SSH brute force attacks

SSH brute force attacks

Q. What is bute force attacks?
Most of the time "bute force attacks on the ssh" use an automated program to attempt one after one combinations of standard/common/frequently used account names and password to get access in a server. For example:- common user name like- admin, administrator, root, accounts, user, it etc. and password like- 123456, administrator, 123456789, admin, username123, abcdef, 987654321 etc.

Q. So, what can we do to prevent this attack?
Well there are many ways to do it. Lets discuss about them one by one-
1. Avoid using easily guessable names for accounts ( you can use deamon to force using strong password )
2. Disable SSH if it is not needed and block the 22 port from iptables
3. Allow only SSH protocol version 2
4. Run SSH on a non-default port
5. Disallow root logins via SSH
6. Allow only one ssh user (using "AllowUsers" option)
7. Block password authentication and use key-based authentication (RSA authentication)
8. if possible allow only the networks that you want to login and block other networks
9. use firewall to block the ip address who missed the password about four times
10. Automatically block the attacker ip address and mail the report to you (using the deamon like "Fail2ban / denyhosts")

Q. how can i configure these?
:-D Thats why I am writing this blog :-D. Just follow these footsteps-

. Install the ssh service:
mahidul@mahidul:~# apt-get install ssh

. Disable SSH if it is not needed and block the 22 port from iptables:
mahidul@testserver:~# /etc/init.d/ssh stop
mahidul@testserver:~# apt-get install rcconf
mahidul@testserver:~# rcconf ###Deselect ssh from here.

mahidul@testserver:~# vim /etc/init.d/iptables
#!/bin/sh
iptables -F
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 22 -j DROP

mahidul@testserver:~# chmod 755 /etc/init.d/iptables
mahidul@testserver:~# /etc/init.d/iptables

. Allow only SSH protocol version 2
mahidul@testserver:~# vim /etc/ssh/sshd_config
Protocol 2

. Run SSH on a non-default port
mahidul@testserver:~# vim /etc/ssh/sshd_config
Port 78 ###You can also use any non-used port here.

. Disallow root logins via SSH
mahidul@testserver:~# vim /etc/ssh/sshd_config
PermitRootLogin no

. Allow only one ssh user (using "AllowUsers" option)
mahidul@testserver:~# vim /etc/ssh/sshd_config
AllowUsers mahidul, user2 ###add this line to the configuration

. Block password authentication and use key-based authentication (RSA authentication)
Go to the pc from where you want to login:
user@pc:~$ apt-get install ssh
user@pc:~$ vim /etc/ssh/sshd_config
PasswordAuthentication no

user@pc:~$ ssh-keygen -t rsa
user@pc:~$ ssh mahidul@192.168.6.73 -p 78 mkdir -p .ssh
user@pc:~$ cat .ssh/id_rsa.pub | ssh mahidul@192.168.6.73 -p 78 'cat >> .ssh/authorized_keys'

Now test the ssh connection. You will not need ssh password.
user@pc:~$ ssh mahidul@192.168.6.73 -p 78

. if possible allow only the networks that you want to login and block other networks
mahidul@testserver:~# vim /etc/init.d/iptables
iptables -A INPUT -i eth0 -p tcp -s ***.***.***/** --dport 78 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 22 -j DROP

. Use firewall to block the ip address who missed the password about four times
mahidul@testserver:~# vim /etc/init.d/iptables
###1st way:
iptables -A INPUT -i eth1 -p tcp -m tcp --dport 78 -m state --state NEW -m recent --set --name DEFAULT --rsource
iptables -A INPUT -i eth1 -p tcp -m tcp --dport 78 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name DEFAULT --rsource -j DROP

###2nd way:
iptables -N SSH_WHITELIST
iptables -A SSH_WHITELIST -s TRUSTED_HOST_IP -m recent --remove --name SSH -j ACCEPT
iptables -A INPUT -p tcp --dport 78 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 78 -m state --state NEW -j SSH_WHITELIST
iptables -A INPUT -p tcp --dport 78 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
iptables -A INPUT -p tcp --dport 78 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP

. Automatically block the attacker ip address and mail the report to you (using the deamon like "Fail2ban / denyhosts")
(fail2ban doc collected from http://felipeferreira.net/?p=47. All rights received by them.)

Installing in Debian:
mahidul@testserver:~# apt-get install fail2ban -y

Installing in RedHat,CentOS,Fedora:
mahidul@testserver:~# wget http://downloads.sourceforge.net/project/fail2ban/fail2ban-stable/fail2ban-0.8.4/fail2ban-0.8.4.tar.bz2?use_mirror=ufpr
mahidul@testserver:~# tar -xjvf fail2ban-0.8.4.tar.bz2
mahidul@testserver:~# cd fail2ban-0.8.4
mahidul@testserver:~# python setup.py install

Autostart in RedHat,CentOS,Fedora
mahidul@testserver:~# cp files/redhat-initd /etc/init.d/fail2ban
mahidul@testserver:~# chkconfig –add fail2ban
mahidul@testserver:~# chkconfig fail2ban on
mahidul@testserver:~# service fail2ban start

mahidul@testserver:~# cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
mahidul@testserver:~# vim /etc/fail2ban/jail.local
     [DEFAULT]
     ignoreip = 127.0.0.1 172.31.0.0/24 10.10.0.0/24 192.168.0.0/24
    bantime = 86400
    maxretry = 5
destemail = mahidul@localhost
mta = postfix
     [ssh-iptables]
    enabled = true
    filter = sshd
    action = iptables[name=SSH, port=ssh, protocol=tcp]
    sendmail-whois[name=SSH, dest=you@mail.com, sender=fail2ban@mail.com]
    logpath = /var/log/auth.log
    maxretry = 5
     logpath=/var/log/secure (for RedHat,CentOS,Fedora)

Then restart the service:
mahidul@testserver:~# /etc/init.d/fail2ban restart
or RedHat
mahidul@testserver:~# service fail2ban restart

And check your iptables:
mahidul@testserver:~# iptables -L

If you want to unblock someone just do:
mahidul@testserver:~# iptables -D fail2ban-ssh 1

Show failed SSH logins by date:
mahidul@testserver:~# cat /var/log/secure | grep ‘Failed password’ |  sort | uniq -c

 Appendix, Install any email server you like. Here I used postfix:
mahidul@testserver:~# apt-get install postfix

Other Tips
. Stop the Service
mahidul@testserver:~# /etc/init.d/fail2ban stop

. Delete the socket if avalible
mahidul@testserver:~# rm /tmp/fail2ban.sock

. Start the Service
mahidul@testserver:~# /etc/init.d/fail2ban start

. Check if fail2ban is working:
mahidul@testserver:~# fail2ban-client ping
Answer should be “pong”

Here we go !!! All done. I think you are pretty secure from ssh bute force attacks from now on. :-D . Let me know your feedback.