
small percentage of the benefit you receive from moving away from port
22 in the first place.

There is an excellent article at
http://www.debian-administration.org/articles/187 describing the use of
the "recent" netfilter module in stopping brute-force ssh attacks at the
firewall level. In addition to its simplicity when compared to denyhosts
or a similar application, the netfilter approach can be used at your
border router to protect the entire network. A host-based solution would
allow one attack against each host, where as the netfilter approach can
limit this to one attack against any single host on the network. While
denyhosts can also achieve this, it requires the use of a central server.

Cheers

Andrew