Protecting ssh server connections

[ballans]

Hi everybody,
My server is an HP-UX B.11.23 (trusted system).
This system is a pop server with ssh activated in order to login to the server from the outside (OpenSSH_4.1).
The problem is that we are victim of ssh attacks (dictionnary attack) and the consequence is that the root account is locked. All days, I have to reactivate my root account. In addition, it causes problem for maintennace operation...
In the sshd_config file I add the following line :
PermitRootLogin no
but it seems to not blocking the attempt...
So, I would like to block IP address which try to log on my ssh server with too many unsuccesfull attempt...
Could you please advice me for the best solution ? Maybe I found a way with the use of keep state in ipfilter. Is it a good solution in my case ?

Thanks in advance for your replies.
Herve

[Steven E. Protter · Accepted solution]

Shalom,

Options:
1) Install HP ipfilter from http://software.hp.com (its free) and set the system up to limit where ssh connections can come from.
2) Use a firewall to do the same thing.

We had the same problem with our web servers and stopped it by limiting inbound ssh to our 30 or so offices world-wide.

SEP

[Steven E. Protter]

I forgot something.

I wrote an hp daemon that uses the syslog to detect invalid login attempts and block those IP's. If you want it, I can crank up a system with it and give it to you.

You may use my itrc profile to reach out to me for it. I think however my first approach is better.

SEP

[Ivan Krastev]

You can use also :

AllowUsers user1,user2,..., userx

in sshd_config

without root user.


regards,
ivan

[rariasn]

Hi,

Modify file /etc/opt/ssh/sshd_config

permitRootLogin no

Restart sshd daemon.

rgs.