| 1 |
Thanks for all the great input guys. |
| 2 |
Theres a lot of reading to do before I can decide ona the most suitable |
| 3 |
option for me, but I'll get through it all. |
| 4 |
|
| 5 |
While i'm getting my head around everything to impliment a permanent |
| 6 |
solution, what about this? (sorry, not great with iptables just yet..) |
| 7 |
Leave sshd listening on port 22, but firewall off everything except my |
| 8 |
trusted IP's (localhost, home, girlfriend, work subnet, internal subnet, |
| 9 |
flatmates server) . |
| 10 |
Add an IPTables rule to port forward $ambiguous_external_port through to |
| 11 |
port 22 on localhost (or if its safer, the 10.x.x.x IP assigned to the |
| 12 |
machine) , and log the instance. |
| 13 |
My thinking is that this would make it harder for someone to find my |
| 14 |
open ssh port, but leave me the convenience of not having to specify a |
| 15 |
port when I connect from my regular connections, dozens of times a day. |
| 16 |
Or is it just going to open up an IP spoofing exploit on port 22, and |
| 17 |
achieve practically nothing? |
| 18 |
|
| 19 |
Presumably this would eliminate the need for my original idea of |
| 20 |
search-and-destroy on the brute force scripts, but I'll probably look at |
| 21 |
implimenting something along those lines when I get my ftpd going (i'm |
| 22 |
using SCP for everything now, but theres a need to change that. ) and |
| 23 |
will still look at using the idea for my permanent SSH solution. |
| 24 |
|
| 25 |
I like the sound of of SEC, the IPTables' "recent" option, and port |
| 26 |
knocking. Because NZ IPs are assigned from the APNIC ranges, I'm not |
| 27 |
sure how well the GEOIP patch would work, but i'll look into it. |
| 28 |
(otherwise I would have blacklisted all of Asia already) |
| 29 |
I'm going to read through all the rules and scripts posted, once i've |
| 30 |
researched the available tools, and i'll go from there. |
| 31 |
|
| 32 |
|
| 33 |
Cheers |
| 34 |
Jeremy B |
| 35 |
|
| 36 |
Jeremy Brake wrote: |
| 37 |
|
| 38 |
> Hey all, |
| 39 |
> |
| 40 |
> I'm looking for an app/script which can monitor for failed ssh logins, |
| 41 |
> and block using IPTables for $time after $number of failed logins (an |
| 42 |
> exclusion list would be handy as well) so that I can put a quick stop |
| 43 |
> to these niggly brute-force ssh "attacks" I seem to be getting more |
| 44 |
> and more often. |
| 45 |
> |
| 46 |
> Anyone have any ideas? |
| 47 |
> |
| 48 |
> Thanks, Jeremy B |
| 49 |
|
| 50 |
|
| 51 |
-- |
| 52 |
gentoo-security@g.o mailing list |
Archives