sshd and locked root account

[Robert Olsson_1]

Hello everyone!
I have HPUX B.11.11 (Trusted system) with HP-UX Secure Shell (T1471AA from hpux.connect.org.uk) installed.
This node is connected to Internet so people can connect with ssh to it.
And the root account is locked out all the time because of the script-kiddies, to run the sshd on another port is not an solution...
Does anyone know how to solve this?
Thank you for your response and help :-)

Important info:
uname -sr: HP-UX B.11.11
sshd -v: OpenSSH_4.1, OpenSSL 0.9.7e 25 Oct 2004
HP-UX Secure Shell-A.04.00.000, HP-UX Secure Shell version
/opt/ssh/etc/sshd_config: PermitRootLogin no
/etc/securetty: console

[Steven E. Protter]

I had the very same problem. Here was my final fix.

By default ssh listens on 0.0.0.0 as in all interfaces.

#ListenAddress 0.0.0.0
ListenAddress 192.168.0.70


By adding this entry I was able to make it stop listening on the public internet NIC.

/sbin/init.d/secsh stop
/sbin/init.d/secsh start

If you only have one interface and its on the public Internet this solution will not work.

I did build a trigger program/daemon that stopped the script kiddies 95% of the time, but that wasn't good enough.

SEP
http://www.isnamerica.com/contactsep.shtml

[Bill Hassell]

ssh is being attacked by a massively large number of script kiddies. This started in depth about a year ago. The absolute best solution is to NEVER allow root login from telnet *or* ssh. For telnet, create /etc/securetty and make it a zero-length file. For ssh, edit the sshd config files and set:

PermitRootLogin no

Then install and use sudo for all root activities. The sshd config prevents attempts to login as root from ever getting to a password request--thus, no failed login counts.

[D Block 2]

yes, turn off root from coming via ssh, for we were being hacked too.. and we limited the ssh client connections to only allow certain login accts (it's backwards, that is, we explaned the NotAllow List in the sshd config file.).

[Robert Olsson_1]

I use a quick n dirty cronjob which unlocks the root's account.
It is run every minute and checks if the account is locked or not.
And ofcourse! root is not allowed to login (but still he get his account locked, so it's not really a security issue, but it is strange).

Thank you all for your help.
Robert