Protect SSH server - 3 attempts at one day

Question

3 day of action Ubuntu Server 14:)

grep sshd.*Did /var/log/auth.log | tail -50

Feb 14 09:41:35 mantykora sshd[3797]: Did not receive identification string from 88.249.106.23
Feb 14 10:17:18 mantykora sshd[4027]: Did not receive identification string from 94.102.48.193
Feb 15 01:41:04 mantykora sshd[17267]: Did not receive identification string from 79.71.81.207
Feb 15 02:31:55 mantykora sshd[17321]: Did not receive identification string from 113.108.21.16
Feb 15 09:07:58 mantykora sshd[19183]: Did not receive identification string from 58.49.91.194
Feb 15 15:54:03 mantykora sshd[3128]: Did not receive identification string from 62.210.24.250
Feb 15 19:12:11 mantykora sshd[3723]: Did not receive identification string from 117.253.221.81
Feb 16 10:08:41 mantykora sshd[4953]: Did not receive identification string from 122.241.63.225
Feb 17 02:01:40 mantykora sshd[5839]: Did not receive identification string from 198.251.79.208

I'm trying to protect using sudo ufw limit OpenSSH 3 attempts at one day, but I do not know how to do it. How to do it?

you can allow a single ip. if you're connecting from your office to a server./etc/hosts.allow — Rajesh Rajendran, Feb 18 '16 at 09:37
and how to do it with the ufw? sudo ufw allow from 15.15.15.0/24 to any port 22 this is correct? — Mantykora 7, Feb 18 '16 at 09:43
and what wit ufw limit OpenSSH ? Can I limit the number of connections ? — Mantykora 7, Feb 18 '16 at 10:05
I don't know what you're trying to accomplish man . if you want to protect your server, first you've to change the ssh port, then deny all the connections except from the ips you believe — Rajesh Rajendran, Feb 18 '16 at 11:25
something like Vyatta rule 12 limit rate 2/second I do not know if this is possible in ubuntu — Mantykora 7, Feb 18 '16 at 11:30
You can use fail2ban : see How to harden an ssh server . IIRC maxretry is set to 3 by default, so you probably don't even need to configure it. — steeldriver, Feb 18 '16 at 13:23

realsub · Accepted Answer · 2016-02-18T13:55:11.237

1

Changing the SSH listening port will prevent these robot attacks.

Quick edit: This isn't exactly a long-term fix, but it'll stop those Chinese robots trying simple username & password combinations on most new SSH connections running on port 22.

edited Feb 18 '16 at 13:55

answered Feb 18 '16 at 09:33

realsub

88

I changed - 9603 – Mantykora 7 Feb 18 '16 at 10:09
This seems like security-by-obscurity at best – steeldriver Feb 18 '16 at 13:25
1
I changed port 9603
sudo ufw limit 9603

Mantykora 7

Feb 18 '16 at 13:49

Protect SSH server - 3 attempts at one day

1 Answers1