Engie's weblog

I am too lazy to install fail2ban to protect my ssh daemon against bad boys. In, addition, I have been raised to minimize reliability on applications when a one-liner or a few-lines script would do all or part of the work. Yesterday, I decided to turn on my home's sshd and make it accessible from outside, so that whenever I need something while at work I would ask some one just to turn on my laptop. I did, and the bad Chinese boys were too quick that they started attacking my poor daemon. They were trying users like: root, oracle, backup, postgres, www, test, kylix, info. So far, there is only one attacking IP which is: 58.68.150.174 So, I hopped for: 1- denying remote root login (Yes, I am a lazy sysadmin! Should have done this earlier) and 2- updating my counter-ssh-attacks script as follows (P.S. I have removed explanatory comments):  #! /bin/bash RETVAL=0 secure='/var/log/secure' file='/tmp/counter-ssh' deny='/etc/hosts.deny' #grep "Did ...

On some servers you are obliged not to run a firewall nor use VPN. As a result your sshd will be the direct attack target for many amateurs and professionals alike. To protect against ssh attacks, I run the following script in crontab: #! /bin/bash # # A script to automatically counter ssh attacks # # # vars RETVAL=0 secure='/var/log/secure' file='/tmp/counter-ssh' deny='/etc/hosts.deny' # # logic # # get unique attacking IPs grep "Did not" $secure | awk '{print $12}' | uniq -u > $file # # if IP is in /etc/hosts.deny do nothing, if IP is NOT in /etc/hosts.deny, add it there! for ip in $(cat $file); do grep --silent $ip $deny; if [ $? -ne 0 ]; then echo "sshd:$ip" >> $deny; fi; done # # exit as learnt RETVAL=$? echo "we have exited $RETVAL"; exit $RETVAL Sometimes you may encounter a line in /etc/hosts.deny like: sshd:UNKNOWN It may be blocking you! Be aware, I have warned you beforehand...