ssh bruteforce
Hi all
how i can automatic denyy ip when some one do ssh bruteforce .... |
Welcome to LQ!
There is a sticky post in the LQ Security forum that talks about this issue. There is a link in the last post of that thread that is extremely comprehensive. http://www.linuxquestions.org/questi...ml#post2027930 Look at Fail2Ban as it should serve your needs. |
but i have script deny ssh bruteforce check it out
#!/bin/bash #This script will monitor for failed login attempts and after a specified number of times add the ip to a deny list #Chad LOGFILE=”/var/log/secure” HOSTSDENY=”/etc/hosts.deny” BADCOUNT=”5" # read logfile and look for invalid login attemps grep sshd $LOGFILE |grep “Invalid user”| awk ‘{print $NF}’|sort|uniq -c|sort -n|sed “s/[[:space:]]*//” | while read i do # read number of failed attempts count=`echo $i | cut -d” ” -f1` # read ip address from failed attempt ip=`echo $i | cut -d” ” -f2` #check hostdeny file to see if IP already exist already=`grep $ip $HOSTSDENY | grep sshd` #if IP does not exist add it to hostdeny file if [ -z "$already" ] then if [ "$count" -ge "$BADCOUNT" ] then echo “sshd: “$ip >> $HOSTSDENY fi fi done so how about this script ..... |
Quote:
But on Red Hat systems (RHEL/CentOS/Fedora) you can edit the /etc/hosts.allow and the /etc/hosts.deny files -C |
my distro fedora 12, can you try thiss script work or not in system because i do with this script not work in fedora 12.....
can you help me ..... |
Fedora 12 is an old distro. I would recommend upgrading to Fedora 17
Once you have that you can follow this example: Let's say you want to deny the 192.168.2.54 address but allow all others /etc/hosts.deny Code:
sshd: 192.168.2.54 Code:
sshd: ALL |
but i want to aoutomatic deny ip when someone attack my server with ssh bruteforce ....
|
Without writing the script for you
Something like Code:
if ! grep ${ipaddr} /etc/hosts.deny ; then -C |
Quote:
|
Quote:
can you explain step by step how to configuration fail2ban, because i not understand how to use fail2ban .... sory my english bad, i from indonesia help me please ! |
Yeah, I have set fail2ban up on a few servers, it is very easy to install/administer.
I haven't used fedora much, so if im wrong with anything just let me know. Code:
yum install fail2ban You can change the maxretry (the amount of times someone can try to login) and the bantime (how long the IP will be banned for). There are lots of other settings in there too that you can tweak to fit what you want to do. This may be helpful for you: http://www.howtoforge.com/preventing...ban-on-fedora9 |
Quote:
|
No problem. Good Luck :)
|
All times are GMT -5. The time now is 06:46 PM. |