If you have computer on a public-facing IP address, and it runs an SSH server on port 22, chances are pretty good you’ll be subjected to a number of dictionary attacks. Compromised hosts will try to login with a list of common user names and passwords.<\/p>\n
Now, this isn’t a problem for most of us, right? We have secure passwords after all, and these attacks are just trying dictionary lists of words – username root, password of ‘password’ or ‘root’, for example. However, they are still annoying – if only because they fill up the logfiles. Also, it’d be better to just not have the connections, just in case they manage to get through. I set it up a week or so ago and get an email every couple of hours with a new IP address that has been blacklisted. I also managed to blacklist one of my own IP addresses while testing, which proved hard to remove – denyhosts kept adding the block back in. Fortunately I set it to purge entries after 3 days, so I can now ssh in again :)<\/p>\n","protected":false},"excerpt":{"rendered":" If you have computer on a public-facing IP address, and it runs an SSH server on port 22, chances are pretty good you’ll be subjected to a number of dictionary attacks. Compromised hosts will try to login with a list of common user names and passwords. Now, this isn’t a problem for most of us, […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[2,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.meta.net.nz\/~daniel\/blog\/wp-json\/wp\/v2\/posts\/6"}],"collection":[{"href":"https:\/\/www.meta.net.nz\/~daniel\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.meta.net.nz\/~daniel\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.meta.net.nz\/~daniel\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.meta.net.nz\/~daniel\/blog\/wp-json\/wp\/v2\/comments?post=6"}],"version-history":[{"count":0,"href":"https:\/\/www.meta.net.nz\/~daniel\/blog\/wp-json\/wp\/v2\/posts\/6\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.meta.net.nz\/~daniel\/blog\/wp-json\/wp\/v2\/media?parent=6"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.meta.net.nz\/~daniel\/blog\/wp-json\/wp\/v2\/categories?post=6"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.meta.net.nz\/~daniel\/blog\/wp-json\/wp\/v2\/tags?post=6"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nI recently came across a tool called denyhosts<\/a>. Denyhosts monitors your ssh log file and modifies \/etc\/hosts.deny to disallow SSH (or all access to tcpwrapped services) from hosts that have a significant number of failed login attempts. It also has a synchronised mode in which hosts running denyhosts on the internet share their list of denied IP addresses.<\/p>\n