<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2963" name=GENERATOR></HEAD>
<BODY text=#000000 bgColor=#ffffff>
<DIV dir=ltr align=left><SPAN class=471361201-20092006><FONT face=Arial
color=#0000ff size=2>For SSH I suggest 2 things</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=471361201-20092006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=471361201-20092006><FONT face=Arial
color=#0000ff size=2>1) "Disable" root. By this I mean, just set an improbable
password that will never ever be discovered because its 300 characters of shite.
Or whatever. Then setup SUDO and set it up well.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=471361201-20092006><FONT face=Arial
color=#0000ff size=2>2) Install fail2ban. fail2ban just ban's IP's that scan or
cause multiple auth errors.</FONT></SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> plug-bounces@plug.org.au
[mailto:plug-bounces@plug.org.au] <B>On Behalf Of </B>Jonathan
Young<BR><B>Sent:</B> Tuesday, 19 September 2006 6:40 PM<BR><B>To:</B>
plug@plug.org.au<BR><B>Subject:</B> Re: [plug] ssh scans<BR></FONT><BR></DIV>
<DIV></DIV>I would also suggest preventing ssh shell access for users with dodgy
passwords or for those who don't need it.<BR><BR>For example, on most of my
Linux boxes, I have ssh access and sudo rights, but you cannot log in as root
via ssh.<BR><BR>Stuart Midgley wrote:
<BLOCKQUOTE cite=mid685D37AD-BFCB-4D3E-94AD-62BCF607CFB6@ivec.org
type="cite">rules like these can also assist <BR><BR>-A RH-Firewall-1-INPUT -p
tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH
--rsource <BR>-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 22 -m state --state
NEW -j SSH_WHITELIST <BR>-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 22 -m
state --state NEW -m recent --update --seconds 60 --hitcount 5 --rttl --name
SSH --rsource -j LOG --log-prefix "SSH_brute_force" <BR>-A RH-Firewall-1-INPUT
-p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60
--hitcount 5 --rttl --name SSH --rsource -j DROP <BR><BR>which only accept 5
connections in 60s to port 22... if it gets more than that, it drops the
packets. Doesn't work with old versions of iptables. <BR><BR>Stu.
<BR><BR><BR><BR>On 11/09/2006, at 9:34, Shannon Carver wrote: <BR><BR>
<BLOCKQUOTE type="cite">Interesting! Jason's IPB Monitor sounds like a
good all-in-one package, <BR>might give it a go tonight for my home Machine.
<BR><BR>I'm lucky in my current position, that most of the boxes I
administer, I do <BR>so on my own, so I can limit SSH connections to a set
of IP's where I'll be <BR>connecting from, or in the case that other users
do need SSH access to the <BR>system they're usually only connecting from
Work connections anyway (static <BR>IPs), VPN etc. <BR><BR>Thanks for the
IPB monitor link! <BR></BLOCKQUOTE><BR><BR>-- <BR>Dr Stuart Midgley
<BR>Industry Uptake Program Leader <BR>iVEC, 'The hub of advanced computing in
Western Australia' <BR>26 Dick Perry Avenue, Technology Park <BR>Kensington WA
6151 <BR>Australia <BR><BR>Phone: +61 8 6436 8545 <BR>Fax: +61 8 6436 8555
<BR>Email: <A class=moz-txt-link-abbreviated
href="mailto:industry@ivec.org">industry@ivec.org</A> <BR>WWW: <A
class=moz-txt-link-freetext href="http://www.ivec.org">http://www.ivec.org</A>
<BR><BR><BR><BR>_______________________________________________ <BR>PLUG
discussion list: <A class=moz-txt-link-abbreviated
href="mailto:plug@plug.org.au">plug@plug.org.au</A> <BR><A
class=moz-txt-link-freetext
href="http://www.plug.org.au/mailman/listinfo/plug">http://www.plug.org.au/mailman/listinfo/plug</A>
<BR>Committee e-mail: <A class=moz-txt-link-abbreviated
href="mailto:committee@plug.linux.org.au">committee@plug.linux.org.au</A>
<BR><BR></BLOCKQUOTE><BR><BR>
<DIV class=moz-signature>-- <BR>
<META http-equiv=Content-Language content=en-us>
<META content="Jonathan Young" name=Signature>
<META content="Copyright 1997 to 2004 PC-PHIX" name=Copyright><FONT face=Verdana
size=2>Jonathan Young<BR>Director of PC-PHIX<BR><A
class=moz-txt-link-abbreviated
href="mailto:jonathan@pcphix.com">jonathan@pcphix.com</A><BR><BR>Phone: 0410 455
674<BR>Web: <A class=moz-txt-link-freetext
href="http://www.pcphix.com/">http://www.pcphix.com/</A><BR><BR></FONT></DIV></BODY></HTML>