LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   How to lock the users after ssh failed login attempts ? (https://www.linuxquestions.org/questions/linux-security-4/how-to-lock-the-users-after-ssh-failed-login-attempts-4175440408/)

bala.linuxtech 12-07-2012 04:26 AM
How to lock the users after ssh failed login attempts ?
 
Hi LQ Dears

I am using RHEL 5.4 Linux box,

Still i am facing lot of failed login attempts from SSH.
Is there any way to lock or restrict the user after failed
login attempts ?

please guide me guyz !

Regards
Bala.LinuxTech

jv2112 12-07-2012 04:35 AM
I would suggest you edit the servers /etc/ssh/sshd_config



Code:
# Authentication:

#LoginGraceTime 2m
#PermitRootLogin yes
#StrictModes yes
MaxAuthTries 6
MaxSessions 10

bala.linuxtech 12-07-2012 04:39 AM
Quote:
Originally Posted by jv2112 (Post 4844405)
I would suggest you edit the servers /etc/ssh/sshd_config



Code:
# Authentication:

#LoginGraceTime 2m
#PermitRootLogin yes
#StrictModes yes
MaxAuthTries 6
MaxSessions 10

Dear jv2112

Thanks ., Could you please explain what does it mean, LoginGraceTime 2m , #StrictModes yes , MaxAuthTries 6 ,MaxSessions 10

Thanks in advance

Regards
Bala.Linuxtech

jschiwal 12-07-2012 04:51 AM
You could look at fail2ban to automate analyzing logs to update iptables rules or hosts.deny to reject connections. You could instead run a user mod command to suspend an account. You could monitor other types of logs such as Apache as well.
http://www.linux-magazine.com/Online...-with-fail2ban

For SSH, you should be using keys instead of user name/password authentication. Then any challenge/response attempt will be rejected.

Use AllowUsers to limit who can log in. Many attempts against SSH will be system users. Others will be against root. Suspending the root account will lock you out of your own server. Better to not allow root logins.

bala.linuxtech 12-07-2012 05:05 AM
Quote:
Originally Posted by jschiwal (Post 4844414)
You could look at fail2ban to automate analyzing logs to update iptables rules or hosts.deny to reject connections. You could instead run a user mod command to suspend an account. You could monitor other types of logs such as Apache as well.
http://www.linux-magazine.com/Online...-with-fail2ban

For SSH, you should be using keys instead of user name/password authentication. Then any challenge/response attempt will be rejected.

Use AllowUsers to limit who can log in. Many attempts against SSH will be system users. Others will be against root. Suspending the root account will lock you out of your own server. Better to not allow root logins.
Dear jschiwal

Thanks ., Fail2ban is very interesting but i dont have a access to install third party tools / softwares in servers, could you guide me another way for this same !!!

Thanks in advance

Regards
Bala.Linuxtech

jschiwal 12-07-2012 05:52 AM
There is an official fail2ban rhel package, so you won't be installing a 3rd party tool. Use the package from your RH repository. The regular expressions used will match your log files. And you won't need to mess with selinux restrictions. The package should handle that for you during installation. Be sure to research fail2ban on the Red Hat site. Using it to protect SSH is the most common usage, so I'm sure it will be well covered.

There is a Pam module (pam_tally) that can suspend accounts after a number of failed login attempts.

http://www.cyberciti.biz/tips/rhel-c...led-login.html

The sshd_config maxauthtries option will log failed attempts on the same connection that exceed half that number and break the connection when it reaches the max.

unSpawn 12-07-2012 06:40 AM
Quote:
Originally Posted by bala.linuxtech (Post 4844406)
please explain what does it mean, LoginGraceTime 2m , #StrictModes yes , MaxAuthTries 6 ,MaxSessions 10
A lot of information is at your fingertips with the whois, whatis, which, apropos, info and man commands. In this case you know it's related to ssh, so if you run 'apropos ssh' you'll get a list of manual pages. Select one, scroll to the bottom and notice the "See also" section. Eventually you'll find 'man sshd_config' explaining these configuration settings. If, after reading, you have more specific questions then ask.

Habitual 12-07-2012 08:31 AM
Quote:
Is there any way to lock or restrict the user after failed
login attempts ?

please guide me guyz !
Code:
man sshd_config
for daemon settings.
Personally, I'd use ssh keys only.


All times are GMT -5. The time now is 03:04 PM.