ssh script attacks
|
|
I’m noticing a fairly consistent level of sshd traffic caused by (I presume) attack scripts that are just working their way through a dictionary of usernames. For example: Mar 1 15:54:37 … sshd 31699: Invalid user gambit from 125.152.96.154 and so on. I’ve seen people write about using iptables rules to block these kinds of attacks, either as a result of too many password attempts (e.g. http://www.fail2ban.org/) or by rate limiting connection attempts (e.g. see bottom of http://www.aerospacesoftware.com/ssh-kiddies.html). Does anyone have a known-working solution on their Brightbox? I’m mostly concerned with removing the noise from my log files, reducing the load on the server and limiting the chances of one of these attacks being successful. I’m a bit wary of setting something up that might lock me out of the Brightbox completely! Cheers, -Mark. |