lkml.org 
[lkml]   [2011]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: kernel.org status: hints on how to check your machine for intrusion
On 01/10/11 19:06, Steven Rostedt wrote:
> On Sat, Oct 01, 2011 at 09:35:33AM +0200, Willy Tarreau wrote:
>>
> For my machine that is connected to the outside world, I have a script
> that runs every night that checks for attacks. As bots constantly look
> for port 22 and 80, they find my machine without issue. When my script
> detects a bunch of ssh login attempts that fail, it will add that ip
> address to the iptables DROP chain:
>
> # iptables -L -n | grep DROP | wc -l
> 2656
>
> I've picked up quite a few ;)
>
> This script only runs and scans once at night. Probably better to have
> it run more often.

Limiting SSH accesses to a few a minute (failed or not) is useful to
block many password guess attacks. I set up mine a long time ago
following this article using "recent" matches in iptables:

http://www.debian-administration.org/articles/187

You'll want to set the same rules for ipv6.

This won't stop low frequency and distributed attacks, and sometimes but
extremely rarely I find myself connecting more quickly than the rate limit.

Setting "PasswordAuthentication no" in your sshd_config is good too.

Regards,

Frank

--
------------------------------------------------------------------------
Frank A. Kingswood frank@kingswood-consulting.co.uk
Cambridge, United Kingdom +44-870-095 0000


\
 
 \ /
  Last update: 2011-10-02 00:15    [W:0.130 / U:0.352 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site