Raspberry Pi Defense-prevent SSH brute force

I used Raspberry Pi set up a small server, with a long time, recently checked log found a lot of SSH landing failed, instant heart broke, has not cared about the security of the small faction, blame me!

Action immediately, first of all, the study of the SSH login and other security information log:/var/log/auth.log, how to know that they have been attacked?

# grep Less 

Nov 11:26:44 raspberrypi2 sshd[4876]: Failed password for root from 61.160.222.53 Port 1323 SSH2
...
Nov 01:14:49 raspberrypi2 sshd[8791]: Failed password for root from 222.186.15.160 Port 2670 ssh2
...
Nov 14:31:23 raspberrypi2 sshd[9343]: Failed password for invalid user admin from 61.160.222.53 Port 1782 Ssh2
...

Here is a record of attempts to log in via SSH, with IP and port descriptions in the description. In general, if you encounter brute force, you will try to use common user names such as Root,admin, and there will be many failure records.

Another failure record is typically a port scan. As follows:

# grep Less 

Nov 12:09:49 Raspberrypi2 sshd[14252]: Did not receive identification string from 198.20.69.98
Nov 12:28:37 Raspberrypi2 sshd[6351]: Did not receive identification string from 61.160.222.53

Statistics, the last one months there are more than 20,000, I was wrong, small pie: (

How to prevent this kind of idle egg ache of person? Generally speaking:

1. Configure Sshd_config, disable root login

2. Using a non-regular SSH service port

3. Use a non-regular login name

4. Use key to login as much as possible

The above four articles I have noticed, but can not prevent the brute force, the next only through some tools to achieve.

Googling, found two tools denyhosts and Fail2ban, the role of two tools is to monitor the log, found anomalies, shielded IP (iptables), but also to carry out the mail and other operations, are written by Python. DenyHosts is for the SSH service, Fail2ban can apply a variety of services such as HTTP,FTP, I chose Fail2ban although I only use SSH.

Installation is simple:

# sudo Install Fail2ban

Modify the configuration (can not be modified, default is to start SSH protection):

# ls /etc/fail2ban/action.d/  fail2ban.conf  filter.d/  jail.conf  jail.local
# jail.local is the jail.conf override profile
# vim/etc/fail2ban/jail.local
[SSH]

Enabled = True
Port = SSH
Filter = sshd
Action = Wechat[name=ssh]
LogPath =/var/log/auth.log
Bantime = 1200
Maxretry = 3

When an exception is found, when the IP is blocked fail2ban by default SendMail email reminders, this action is customizable, in the/etc/fail2ban/action.d/directory can be added configuration file implementation. I got myself a reminder service, when I found out that the exception was pushed to me, I can first let me know who bullied my small faction, hum ~

[via]  [via] [via]

Raspberry Pi Defense-prevent SSH brute force