I used Raspberry Pi set up a small server, with a long time, recently checked log found a lot of SSH landing failed, instant heart broke, has not cared about the security of the small faction, blame me!
Action immediately, first of all, the study of the SSH login and other security information log:/var/log/auth.log, how to know that they have been attacked?
# grep Less
Nov 11:26:44 raspberrypi2 sshd: Failed password for root from 220.127.116.11 Port 1323 SSH2
Nov 01:14:49 raspberrypi2 sshd: Failed password for root from 18.104.22.168 Port 2670 ssh2
Nov 14:31:23 raspberrypi2 sshd: Failed password for invalid user admin from 22.214.171.124 Port 1782 Ssh2
Here is a record of attempts to log in via SSH, with IP and port descriptions in the description. In general, if you encounter brute force, you will try to use common user names such as Root,admin, and there will be many failure records.
Another failure record is typically a port scan. As follows:
# grep Less
Nov 12:09:49 Raspberrypi2 sshd: Did not receive identification string from 126.96.36.199
Nov 12:28:37 Raspberrypi2 sshd: Did not receive identification string from 188.8.131.52
Statistics, the last one months there are more than 20,000, I was wrong, small pie: (
How to prevent this kind of idle egg ache of person? Generally speaking:
1. Configure Sshd_config, disable root login
2. Using a non-regular SSH service port
3. Use a non-regular login name
4. Use key to login as much as possible
The above four articles I have noticed, but can not prevent the brute force, the next only through some tools to achieve.
Googling, found two tools denyhosts and Fail2ban, the role of two tools is to monitor the log, found anomalies, shielded IP (iptables), but also to carry out the mail and other operations, are written by Python. DenyHosts is for the SSH service, Fail2ban can apply a variety of services such as HTTP,FTP, I chose Fail2ban although I only use SSH.
Installation is simple:
# sudo Install Fail2ban
Modify the configuration (can not be modified, default is to start SSH protection):
# ls /etc/fail2ban/action.d/ fail2ban.conf filter.d/ jail.conf jail.local
# jail.local is the jail.conf override profile
Enabled = True
Port = SSH
Filter = sshd
Action = Wechat[name=ssh]
Bantime = 1200
Maxretry = 3
When an exception is found, when the IP is blocked fail2ban by default SendMail email reminders, this action is customizable, in the/etc/fail2ban/action.d/directory can be added configuration file implementation. I got myself a reminder service, when I found out that the exception was pushed to me, I can first let me know who bullied my small faction, hum ~
[via] [via] [via]
Raspberry Pi Defense-prevent SSH brute force