<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body style="font-size:17px;font-family:.SFUIText;color:#000000;background-color:white;">I always change the port for ssh to something waaay above 1024<br><br><div style="background:white;" id="newMessage">
<!-- MESSAGE END --></div><br><br><br><blockquote type="cite"><div style="font-family:Helvetica; font-size:16px; color:#000;"><b>From: </b>Lonni J Friedman via Linux-users <<a href="mailto:linux-users@linux-sxs.org">linux-users@linux-sxs.org</a>><br>
<b>Subject: </b><b>brute force ssh attacks</b><br>
<b>Date: </b>2/7/19 10:49 AM<br>
<b>To: </b>Linux tips and tricks <<a href="mailto:linux-users@linux-sxs.org">linux-users@linux-sxs.org</a>><br>
<b>CC: </b>Lonni J Friedman <<a href="mailto:netllama@gmail.com">netllama@gmail.com</a>><br>
<br><br><p>For the past few days some bot net has decided to attempt to attack
<br>sshd on one of my systems with some kind of brute force attach. Its
<br>coming from literally a broad swadth of the internet with connection
<br>attempts like this in the past 24 hours:
<br>
<br> 1.9.46.177: 6 times
<br> 1.22.91.179: 5 times
<br> 1.23.144.150: 3 times
<br> 1.34.164.204 (1-34-164-204.HINET-IP.hinet.net): 2 times
<br> 1.34.177.7 (1-34-177-7.HINET-IP.hinet.net): 1 time
<br> 1.119.131.102: 5 times
<br> 1.179.146.156: 2 times
<br> 1.179.185.50: 2 times
<br> 1.180.16.156: 3 times
<br> 1.180.17.229: 2 times
<br> 1.180.17.239: 3 times
<br> 1.180.17.245: 2 times
<br> 1.180.17.253: 3 times
<br> 1.192.126.125: 1 time
<br> 1.194.238.224: 3 times
<br> 1.202.165.40 (40.165.202.1.static.bjtelecom.net): 3 times
<br> 1.236.151.31: 1 time
<br> 2.6.219.46 (apoitiers-654-1-28-46.w2-6.abo.wanadoo.fr): 1 time
<br> 2.31.102.13: 1 time
<br> 2.238.129.59 (2-238-129-59.ip244.fastwebnet.it): 1 time
<br> 3.8.16.138 (ec2-3-8-16-138.eu-west-2.compute.amazonaws.com): 5 times
<br> 3.8.84.231 (ec2-3-8-84-231.eu-west-2.compute.amazonaws.com): 2 times
<br> 3.17.39.75 (ec2-3-17-39-75.us-east-2.compute.amazonaws.com): 4 times
<br> 3.104.123.118
<br>(ec2-3-104-123-118.ap-southeast-2.compute.amazonaws.com): 5 times
<br> 3.122.149.254
<br>(ec2-3-122-149-254.eu-central-1.compute.amazonaws.com): 4 times
<br> 5.2.152.160 (static-5-2-152-160.rdsnet.ro): 3 times
<br> 5.9.7.117 (static.117.7.9.5.clients.your-server.de): 3 times
<br>
<br>
<br>Except, that its a few thousand attempts every day. I'm already not
<br>permitting password based auth for sshd, so the entire exercise is
<br>futile, but its definitely consuming resources on my side. I'm aware
<br>of tools like fail2ban, but I'm not sure that's going to be much value
<br>when the attacks are a few attempts from a very large number of unique
<br>sources.
<br>
<br>Are there any other good solutions for preventing this sort of thing
<br>beyond blocking sshd from everywhere except white listed IP addresses?
<br>
<br>thanks
<br>_______________________________________________
<br>Linux-users mailing list
<br><a href="mailto:Linux-users@linux-sxs.org">Linux-users@linux-sxs.org</a>
<br><a href="http://mailman.celestial.com/mailman/listinfo/linux-users">http://mailman.celestial.com/mailman/listinfo/linux-users</a>
<br>
</p></div></blockquote>
</body>