Secure SSH against brute force attacks

With more and more people installing Amahi we have more and more Amahi's exposed to the internet when people start opening up ports in their routers to be able to access their servers remotely. Since SSH is used by many this is often also exposed outwards. This opens up for SSH brute force attacks (which can be both fast and effective).

[root@dahome ~]# iptables --list
Chain INPUT (policy ACCEPT)
 target     prot opt source               destination
 ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh state NEW recent: SET name: SSH side: source mask: 255.255.255.255
 LOG        tcp  --  anywhere             anywhere             tcp dpt:ssh recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: SSH side: source mask: 255.255.255.255 LOG level  warning prefix "SSH_brute_force " 
 DROP       tcp  --  anywhere             anywhere             tcp dpt:ssh recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: SSH side: source mask: 255.255.255.255
Chain FORWARD (policy ACCEPT)
 target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
 target     prot opt source               destination

This will allow a couple of failed SSH login attempts and then add a 60 second cool down. Effectively killing any interest in brute forcing the server in question. Another tip is to disable root ssh access if you don't really need it since that is one of the most common user names used when brute forcing.

Alternative Ports

Another technique that can help reduce the automatic probes of the SSH port (port 22), is to use some alternative port. For instance, you could choose a port, say port 9988, and forward that (TCP) port from the outside of your router to your HDA's port 22. To connect to your HDA (in this example myhda.yourhda.com) from outside, you could then do:

   ssh -p 9988 myhda.yourhda.com

If this gets old, you can avoid the -p in the client configuration. In Linux/Mac OS X systems, this can be done with the .ssh/config file, by adding:

   Host myhda.yourhda.com
           Port 9988

and you will not need to type the -p in ssh or other programs that use ssh, like rsync, when accessing your host.

Other Techniques

Other techniques, in some case more advanced, include:

• Dual-factor authentication
• Port knocking