From: "Brian D. McGrew" <brian@xxxxxxxxxxxxx>
Good morning,
I'm looking to tighten up my ssh configuration. I have to have SSH open
on the box at home so I can get to it from the office. I've found
several articles on securing ssh that include deny root access and
require 'wheel' group membership for su.
Is changing the port to something non-standard a good idea? What else
can I do; can someone point me to a good write up on it?
At the risk of being tendentious about it this is the trick I found
works very well:
===8<---
$IPTABLES -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --set
$IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
--rcheck --seconds 120 --hitcount 3 -j LOG --log-prefix 'SSH REJECT: '
$IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
--rcheck --seconds 120 --hitcount 3 -j REJECT --reject-with tcp-reset
===8<---
Modify it to match your defines and names. I built my own set of rules
that have some special capabilities in them that I need. (I open a video
streaming hole when needed from another host on the system, for example.)
What this does is prevent any site from making more than two tries in
120 seconds. So far all attacks have been steady streams at VERY high
rates of connection attempt. They all get blocked after the first two.
Barring a cosmic accident with the right password being guessed right
off there's no chance of a break in even with ABCDefg as a password
before the Earth is engulfed by the Sun as the Sun ages. Even if they
get the 120 second rythmn going a decent password would be good just
an awesome long time. So it's not worth their efforts.
{^_^} Joanne
