[gentoo-user] Re: SSH brute force attacks and blacklist.py

[Remy Blank]

Steve wrote:
> I'm one of the (many) people who has opportunists trying usernames and
> passwords against SSH... while every effort has been made to secure this
> service by configuration; strong passwords; no root login remotely etc.
> I would still prefer to block sites using obvious dictionary attacks
> against me.

The best advice I can give is to use public key authentication only. 
This will defend against all dictionary-based attacks, which is what you 
describe.

The only remaining "problem" is that your log files will be filled with 
unsuccessful login attempts. A simple solution is to run sshd on a 
non-standard, high-numbered port, e.g. in the 30'000. Bots only ever try 
to connect on port 22. This will *not* improve the protection of your 
server, but it will avoid having your logs spammed.

-- Remy