Hi LQ Dears

I am using RHEL 5.4 Linux box,

Still i am facing lot of failed login attempts from SSH.
Is there any way to lock or restrict the user after failed
login attempts ?

please guide me guyz !

Regards
Bala.LinuxTech

I would suggest you edit the servers /etc/ssh/sshd_config

Dear jv2112

Thanks ., Could you please explain what does it mean, LoginGraceTime 2m , #StrictModes yes , MaxAuthTries 6 ,MaxSessions 10

Thanks in advance

Regards
Bala.Linuxtech

You could look at fail2ban to automate analyzing logs to update iptables rules or hosts.deny to reject connections. You could instead run a user mod command to suspend an account. You could monitor other types of logs such as Apache as well.
http://www.linux-magazine.com/Online...-with-fail2ban

For SSH, you should be using keys instead of user name/password authentication. Then any challenge/response attempt will be rejected.

Use AllowUsers to limit who can log in. Many attempts against SSH will be system users. Others will be against root. Suspending the root account will lock you out of your own server. Better to not allow root logins.

Dear jschiwal

Thanks ., Fail2ban is very interesting but i dont have a access to install third party tools / softwares in servers, could you guide me another way for this same !!!

Thanks in advance

Regards
Bala.Linuxtech

There is an official fail2ban rhel package, so you won't be installing a 3rd party tool. Use the package from your RH repository. The regular expressions used will match your log files. And you won't need to mess with selinux restrictions. The package should handle that for you during installation. Be sure to research fail2ban on the Red Hat site. Using it to protect SSH is the most common usage, so I'm sure it will be well covered.

There is a Pam module (pam_tally) that can suspend accounts after a number of failed login attempts.

http://www.cyberciti.biz/tips/rhel-c...led-login.html

The sshd_config maxauthtries option will log failed attempts on the same connection that exceed half that number and break the connection when it reaches the max.

A lot of information is at your fingertips with the whois, whatis, which, apropos, info and man commands. In this case you know it's related to ssh, so if you run 'apropos ssh' you'll get a list of manual pages. Select one, scroll to the bottom and notice the "See also" section. Eventually you'll find 'man sshd_config' explaining these configuration settings. If, after reading, you have more specific questions then ask.

for daemon settings.
Personally, I'd use ssh keys only.