Stopping SSH Brute Force attacks with PF on FreeBSD

Most people know that port 22 is used for SSH communication and due to this common knowledge, you get people using scripts to test for weak passwords. If you look into your /var/log/auth.log and you see tons of fails/errors from users not on your system or from invalid passwords for root, it means you have people trying to break into your system. Truthfully, anyone that puts a system online with port 22 open will see this happen to them. It’s quite common and not direct attack against you, just scripts looking for IPs with port 22 open.

(more...)

Stopping SSH & FTP brute force attacks with IPFW

Brute force attacks are becoming more and more common in todays security landscape; if you receive security cron logs from your FreeBSD server you will know exactly what I mean. These attacks usually use automated software to try thousands of username and password combinations on SSH and FTP, continually aiming to find a weak account on your system and exploit it.

If an attacker can get access to one system account, that is the first step to doing some very bad things on your system, a nightmare for users and administrators. Luckily, there is a way to stop these attacks, and they’re freely available in the ports collection.

IPTables on Linux has the ability to dynamically add rules to block brute force attacks, however IPFW, a widely used firewall and packet filter, does not have an ability. We are forced to turn to look for 3rd party apps, lucky for us there are some very good ones out there, and we will look at 2 here.

OpenSSH 5.1 released

OpenSSH 5.1 has just been released. It will be available from the mirrors listed at http://www.openssh.com/ shortly.

Tunnel Web and DNS Traffic Over SSH

I have been tunneling all of my web traffic over an encrypted SSH connection for some time now. Considering the fact that I travel a lot, I’m very regularly on untrusted, insecure networks. I prefer to secure those connections (web, IM, email, etc) by creating an encrypted SSH connection and pushing the traffic through it. Today I also found a method for also pushing DNS requests through the same tunnel. This ensures total privacy between yourself and the SSH Server.

(more...)

SSH Fingerprint Visualization Support

Alexander von Gernler (grunk@) has committed support for SSH fingerprint visualization. This is a technique to make it possible for users to remember SSH fingerprints more easily. Instead of just looking at the ssh fingerprint in clear text you can now get a graphical pattern where your key is represented by a worm inside a field, the worm will look slightly different depending on the fingerprint.

(more...)

Using SSH For Secure Web Browsing

With fraud on the rise everyone has a need for a secure Internet connection, weather this is to do some online banking or possibly checking a social networking site such as Facebook or MySpace. You can have peace of mind while browsing via a public computer or wireless Internet connection by using a SSH tunnel to encrypt your data.

(more...)

Screen? A must for SSH

If you’ve ever used SSH to connect to a server, you ‘ll know its limitations: if you want to open a new window, you’ll need to create a second SSH connection to the server. And if the connection breaks during the SSH tunnel, you’ve lost your progress. This is where Screen comes in.

Protect SSH from brute force attacks

pam_abl provides auto blacklisting of hosts and users responsible for repeated failed authentication attempts. Generally configured so that blacklisted users still see normal login prompts but are guaranteed to fail to authenticate.

(more...)

Some Tips To Make SSH/SCP Usage More Convenient

I guess many of us rely heavily on ssh/scp to access/maintain remote hosts. In this short article I would like to share some experiences I find useful for ssh/scp usage.

The Ultimate SSH Security Tutorial

SSH is one of the most secure communication methods we have. It’s encrypted, and even the passwords can’t be sniffed. But it’s not invincible. Weak passwords can be brute forced and open ports invite automated bots looking for that open port 22. But there’s a number of ways we can harden our ssh server.

Secure Backups

A fast Easy way to setup a Remote Backup system using OpenSSH, cron and rsync.

(more...)

How To Set Up SSH With Public-Key Authentication

This mini-howto explains how to set up an SSH server on Debian Etch with public-key authorization (and optionally with disabled password logins). SSH is a great tool to control Linux-based computers remotely. It's safe and secure.

OpenSSH Speed Tips and Tricks

Although using public key authentication instead of passwords is a great method for increasing the security of SSH transfers, transferring SSH identity keys can be a royal pain. First, you create your key pairs; then, you copy the public key into the correct locations on all the machines you want to log into. The keys must be in a particular format, and you must go into the correct directory with the correct permissions.

Fortunately, ssh-copy-id, a slick utility included with OpenSSH, makes it easy.

OpenSSH 5.0 released

OpenSSH 5.0 has just been released. It will be available from the mirrors listed at www.openssh.com shortly.

(more...)

Mount remote folders via SSH

This document describes how to install and use sshfs, a FUSE based filesystem that uses SSH to mount remote folders. Since it is based on FUSE (userspace filesystem framework for Linux) your kernel will need to have the fuse module available. FUSE is included in kernel newer than 2.6.14, so I will assume that you will have it already included in your kernel.

Chroot in OpenSSH

"Damien Miller (djm@), who worked on this new feature with Markus Friedl (markus@), offers more details about ChrootDirectory:

This commit adds a chroot(2) facility to sshd, controlled by a new sshd_config(5) option "ChrootDirectory". This can be used to "jail" users into a limited view of the filesystem, such as their home directory, rather than letting them see the full filesystem."

(more...)

SSH: Best Practices

Are you using SSH in the best way possible? Have you configured it to be as limited and secure as possible? The goal of this document is to kick in the new year with some best practices for SSH: why you should use them, how to set them up, and how to verify that they are in place.

All of the examples below assume that you are using EnGarde Secure Linux but any modern Linux distribution will do just fine since, as far as I know, everybody ships OpenSSH.

HAPPY BIRTHDAY OPENSSH!

Eight years ago today, Sept 26 1999, Theo de Raadt committed the initial source code for OpenSSH to the OpenBSD repository. The code was a fork of Björn Grönvall's OSSH, which was derived from an early version of the increasingly "less free" ssh from Tatu Ylönen. With only two months until the 2.6 release, the team moved quickly to remove code covered by restrictive licenses, push patent encumbered features to external libraries, and add important features such as 1.5 protocol support.

(more...)

OpenSSH 4.7 released

OpenSSH 4.7 has just been released. It will be available from the mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0 implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots and purchased T-shirts or posters.

(more...)

Distributed administration using SSH

Use Secure Shell (SSH) to run commands on remote UNIX® systems and, with some simple scripts, put together a system that enables you to manage many systems simultaneously from one machine without having to log in directly to the machines themselves. Also examine the basics of a distributed management system and some scripts and solutions using the technique.

(more...)