Re: SSH server under attack...

[Rembrandt <rembrandt () jpberlin de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 24 Jan 2006 23:21:17 +0100
Robert Larsen <robert () the-playground dk> wrote:

> I "solved" this problem by disabling password authentication and only 
> permitting rsa authentication.
> These options in sshd's config file do the trick:
> PasswordAuthentication no
> RSAAuthentication yes
> PubkeyAuthentication yes

Bruteforce exspects a fast connection because if you try to brute-force
with just 2 trials a minute you'll have mostly no succes.

If you're using OpenBSD you could do the followring:

pass in on $ext_if proto tcp to $web_server \
     port 22 flags S/SA keep state \
     (max-src-conn 10, max-src-conn-rate 3/10, overload <younerve>
flush)

This would simply drop every Computer wich tries to connect faster then
3 times in 10 seconds.

Just for the case that you're using OpenBSD.
I don't know if a Linuxfirewall could do the same.
You could clean this table e.g. weekly by a cron-job.
Or daily or so on.. depends to your needs.

Additional you should have such a rule too:
block drop in quick from <younerve>

So all further communication with this host gets droped.
Addtinional you should maybe use these sshd.conf-Options too:

PasswordAuthentication no
LoginGraceTime 0s
MaxAuthTries 0

Puplickey-Authentication should still work without any problem.


Kind regards,
Rembrandt

p.s.
You may wanna use the synproxy-Option in pf...
- -- 
God did a bless on me,
So accapt the dark side in you.
Hate leads me to victory, so give me a war.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (OpenBSD)

iD8DBQFD2CCDHXWDTKj6tTkRAmOqAJ9Hhg44w6XoUYEImdUh56yQ4MKnEwCbBly0
A2N+rNXutNh/jrfvKm7ovGA=
=4FsC
-----END PGP SIGNATURE-----

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity Planning, 
Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------