Raspberry Pi Defense-prevent SSH brute force

Source: Internet
Author: User

I used Raspberry Pi set up a small server, with a long time, recently checked log found a lot of SSH landing failed, instant heart broke, has not cared about the security of the small faction, blame me!

Action immediately, first of all, the study of the SSH login and other security information log:/var/log/auth.log, how to know that they have been attacked?

# grep Less 

Nov 11:26:44 raspberrypi2 sshd[4876]: Failed password for root from Port 1323 SSH2
Nov 01:14:49 raspberrypi2 sshd[8791]: Failed password for root from Port 2670 ssh2
Nov 14:31:23 raspberrypi2 sshd[9343]: Failed password for invalid user admin from Port 1782 Ssh2

Here is a record of attempts to log in via SSH, with IP and port descriptions in the description. In general, if you encounter brute force, you will try to use common user names such as Root,admin, and there will be many failure records.

Another failure record is typically a port scan. As follows:

# grep Less 

Nov 12:09:49 Raspberrypi2 sshd[14252]: Did not receive identification string from
Nov 12:28:37 Raspberrypi2 sshd[6351]: Did not receive identification string from

Statistics, the last one months there are more than 20,000, I was wrong, small pie: (

How to prevent this kind of idle egg ache of person? Generally speaking:

1. Configure Sshd_config, disable root login

2. Using a non-regular SSH service port

3. Use a non-regular login name

4. Use key to login as much as possible

The above four articles I have noticed, but can not prevent the brute force, the next only through some tools to achieve.

Googling, found two tools denyhosts and Fail2ban, the role of two tools is to monitor the log, found anomalies, shielded IP (iptables), but also to carry out the mail and other operations, are written by Python. DenyHosts is for the SSH service, Fail2ban can apply a variety of services such as HTTP,FTP, I chose Fail2ban although I only use SSH.

Installation is simple:

# sudo Install Fail2ban

Modify the configuration (can not be modified, default is to start SSH protection):

# ls /etc/fail2ban/action.d/  fail2ban.conf  filter.d/  jail.conf  jail.local
# jail.local is the jail.conf override profile
# vim/etc/fail2ban/jail.local

Enabled = True
Port = SSH
Filter = sshd
Action = Wechat[name=ssh]
LogPath =/var/log/auth.log
Bantime = 1200
Maxretry = 3

When an exception is found, when the IP is blocked fail2ban by default SendMail email reminders, this action is customizable, in the/etc/fail2ban/action.d/directory can be added configuration file implementation. I got myself a reminder service, when I found out that the exception was pushed to me, I can first let me know who bullied my small faction, hum ~

[via]  [via] [via]

Raspberry Pi Defense-prevent SSH brute force

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.