I have SUSE 10.0 and running sshd. When I look in messages I see...

Jun 15 11:36:09 linux01 sshd[9840]: Invalid user steve from 204.10.106.233
Jun 15 11:36:12 linux01 sshd[9842]: Invalid user steve from 204.10.106.233
Jun 15 11:36:14 linux01 sshd[9844]: Invalid user steve from 204.10.106.233
Jun 15 11:36:15 linux01 sshd[9846]: Invalid user shimada from 204.10.106.233
Jun 15 11:36:17 linux01 sshd[9848]: Invalid user shimada from 204.10.106.233
Jun 15 11:36:18 linux01 sshd[9850]: Invalid user shimada from 204.10.106.233

I'm up to date on my patches and use strick ID/PWs, but I cant seem to find the answer I'm looking for.

On SUSE 10, How do I set up my FW rules so a user from ip address X can only attempt x number of login attempts and then my system negelects to respond with logins for x mins?

Simple example would be: I fail to login on three attempts... my next login attempt wont be accepted till say 10mins later.

is your machine accessible through ssh from everywhere (0/0)? In my practice I have never done it. I just open very-very specific IPs in my FW for ssh access. That way, FW would reject any ssh attempts from unknown IPs. Yes you need static IPs for that and you might as well get it if you don't have it already. Also you might want to change your ssh port no to something less known than the default 22. Yes somebody could still find the port no being used and also fake the IP but the process is harder and will consume time. If you are the only one using the Ssh access make sure you change the port no occassionly. For eg. I acccess my work network from my home and I have a static IP at home and in my firewall, i have just opened up access for that IP. Your situation could ofcourse be different.

I use a dynamic dns servics and route via name... but yes local on my network it is static IP and yes I'm the only one ssh'ing.

I'd rather not restrict by IP as I some times connect from relatives PCs and they all have dynamic IPs as well as different ISPs.

I've seen how to do it in RH, but from what I can tell SUSE appears to be different type of cfg.

Have a look at this:

http://linsec.ca/syshardening/openssh.php

.

Yes i know, I too have faced those kind of problems. So in the end, it all boils down to security Vs. convinience issue.

maybe instead of using password, you can use ssh-keys or both.

I have clients running Linux servers on DSL/Cable connections that run no-ip.com for dynamic addresses. I never use port 22 on them and I use ssh-keys only to remote access them. Port 22 gets scanned constantly but other port numbers are usually ignored.

hello WRXSTi,

Why don't you have a look at this thread in the same forum

Hope, this will help you

Hi,

As an instant measure change your password to something long and complicated

You should also e-mail abuse@acceleratebiz.com, attaching the logs, so they can punish the person trying to break in to your computer.

the ssh-key seems to best for the purpose. I am going to try it. I get the feeling, it would be annoying carrying the key in a pendrive everywhere i go, nevertheless i will try.

See what I do to handle this in post #20 and post #22 in the thread below. These two posts went a bit off-topic on that thread, but they illustrate a program I use to ban IP addresses after three failed attempts. http://www.linuxquestions.org/questi...d.php?t=454306