On 08/01/07, gjgowey (at) tmo.blackberry (dot) net [email concealed] <gjgowey (at) tmo.blackberry (dot) net [email concealed]> wrote:
> Password access via SSH should be banned. On my colo'd server I have public
> key authentication as the only valid authentication method enabled.
> However, I still notice numerous attempts in my log files of trying brute
> force attacks. I've seen upwards of over 1000+ tries from the same IP in
> some instances. SSH really needs better defense mechanisms against these
> script kiddies like a timeout for some period of time for an IP when they're
> trying an obvious brute force.

I hope you guys are aware of the very neat OpenSSH option
'MaxStartups'. IIRC it's a new feature of some recent OpenSSH
releases. Personally, I like it very much (and have it as low as 2 or
3). :)

Excerpt from 'man sshd_config':

MaxStartups
Specifies the maximum number of concurrent
unauthenticated connections to the SSH daemon. Additional connections
will be dropped until authentication succeeds or the LoginGraceTime
expires for a connection. The default is 10.

Alternatively, random early drop can be enabled by
specifying the three colon separated values ``start:rate:full'' (e.g.
"10:30:60"). sshd(8) will refuse connection attempts with a
probability of ``rate/100'' (30%) if there are currently ``start''
(10) unauthenticated connections. The probability increases linearly
and all connection attempts are refused if the number of
unauthenticated connections reaches ``full'' (60).

--
http://nk99.org/

[ reply ]