Re: kernel.org status: hints on how to check your machine for intrusion

Frank A. Kingswood
2011-10-01T22:12:34Z

On 01/10/11 19:06, Steven Rostedt wrote:
> On Sat, Oct 01, 2011 at 09:35:33AM +0200, Willy Tarreau wrote:
>>
> For my machine that is connected to the outside world, I have a script
> that runs every night that checks for attacks. As bots constantly look
> for port 22 and 80, they find my machine without issue. When my script
> detects a bunch of ssh login attempts that fail, it will add that ip
> address to the iptables DROP chain:
>
> # iptables -L -n | grep DROP | wc -l
> 2656
>
> I've picked up quite a few ;)
>
> This script only runs and scans once at night. Probably better to have
> it run more often.

Limiting SSH accesses to a few a minute (failed or not) is useful to
block many password guess attacks. I set up mine a long time ago
following this article using "recent" matches in iptables:

http://www.debian-administration.org/articles/187

You'll want to set the same rules for ipv6.

This won't stop low frequency and distributed attacks, and sometimes but
extremely rarely I find myself connecting more quickly than the rate limit.

Setting "PasswordAuthentication no" in your sshd_config is good too.

Regards,

Frank

--
------------------------------------------------------------------------
Frank A. Kingswood frank@kingswood-consulting.co.uk
Cambridge, United Kingdom +44-870-095 0000