Preventing brute force ssh attacks [LWN.net]

Preventing brute force ssh attacks

Posted Oct 26, 2007 0:14 UTC (Fri) by kh (subscriber, #19413)
Parent article: Preventing brute force ssh attacks

I was getting so many brute force attempts on ssh that the server was not able to do anything
else but check passwords - thus a DOS. I started using denyhosts on all internet facing
servers and have not had that problem since. I find I really like the simplicity of denyhosts.

(Log in to post comments)

Preventing brute force ssh attacks

Posted Oct 26, 2007 11:43 UTC (Fri) by hein.zelle (guest, #33324) [Link]

I'm surprised nobody mentions sshdfilter in these posts, apparently it's less popular.  From
what I've heard it does about the same as denyhosts, using the sshd logs and iptables to block
connections.
 
Since installing it and switching to only-passkeys, and limiting the valid users with
AllowedUsers in sshd_config, I feel quite secure about having sshd on port 22, and I don't get
many attempts at all.

I'm not sure how valid the comment in the article is, about such an approach not working for a
botnet: sshd_filter typically blocks after the first invalid username, so only one attempt
comes through.  If a thousand hosts tried at the same time this may indeed blow up.