[CentOS] Ideas for stopping ssh brute force attacks
ned at unixmail.co.uk
Tue Jul 22 23:20:23 UTC 2008
Les Bell wrote:
> "David Dyer-Bennet" <dd-b at dd-b.net> wrote:
> Yes, but if there are *any* ports exposed, seems like those are equally
> Sort of. Changing the port used by sshd stops the completely clueless
> script kiddies, since they don't even bother looking at anything other than
> port 22. Putting it way up high, among the ephemeral ports, will slow down
> the slightly more clueful who perform nmap scans, since nmap only scans
> around 1500 ports by default, and if sshd isn't running on one of those,
> they won't spot it.
Indeed. A relatively small botnet (~500 bots) can scan the complete IPv4
address space for a single port (port 22) in 24 hours so in theory any
hacker with meagre resources could map every standard SSH installation
on the internet in a single day. If you run SSH on port 22 it *will* get
discovered and probed.
> However, it won't deter the intelligent or curious attacker; these guys
> will scan all ports (slowly, so you may not even notice them) and they will
> use banner enumeration to identify the services, rather than assuming.
Yes, moving SSH to a non-standard port will likely prevent the casual
hacker looking for vulnerable installations but it won't protect against
targeted attacks towards specific servers where a full scan is more
likely to be performed.
> Moving sshd to a non-standard port is one of the worst examples of relying
> on security by obscurity. Its only advantage is that it cuts out some noise
> in the logs, but proper precautions do that as well, without lulling you
> into a false sense of security. Rate limiting, combined with enforcement of
> really strong passwords, or even better, public/private key authentication,
> is real security.
I don't think anyone is suggesting running SSH on a non-standard port as
a sole means of defence, but rather as part of a layered approach where
it is very effective in what it is designed to do - namely to vastly
reduce the number of random brute-forcing attempts and concomitant noise
in log files not to mention reducing the overall load on other
mechanisms of defence such as firewall scripts etc.
Moreover, rate limiting is not as effective as it used to be as there is
now evidence that attackers are using distributed methods of attack
utilizing multiple random IP addresses that circumnavigate defences that
rely on attacks originating from a single IP address. Studies suggest
attackers will try a handful of common account names/passwords and then
move on as that's what yields the highest returns for them.
We should also remember that public/private key authentication is only
secure as the host the private key is stored on when keys without
passphrases are employed (all too common where users don't want to trade
using a password for a passphrase). If a user account gets hacked then
the keys to the kingdom are there for the taking and the hacker has
instant access to any SSH servers which employ public/private key
authentication (without passphrases).
> A useful additional layer of defence, if you want it, is a daemon that will
> watch for port scans on the simple services ports and immediately insert a
> firewall rule to block that source - such as the old PortSentry, if you can
> find it, or some more modern equivalent. Of course, this won't do much to
> defend against some types of stealthy scans, such as idle time scans.
> --- Les Bell, RHCE, CISSP
> Tel: +61 2 9451 1144
> FreeWorldDialup: 800909
More information about the CentOS