undefined | Better HN

0 pointssmtddr11y ago0 comments

For me I just don't like seeing /var/log/auth.log being filled with 100s of lines of:

  Failed password for root2 from 82.192.86.44 port 44990 ssh2
  Failed password for admin from 82.192.86.44 port 44990 ssh2
  Failed password for sysdb from 82.192.86.44 port 44990 ssh2
  Failed password for scott from 82.192.86.44 port 44990 ssh2

(Yes, that IP has scanned my machine before)

0 comments

Piskvorrr11y ago

And that's exactly what denyhosts is for. You'll see this line a few initial times, then the banhammer springs into action.

(It's fully configurable - the number of failed attempts, the length of the autoban, etc.)

moe11y ago

Unfortunately one attempt is enough when there's a pre-auth vulnerability. Your ban-hammer doesn't help you there.

throwaway204811y ago

until one of the millions of other compromised IPs begins hammering your machine minutes later..

Moru11y ago

That's the whole point. The ban-hammer in this case is automatic and will ban that one too after five attempts or whatever.

2 more replies

pwg11y ago

There is also ssh-faker: http://www.pkts.ca/ssh-faker.shtml

Which would prevent even that first password failure attempt from occurring.

supergauntlet11y ago

Sending a password over telnet seems like a bad idea..

j / k navigate · click thread line to collapse