On Tuesday 08 November 2005 10:40 am, Ulf Rasch wrote:

If you refer to the thread "[SLE] stopping dictionary attacks on sshd" look at the post from Kevin 15:19 today. There is not more to add. This "coolsolution" or changing the portnumber sshd will listen on only help you that these attacks don't fill you logs.

Adding a host to the /etc/hosts.deny file does much more than prevent my logs from filling up. It's not filling my logs because the offending host is no longer accessing my server. -- Louis Richards

...

Adding a host to the /etc/hosts.deny file does much more than prevent my logs from filling up. It's not filling my logs because the offending host is no longer accessing my server.

Not really.

It stops that offender, at least for some time. It will not stop the thousand more offenders out there. It is not a final solution.

My only concern was to discourage the offenders that try to get into my system. I know there are many more out there. -- Louis Richards

On Wednesday 09 November 2005 02:57 pm, Ulf Rasch wrote:

Louis Richards wrote:

...

On Tuesday 08 November 2005 10:40 am, Ulf Rasch wrote:

...

If you refer to the thread "[SLE] stopping dictionary attacks on sshd" look at the post from Kevin 15:19 today. There is not more to add. This "coolsolution" or changing the portnumber sshd will listen on only help you that these attacks don't fill you logs.

Adding a host to the /etc/hosts.deny file does much more than prevent my logs from filling up. It's not filling my logs because the offending host is no longer accessing my server.

How many hosts will that script put into you hosts.deny until you give up and try a more secure way? 10, 100, 1000? With password authentication you still give every host which is not in your blacklist x tries. With publickey authentication they can try forever. They would need your key and its password and not a dictionary to break into your box through ssh. (given that there are security issues with ssh of course) Given that you have setup your sytem for publickey authentication and disabled passwords there would be no need to put this script on your server.

Ulf

You are 100% correct. There are many ways to secure a system and many better than this script. For those of us that are using keys, I would suggest adding from="000.000.000.000" to the beginning of the entry if you know the host ip that will be connecting. Of course, not everyone can use this method as it may be to restrictive. It's a bit of a balancing act. I was only trying to point out that adding a host to my hosts.deny file does quite a bit more than prevent my logs from filling up. As to the number of entries ... the file is overwritten with each run. I usually average about 4 entries in a file. I am using passwords for ssh on some systems and keys on others. I suppose the ones using key files are more secure. The ones running things like NX Server and web apps seemed easier to integrate into single signon environments using ssh and passwords. I also run Snort with the SnortSam plugin which helps. RKHunter happily emails me a report twice a day. After all of this I suspect a determined attacker would still get in. -- Louis Richards