Defending against SSH brute force attacks

Posted by IgnitionWeb on Wednesday April 13, 2011 @09:31AM
from the ignitionweb.posterous.com dept.

http://ignitionweb.posterous.com/49335013

( 4 comments | 15 points | on HN )

Re:Defending against SSH brute force attacks by nuclear_eclipse on Wednesday April 13, 2011 @09:57AM (#2442186)

I think what the author fails to realize is that this isn't a targetted attack by a single group, but rather a mass of unfocused attempts to catch low-hanging fruit anywhere on the internet they can find it. Not to say that the hardening efforts aren't worth it, but that there's a difference between a bunch of automated attacks against "common" username and password combinations and a focused brute-force attack.

I just disable password-auth, install fail2ban, and call it a day.

[ Parent | on HN ]

Re:Defending against SSH brute force attacks by originalgeek on Wednesday April 13, 2011 @01:16PM (#2443204)

I have found the suite of "projects" from R-fx Networks to be fairly effective and easy to deploy:

http://www.rfxn.com/projects/

[ Parent | on HN ]

Re:Defending against SSH brute force attacks by IgnitionWeb on Wednesday April 13, 2011 @02:47PM (#2443587)

nice find

[ Parent | on HN ]

Re:Defending against SSH brute force attacks by nodata on Wednesday April 13, 2011 @09:57AM (#2442183)

How can this stuff get voted to the top every week?

100 different ways to write "Install a firewall and use fail2ban/denyhosts. Oh and make sure you sshd config is sane."

[ Parent | on HN ]