1

Today I have noticed that my /var/log/secure file gets bigger and bigger. That was strange and when I checked the tail, I get such things:

Sep  6 18:37:58 asdf sshd[17615]: Failed password for root from 200.85.122.11 port 36126 ssh2
Sep  6 18:37:58 asdf sshd[17616]: Received disconnect from 200.85.122.11: 11: Bye Bye
Sep  6 18:38:00 asdf sshd[17618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.122.11  user=root

Sep  6 18:38:02 asdf sshd[17618]: Failed password for root from 200.85.122.11 port 36445 ssh2
Sep  6 18:38:02 asdf sshd[17619]: Received disconnect from 200.85.122.11: 11: Bye Bye
Sep  6 18:38:04 asdf sshd[17623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.122.11  user=root

Sep  6 18:38:06 asdf sshd[17623]: Failed password for root from 200.85.122.11 port 36776 ssh2
Sep  6 18:38:06 asdf sshd[17624]: Received disconnect from 200.85.122.11: 11: Bye Bye
Sep  6 18:38:08 asdf sshd[17626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.122.11  user=root

Sep  6 18:38:10 asdf sshd[17626]: Failed password for root from 200.85.122.11 port 37072 ssh2
Sep  6 18:38:11 asdf sshd[17627]: Received disconnect from 200.85.122.11: 11: Bye Bye
Sep  6 18:38:13 asdf sshd[17689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.122.11  user=root

Sep  6 18:38:15 asdf sshd[17689]: Failed password for root from 200.85.122.11 port 37390 ssh2
Sep  6 18:38:15 asdf sshd[17690]: Received disconnect from 200.85.122.11: 11: Bye Bye
Sep  6 18:38:17 asdf sshd[17700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.122.11  user=root

This looks as if someone is trying to find a password to my server.

How can I block IP after some number of unsuccessful attempts to login (for example, if 10 attempts to login failed during last hour, however, now my VPS receives at least 100 failing requests to login per minute). Actually, password is too long and complicated for brute force, but I'm not sure whether such brute force attempts can cause server load.

0

3 Answers 3

1

You can set a rate limit using iptables. Take a look at this link: http://www.debian-administration.org/articles/187

1

Look at my post. Fail2Ban was the solution for me. https://unix.stackexchange.com/questions/204383/fail2ban-is-not-blocking-ips-trying-to-access-my-server-via-ssh/204393#204393

As someone pointed out and I think is a good practice to have this directive PermitRootLogin no in sshd_config just in case.

0

You can use DenyHosts: works quite well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.