ssh script attacks

Subscribe to ssh script attacks 1 post(s), 1 voice(s)

 
Avatar Mark Wilkinson 6 post(s)

I’m noticing a fairly consistent level of sshd traffic caused by (I presume) attack scripts that are just working their way through a dictionary of usernames. For example:

Mar 1 15:54:37 … sshd 31699: Invalid user gambit from 125.152.96.154
Mar 1 15:54:40 … sshd 31703: Invalid user gambit from 125.152.96.154
Mar 1 15:54:42 … sshd 31707: Invalid user andrei from 125.152.96.154
Mar 1 15:54:44 … sshd 31711: Invalid user andrei from 125.152.96.154
Mar 1 15:54:47 … sshd 31715: Invalid user andrei from 125.152.96.154

and so on. I’ve seen people write about using iptables rules to block these kinds of attacks, either as a result of too many password attempts (e.g. http://www.fail2ban.org/) or by rate limiting connection attempts (e.g. see bottom of http://www.aerospacesoftware.com/ssh-kiddies.html). Does anyone have a known-working solution on their Brightbox? I’m mostly concerned with removing the noise from my log files, reducing the load on the server and limiting the chances of one of these attacks being successful. I’m a bit wary of setting something up that might lock me out of the Brightbox completely!

Cheers,

-Mark.

Signup or login to contribute