Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #196525

Re: Undesired ssh login attempts

Show all headers | View raw

Reco wrote:

> You mean that all these connections originate from 197.159.128.171?
> "iptables -I INPUT -s 197.159.128.171/29 -j DROP" will take care of it.
> 

No this was just an example - they come from different IPs. Some days
nothing, some days it is nothing.

> While you're at it, write an abuse letter to Jonathan Lamptey - he? owns
> problematic IP range according to AFRINIC.
> 
> 
>> I think both are secure: for ssh no users with easy password allowed to
>> login
> 
> If you have password-enabled ssh with stock Ciphers, MACs, and Kex'es
> enabled, and your only protection is non-standard ssh port - then you
> are doing it wrong.
> 
> Set these to /etc/ssh/sshd_config, and watch all those script-kiddies
> cry as they won't be able to connect to you at all:
> 
> Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
> MACs
>
hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
> KexAlgorithms
> curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
> 
> And forbid ssh password authentication. They've invented key-based
> authentication for cases like yours 15 years ago.
> 
> 

Thanks, this is a good advise I will investigate. In fact I have 2 ssh
servers - one for internal network and one for external. External is
allowed only for 3 users including me. When I upgraded to jessie or to
stretch I also updated the cipher rules, but I will double check.

>> and apache - no pages or stuff that would compromise.
> 
> As long as this apache serves static HTML only then you're probably safe
> indeed.

Ok thanks for that - I think it is true as it is local server and there is
nothing php - but just documentation.

thanks 

regards

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Undesired ssh login attempts deloptes <deloptes@gmail.com> - 2018-06-10 13:00 +0200
  Re: Undesired ssh login attempts Dan Purgert <dan@djph.net> - 2018-06-10 13:20 +0200
    Re: Undesired ssh login attempts Roberto C. Sánchez <roberto@debian.org> - 2018-06-10 14:30 +0200
      Re: Undesired ssh login attempts Dan Purgert <dan@djph.net> - 2018-06-11 12:10 +0200
    Re: Undesired ssh login attempts Thomas D Dial <tdial@acm.org> - 2018-06-11 03:50 +0200
  Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-10 13:30 +0200
    Re: Undesired ssh login attempts Dejan Jocic <jodejka@gmail.com> - 2018-06-10 14:30 +0200
    Re: Undesired ssh login attempts deloptes <deloptes@gmail.com> - 2018-06-10 16:40 +0200
    Re: [Debian] Re: Undesired ssh login attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 13:20 +0200
      Re: [Debian] Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-11 14:00 +0200
        Re: [Debian] Re: [Debian] Re: Undesired ssh login attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 14:10 +0200
          Re: [Debian] Re: [Debian] Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-11 14:30 +0200
            Re: [Debian] Re: [Debian] Re: [Debian] Re: Undesired ssh login  attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 15:00 +0200
  Re: Undesired ssh login attempts likcoras <likcoras@riseup.net> - 2018-06-10 13:30 +0200
    Re: Undesired ssh login attempts Joe <joe@jretrading.com> - 2018-06-10 14:30 +0200

csiph-web