Re: Delay between failed login attempts? (OpenSSH)
- From: René Berber <rberber@xxxxxxxxxxxxxxx>
- Date: Wed, 19 Sep 2007 15:47:46 -0700
On Sep 18, 6:12 am, Suk wrote:
Im using OpenSSH on Suse 10.2[...
I get hackers trying to ssh into my server all the time and /var/log/
messages fills up with various messages like below
Sep 18 01:58:06 linux sshd[28115]: Invalid user guest from
222.83.228.151
Obviously these people are using some kind of brute force password
guessing program to attempt to gain access to my system.
Can I increase the delay between failed login attempts? Say after a
certain number of failed logins the ssh server doesnt accept new
connections for a few seconds?
Options like these help (in /etc/sshd_config):
MaxAuthTries 4
MaxStartups 1:3:6
I want these types of programs to frustratingly long to use for the
hackers trying to gain acess..
Any ideas?
Block them, you only need ssh built with tcp_wrappers support and one
of:
- DenyHosts
- Fail2ban
- probably others
that monitor a log file (authlog, messages, syslog,...) and block the
IP after a given number of failed tries. Of course you can white list
your own LAN or known external hosts.
--
René Berber
.
- References:
- Prev by Date: Re: private key with no passphrase detection
- Next by Date: Re: private key with no passphrase detection
- Previous by thread: Delay between failed login attempts? (OpenSSH)
- Next by thread: Re: Delay between failed login attempts? (OpenSSH)
- Index(es):
Relevant Pages
|
|
