Secure SSH against brute force attacks - Revision history

Inquam at 06:09, 30 August 2013

2013-08-30T06:09:09Z

Bigfoot65 at 21:32, 29 August 2013

2013-08-29T21:32:59Z

Inquam at 13:36, 29 August 2013

2013-08-29T13:36:27Z

Inquam at 06:54, 29 August 2013

2013-08-29T06:54:40Z

Inquam at 06:36, 29 August 2013

2013-08-29T06:36:50Z

Cpg at 22:53, 28 August 2013

2013-08-28T22:53:52Z

Cpg: /* Alternative Ports */

2013-08-28T20:27:53Z

Alternative Ports

Cpg at 20:27, 28 August 2013

2013-08-28T20:27:36Z

Inquam: Created page with "With more and more people installing Amahi we have more and more Amahi's exposed to the internet when people start opening up ports in their routers to be able to access their..."

2013-08-28T13:25:19Z

Created page with "With more and more people installing Amahi we have more and more Amahi's exposed to the internet when people start opening up ports in their routers to be able to access their..."

New page

With more and more people installing Amahi we have more and more Amahi's exposed to the internet when people start opening up ports in their routers to be able to access their servers remotely. Since SSH is used by many this is often also exposed outwards. This opens up for SSH brute force attacks (which can be both fast and effective).
To bring some kind of default protection to the platform against this I purpose that we include the following iptable rules by default

[root@dahome ~]# iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: SET name: SSH side: source mask: 255.255.255.255
LOG tcp -- anywhere anywhere tcp dpt:ssh recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: SSH side: source mask: 255.255.255.255 LOG level warning prefix "SSH_brute_force "
DROP tcp -- anywhere anywhere tcp dpt:ssh recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: SSH side: source mask: 255.255.255.255
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination

This will allow a couple of failed SSH login attempts and then add a 60 second cool down. Effectively killing any interest in brute forcing the server in question.
Another tip is to disable root ssh access if you don't really need it since that is one of the most common user names used when brute forcing.

@@ Line 23: / Line 23: @@
   iptables-save > /etc/sysconfig/iptables
 <b>NOTE:</b> This actually doesn't work for F19. They have changed things. So you will lose the settings on reboot and have to manually enter them again. Will update once I found the correct way for F19.
 = Disable root ssh access =

@@ Line 22: / Line 22: @@
   iptables-save > /etc/sysconfig/iptables
- - NOTE... This actually doesn't work for F19. They have changed things. So you will loos the settings on reboot and have to manually enter them again. Will udpate once I found the correct way for F19.
+<b>NOTE:</b> This actually doesn't work for F19. They have changed things. So you will lose the settings on reboot and have to manually enter them again. Will update once I found the correct way for F19.
 = Disable root ssh access =

← Older revision		Revision as of 13:36, 29 August 2013
Line 22:		Line 22:

	iptables-save > /etc/sysconfig/iptables		iptables-save > /etc/sysconfig/iptables
		+	- NOTE... This actually doesn't work for F19. They have changed things. So you will loos the settings on reboot and have to manually enter them again. Will udpate once I found the correct way for F19.

	= Disable root ssh access =		= Disable root ssh access =

← Older revision		Revision as of 06:36, 29 August 2013
Line 1:		Line 1:
	With more and more people installing Amahi we have more and more Amahi's exposed to the internet when people start opening up ports in their routers to be able to access their servers remotely. Since SSH is used by many this is often also exposed outwards. This opens up for SSH brute force attacks (which can be both fast and effective).		With more and more people installing Amahi we have more and more Amahi's exposed to the internet when people start opening up ports in their routers to be able to access their servers remotely. Since SSH is used by many this is often also exposed outwards. This opens up for SSH brute force attacks (which can be both fast and effective).
−	~~To bring some kind of default protection to the platform against this I purpose that we include the following iptable rules by default~~

	[root@dahome ~]# iptables --list		[root@dahome ~]# iptables --list

← Older revision		Revision as of 22:53, 28 August 2013
Line 28:		Line 28:

	and you will not need to type the -p in ssh or other programs that use ssh, like rsync, when accessing your host.		and you will not need to type the -p in ssh or other programs that use ssh, like rsync, when accessing your host.
		+
		+	= Other Techniques =
		+
		+	Other techniques, in some case more advanced, include:
		+
		+	* [http://www.linuxjournal.com/article/8957 Dual-factor authentication]
		+	* [https://www.linux.com/learn/tutorials/351079-weekend-project-secure-your-system-with-port-knocking Port knocking]

@@ Line 12: / Line 12: @@
    target     prot opt source               destination
-This will allow a couple of failed SSH login attempts and then add a 60 second cool down. Effectively killing any interest in brute forcing the server in question.
+There are many more or less elaborate ways of doing this, but these three simple rules add good basic protection. This will allow a couple of failed SSH login attempts and then add a 60 second cool down. Effectively killing any interest in brute forcing the server in question.
 Another tip is to disable root ssh access if you don't really need it since that is one of the most common user names used when brute forcing.

← Older revision		Revision as of 20:27, 28 August 2013
Line 27:		Line 27:
	Port 9988		Port 9988

−	and you will not need to type the -p in ssh or other programs that use ssh, like rsync.	+	and you will not need to type the -p in ssh or other programs that use ssh, like rsync, when accessing your host.

← Older revision		Revision as of 20:27, 28 August 2013
Line 15:		Line 15:
	This will allow a couple of failed SSH login attempts and then add a 60 second cool down. Effectively killing any interest in brute forcing the server in question.		This will allow a couple of failed SSH login attempts and then add a 60 second cool down. Effectively killing any interest in brute forcing the server in question.
	Another tip is to disable root ssh access if you don't really need it since that is one of the most common user names used when brute forcing.		Another tip is to disable root ssh access if you don't really need it since that is one of the most common user names used when brute forcing.
		+
		+	= Alternative Ports =
		+
		+	Another technique that can help reduce the automatic probes of the SSH port (port 22), is to use some alternative port. For instance, you could choose a port, say port 9988, and forward that (TCP) port from the outside of your router to your HDA's port 22. To connect to your HDA (in this example myhda.yourhda.com) from outside, you could then do:
		+
		+	ssh -p 9988 myhda.yourhda.com
		+
		+	If this gets old, you can avoid the -p in the client configuration. In Linux/Mac OS X systems, this can be done with the .ssh/config file, by adding:
		+
		+	Host myhda.yourhda.com
		+	Port 9988
		+
		+	and you will not need to type the -p in ssh or other programs that use ssh, like rsync.