SSH failures - auto-block by ip?

Question

Level 1

90 points

SSH failures - auto-block by ip?

I know there are several ways to auto-block IPs of failed SSH dictionary attckers on Linux, are there any such scripts or apps for Xserve?

I've looked at several of the Linux scripts, and most of them are specific to the distribution they are written for. I'm not a programmer, not even a shell scripter, so building custom stuff is a bit beyond me.

Any help would be greatly appreciated, since my server is going live on Monday (in a datacenter which has caused me script-kiddie trouble in the past, but it's my only option currently) and I want to be as protected as possible.

Turning off SSH is really not an option, since I'm going to be doing all server administration from my home, and I'll have minimal site access.

Thanks,

-Gregg

G4 Cube, Mac OS X (10.4.8)

Posted on Feb 17, 2007 8:08 AM

Reply

Answer 1

Feb 17, 2007 4:49 PM in response to gdiscenza

Would allowing access from your home IP and the internal networks and blocking from everyone else on port 22 work for you?

Roger

Reply

Answer 2

gdiscenza Author

Level 1

90 points

Feb 17, 2007 6:26 PM in response to Community User

No, the problem is that my home IP changes every time I need to restart my DSL modem - about once every week or so. I need to be able to connect as any IP address Verizon sees fit to give to me, and I haven't been able to pin down any specific range....

Otherwise, the idea is a good one.

Another thought I had was simply remapping SSH to port 9922 and removing it from port 22 - effectively "hiding" it from the dictionary attacks and script kiddies.

Any thoughts?

-Gregg

Reply

Answer 3

Feb 17, 2007 11:30 PM in response to gdiscenza

Another thought I had was simply remapping SSH to
port 9922 and removing it from port 22 - effectively
"hiding" it from the dictionary attacks and script
kiddies.

Which doesn't protect you from weak passports. I'd disable all but pubkey auth method in sshd_config.

Changing the default ssh port in tiger is quite tricky beacause ssh is launched by launchd. Launchd is listening for connections on the port defined by the pair i) SockServiceName in sshd.plist and ii) the corresponding port value for ssh in /etc/services. These values have to be changed to your port of choice and I suggest to maintain the ascending sorted list and place the changed lines at the end.

-Ralph

Reply

Answer 4

Feb 19, 2007 3:30 PM in response to gdiscenza

If you can get your IP address and netmask that Verizon assigns, you can calculate your network number by and'ing them, and use that for the allow rule.

Roger

Reply

Answer 5

David_x

Level 4

3,011 points

Feb 19, 2007 4:28 PM in response to gdiscenza

Is VPN not an option? L2TP with additional pass-phrase is extemely secure and very simple to configure. This would then allow all services including ssh.

-david

Reply

Answer 6

PatGmac

Level 3

510 points

Feb 21, 2007 5:28 AM in response to gdiscenza

Denyhosts works with OS X.
http://denyhosts.sourceforge.net/index.html

See the FAQ.

Reply