topic Re: Protecting ssh server connections in Operating System - HP-UX

Protecting ssh server connections

ballans — Thu, 23 Nov 2006 05:17:49 GMT

Hi everybody,
My server is an HP-UX B.11.23 (trusted system).
This system is a pop server with ssh activated in order to login to the server from the outside (OpenSSH_4.1).
The problem is that we are victim of ssh attacks (dictionnary attack) and the consequence is that the root account is locked. All days, I have to reactivate my root account. In addition, it causes problem for maintennace operation...
In the sshd_config file I add the following line :
PermitRootLogin no
but it seems to not blocking the attempt...
So, I would like to block IP address which try to log on my ssh server with too many unsuccesfull attempt...
Could you please advice me for the best solution ? Maybe I found a way with the use of keep state in ipfilter. Is it a good solution in my case ?

Thanks in advance for your replies.
Herve

Re: Protecting ssh server connections

Steven E. Protter — Thu, 23 Nov 2006 05:57:05 GMT

Shalom,

Options:
1) Install HP ipfilter from http://software.hp.com (its free) and set the system up to limit where ssh connections can come from.
2) Use a firewall to do the same thing.

We had the same problem with our web servers and stopped it by limiting inbound ssh to our 30 or so offices world-wide.

SEP

Re: Protecting ssh server connections

Steven E. Protter — Thu, 23 Nov 2006 05:58:44 GMT

I forgot something.

I wrote an hp daemon that uses the syslog to detect invalid login attempts and block those IP's. If you want it, I can crank up a system with it and give it to you.

You may use my itrc profile to reach out to me for it. I think however my first approach is better.

SEP

Re: Protecting ssh server connections

Ivan Krastev — Thu, 23 Nov 2006 06:42:16 GMT

You can use also :

AllowUsers user1,user2,..., userx

in sshd_config

without root user.

regards,
ivan

Re: Protecting ssh server connections

rariasn — Thu, 23 Nov 2006 07:04:06 GMT

Hi,

Modify file /etc/opt/ssh/sshd_config

permitRootLogin no

Restart sshd daemon.

rgs.