Re: [gentoo-hardened] Hardening SSHD

[Brian Davis]

From everything I've read on this topic, I've come up with the 
following suggestions (from the security in layers department):

Set PermitRootLogin to no
Disallow password logins
Use DSA keys.
Move the SSHD port to something other than 22 (security by obscurity). 
Yes, we all know that someone will find it, but that someone will be 1 
in 1000 rather than all 1000 hitting the port.
Use a combination of denyhosts, fail2ban, sshdfilter (iptables based) or 
nothing at all depending on how secure you feel these applications are 
(see Andrew Ross' post in this thread).
I've seen one mention of jailing SSHD with grsecurity, but this doesn't 
seem to be the norm, at least as far as I can gather.

Thanks,
Brian

Guillaume Castagnino wrote:
> Hi,
>
> Le mercredi 25 octobre 2006 16:29, Longman, Bill a écrit :
>
>>> I've seen many recommendations for port knocking, but I feel that's
>>> unnecessarily complex when compared to simply changing the port
>>> sshd listens on. While the use of port knocking no doubt further
>>> decreases your exposure over an alternate sshd port, the difference
>>> is only a small percentage of the benefit you receive from moving
>>> away from port 22 in the first place.
>>>
>> I've moved most of my public SSH ports off 22 because it reduces by
>> thousandfolds the script kiddies playing with their toys and filling
>> my logs and pipes. There is no more efficient means that will give
>> you such returns with such little effort.
>>
>> I only wish I'd done it sooner. Yeah, you'll still get port scanned
>> and someone will snoop around, but that's not in the face of the
>> storm on port 22.
>>
>
> This is REALLY not a solution against bruteforce attacks... You say the
> reason : a port scan and the bruteforce can begin...
>
> Solutions could be :
>
> - using a daemon that analyse the logs and blacklist the guy (with
> iptables or host.deny) after X login tries, such as fail2ban (in
> portage), or
>
> - using ipt_recent like this (for example) :
>
> iptables -A INPUT -p tcp --dport ssh -m state --state NEW -m
> recent --set --name SSH
> iptables -A INPUT -p tcp --dport ssh -m state --state NEW -m
> recent --update --seconds 120 --hitcount 5 --rttl --name SSH -j DROP
>
> my 2 cents,
> Guillaume
>
>
-- 
gentoo-hardened@g.o mailing list