Slashdot Mirror

← Back to Stories (view on slashdot.org)

Coping With 1 Million SSH Authentication Failures?

Posted by kdawson on from the some-definitions-of-managed dept.

An anonymous reader writes "I own a small Web development studio that specializes in open source software, primarily Drupal, WordPress, and Joomla for small businesses. Our production servers, which host about 50 sites and generate ~20K hits/week, are managed by a 3rd party that I'm sure many on Slashdot would recognize. Earlier today I was researching some problems on one of our sites and found that there have been over 1 million SSH authentication failures from ~1200 IP addresses on one of our servers over the last year. I contacted the ISP, who had promised me that server security would be actively managed, and their recommendation was, 'change the SSH port!' Of course this makes sense and may help to an extent, but it still doesn't solve the problem I'm facing: how do you manage server security on a tight budget with literally no system admin (except for me and I know I'm a n00b)? User passwords are randomly generated, we use a non-standard SSH port, and do not use any unencrypted services such as FTP. Is there a server monitoring program you would recommend? Is there an ISP or Web-based service that specializes in this?"

3 of 497 comments (clear)

  1. So? by victim · · Score: 4, Interesting

    If you really have secure passwords, the random guessers aren't going to get them. Log it and move on.

    I get thousands of Chinese hackers attempting to break into the battery monitor in my tool shed, big deal. I don't know why my battery voltage and solar current is so important to them, but they can knock themselves out all day.

    If the logs bother you then install fail2ban and configure it to lock people out after a few bad guesses. (Then be ready to unlock yourself from an alternate IP when you inevitably lock yourself out.)

  2. Re:Tar Pitting by Anonymous Coward · · Score: 5, Interesting

    I use a variation on tarpitting that has worked very well for me.
    It cut the attempts down from 60,000/day to 20 or 30 per day.

    I just add a small delay between the initial connection attempt
    and when I send the username/password prompt. The delay (in
    seconds) is the number of attempts in the last 30 minutes,
    squared. This makes all but the most determined attacker
    give up and go away very quickly.

    I have been using this with both FTP and SSH for the last
    year, and it works great.

  3. Re:Tar Pitting by IQgryn · · Score: 4, Interesting

    How would one go about implementing this delay?