Re: [gentoo-user] Why isn't sshd blocking repeated failed login attempts?

[Paul Hartman]

On Tue, Jan 20, 2009 at 3:49 PM, Joshua Murphy <poisonbl@×××××.com> wrote:
> On Tue, Jan 20, 2009 at 4:33 PM, Paul Hartman
> <paul.hartman+gentoo@×××××.com> wrote:
>> Hi,
>>
>> After setting up public key authentication i changed my sshd back to
>> port 22 and got the expected bombardment of connection attempts.
>> However, it doesn't seem to ever stop them. I'm using sshd with this
>> setting:
>>
>> MaxAuthTries 3
>>
>> in my /etc/ssh/sshd_config
>>
>> So, why does it allow unlimited failed login attempts? For example, as
>> I write this I'm seeing this in my logs:
>>
> <snip>
>>
>> I'm using denyhosts but it seems that it doesn't deny anyone until an
>> hour has passed, despite the fact I'm using the daemon which
>> constantly monitors the log file... by which time hundreds or
>> thousands of attempts can be made. Maybe that's a configuration issue
>> on my denyhosts setup, but shouldn't sshd be blocking them in the
>> first place?
>>
>> Thanks,
>> Paul
>
> I'm pretty sure MaxAuthTries 3 does nothing more than disconnect you
> after 3 failed connections (meaning all you have to do is reconnect to
> keep trying)... it doesn't do any sort of 'intelligent' protection of
> the system. DenyHosts worked great for me while I used it, but I also
> found that a firewall rule limiting connection attempts to 3 per
> source IP per 10 minute period put a big dent in the number of tries
> that denyhosts ever even had to see (though they were always enough to
> get that source blacklisted, I had things set rather restrictive).
> Something I was pointed towards on IRC, in the event that the SSH
> server you're running is primarily for your use or the use of
> knowledgeable users (fellow admins)... look up Single Packet
> Authorization (SPA).

I'm using the online denyhosts synchronization database, I think that
may negatively affect how often it blocks hosts locally, because it
waits until it does a remote sync to scan the local file. This is my
theory. I like the idea of sharing my blocks and taking advantage of
the blocks of others, but if it renders the program ineffective
against the IP /actively/ attacking my system, then it's pointless.

I'm going to turn off the online sharing of denyhosts and see if it
makes a difference.

Otherwise I guess I need to set up some kind of local firewall on this
machine to get any more fine control over the connections.

Thanks
Paul