[CentOS] Ideas for stopping ssh brute force attacks

[Les Bell]

"David Dyer-Bennet" <dd-b at dd-b.net> wrote:

>>
Yes, but if there are *any* ports exposed, seems like those are equally
possible.
<<

Sort of. Changing the port used by sshd stops the completely clueless
script kiddies, since they don't even bother looking at anything other than
port 22. Putting it way up high, among the ephemeral ports, will slow down
the slightly more clueful who perform nmap scans, since nmap only scans
around 1500 ports by default, and if sshd isn't running on one of those,
they won't spot it.

However, it won't deter the intelligent or curious attacker; these guys
will scan all ports (slowly, so you may not even notice them) and they will
use banner enumeration to identify the services, rather than assuming.

Moving sshd to a non-standard port is one of the worst examples of relying
on security by obscurity. Its only advantage is that it cuts out some noise
in the logs, but proper precautions do that as well, without lulling you
into a false sense of security. Rate limiting, combined with enforcement of
really strong passwords, or even better, public/private key authentication,
is real security.

A useful additional layer of defence, if you want it, is a daemon that will
watch for port scans on the simple services ports and immediately insert a
firewall rule to block that source - such as the old PortSentry, if you can
find it, or some more modern equivalent. Of course, this won't do much to
defend against some types of stealthy scans, such as idle time scans.

Best,

--- Les Bell, RHCE, CISSP
[http://www.lesbell.com.au]
Tel: +61 2 9451 1144
FreeWorldDialup: 800909