FreeBSD. DenyHosts Will Protect You from SSH Brute-Force Attacks

Around the beginning of November, security specialists noticed unusual botnet behavior. They began a coordinated effort to slowly try username and password combinations on all sorts of hosts. Specialists call this “slow brute force” because the rate of password guessing is extremely low (every password combination has to be tried for every possible username in the dictionary)—this process will take several years.

But thanks to the huge number of machines involved in the “attack,” things are still gradually moving forward—every day, the attackers get some kind of “catch.” Requests come from different IP addresses (see the logs). The attack is clearly coordinated from a central hub (the bots share a dictionary for trying combinations).

Botnets involved in “slow brute force” have become smarter…

Well, if you too are being subjected to brute-force attempts (and who isn’t these days…), DenyHosts will come to your rescue!

Installation

This is how I installed it; there are more details on the official page.

# wget http://www.inetbase.com/scripts/ddos/install.sh
# chmod 0700 install.sh
# ./install.sh

However, there is also a port for this utility

# /usr/ports/security/denyhosts
# make install clean

This works through TCP-Wrappers, so sshd needs to be run through inetd

#sshd_enable="YES"
inetd_enable="YES"
denyhosts_enable="YES"
syslogd_flags="-c"

Let’s add a line to /etc/inetd.conf

ssh     stream  tcp     nowait  root    /usr/sbin/sshd          sshd -i -4

Let’s create a file for banned IP addresses

# touch /etc/hosts.deniedssh

Let’s edit /etc/hosts.allow, right at the beginning of the file (around line 23)

# разрешаем локалке
sshd : 192.168.0.0/255.255.255.0 : allow

# запретим целому списку
sshd : /etc/hosts.deniedssh : deny

# остальным разрешим
sshd : ALL : allow

Let’s Edit the Configuration File

# vi /usr/local/etc/denyhosts.conf

We’re interested in the following contents:

# сюда будет высылать отчет о забаненных IP
ADMIN_EMAIL = mail@example.com

# какие сервисы контролировать (можете добавить например ftpd)
BLOCK_SERVICE  = sshd

# лог
DAEMON_LOG = /var/log/denyhosts

# список забаненых IP
HOSTS_DENY = /etc/hosts.deniedssh

# секурный лог, туда помещается информация о соединениях
SECURE_LOG = /var/log/auth.log

# количество неправильных авторизаций
DENY_THRESHOLD_INVALID = 5

Now, when an IP address is added to the banned list, you’ll receive a notification at mail@example.com

Let’s start the utility

# /usr/local/etc/rc.d/denyhosts start

As dud said, in general it’s better to use certificates and do away with entering a username/password, but that’s not always convenient…