Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #196521

Re: Undesired ssh login attempts

Show all headers | View raw

On 10-06-18, Reco wrote:
> 	Hi.
> 
> On Sun, Jun 10, 2018 at 12:55:24PM +0200, deloptes wrote:
> > Hi,
> > I recently get many of those, which means someone found out that ssh
> > external is on port 22222 and is trying to do some evil work there.
> > Should I worry or do something?
> > Similar for apache web server.
> 
> You mean that all these connections originate from 197.159.128.171?
> "iptables -I INPUT -s 197.159.128.171/29 -j DROP" will take care of it.
> 
> While you're at it, write an abuse letter to Jonathan Lamptey - he? owns
> problematic IP range according to AFRINIC.
> 

While that will certainly solve that problematic IP address, best
practice would be to have some limit per IP address set in your firewall
rules. In case of using iptables something like this should work:

iptables I INPUT -p tcp --dport 2222 -i eth0 -m state --state NEW -m recent --set

iptables -I INPUT -p tcp --dport 2222 -i eth0 -m state --state NEW -m recent  --update --seconds 60 --hitcount 4 -j DROP

That will limit to 3 attempts per minute per IP address for port 2222 which you use for SSH. If you use ufw for firewall, it would be simpler:

ufw limit 2222/tcp
> 
> > I think both are secure: for ssh no users with easy password allowed to
> > login
> 
> If you have password-enabled ssh with stock Ciphers, MACs, and Kex'es
> enabled, and your only protection is non-standard ssh port - then you
> are doing it wrong.
> 
> Set these to /etc/ssh/sshd_config, and watch all those script-kiddies
> cry as they won't be able to connect to you at all:
> 
> Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
> MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
> KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
> 
> And forbid ssh password authentication. They've invented key-based
> authentication for cases like yours 15 years ago.
> 
> 

Aye, key-based authentication is definitely way to go. Password
authentication is bad for your health.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Undesired ssh login attempts deloptes <deloptes@gmail.com> - 2018-06-10 13:00 +0200
  Re: Undesired ssh login attempts Dan Purgert <dan@djph.net> - 2018-06-10 13:20 +0200
    Re: Undesired ssh login attempts Roberto C. Sánchez <roberto@debian.org> - 2018-06-10 14:30 +0200
      Re: Undesired ssh login attempts Dan Purgert <dan@djph.net> - 2018-06-11 12:10 +0200
    Re: Undesired ssh login attempts Thomas D Dial <tdial@acm.org> - 2018-06-11 03:50 +0200
  Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-10 13:30 +0200
    Re: Undesired ssh login attempts Dejan Jocic <jodejka@gmail.com> - 2018-06-10 14:30 +0200
    Re: Undesired ssh login attempts deloptes <deloptes@gmail.com> - 2018-06-10 16:40 +0200
    Re: [Debian] Re: Undesired ssh login attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 13:20 +0200
      Re: [Debian] Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-11 14:00 +0200
        Re: [Debian] Re: [Debian] Re: Undesired ssh login attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 14:10 +0200
          Re: [Debian] Re: [Debian] Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-11 14:30 +0200
            Re: [Debian] Re: [Debian] Re: [Debian] Re: Undesired ssh login  attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 15:00 +0200
  Re: Undesired ssh login attempts likcoras <likcoras@riseup.net> - 2018-06-10 13:30 +0200
    Re: Undesired ssh login attempts Joe <joe@jretrading.com> - 2018-06-10 14:30 +0200

csiph-web