Jamie Griffin <[email protected]> writes:
> Hello
>
> I've been reading up on securing sshd after being bombarded with attempted
> logins.
>
> The steps i've taken so far to make things more secure are:
>
> * changed the encryption method for passwords in /etc/login.conf from md5 to
> blowfish and changed all the passwords to ridiculously obscure ones (at least
> as obscure as I could think of).
>
> * changed /etc/ttys secure entries to insecure to prevent root logins on the
> console
>
> (the above are not really sshd specific i know.)
>
> * Disabled root login by ssh in /etc/ssh/sshd_config
>
> * Set myself as the only user able to login by ssh
>
> * Disabled password logins completely, and to only allow public key
> authentication
>
> * Changed the default ssh port from 22 to something much higher
>
> I'm the only user that will ever need to log into the machine. I wondered,
> does this setup seem ok and are there any other methods used by anyone on
> list that might help me to secure remote logins even further?
Hi,
I'm using the following pf snippet in order to "protect" myself and my
system's logs against brute force attemps on sshd:
#
# Block them all
#
block log quick from <bruteforce_ssh>
#
# connection rate the incoming ssh connections and fill the bruteforce
# table
#
pass in log inet proto tcp from any to any port = 22 \
flags S/SA keep state \
(max-src-conn 10, max-src-conn-rate 5/4, \
overload <bruteforce_ssh> flush global)
For more information on how this works, take a look at pf.conf(5).
I don't know if it's complete (or even good practice), but a) I think it
works for me and b) it does not depend on a port-provided solution.
> Thanks for any help.
>
> Jamie
> _______________________________________________
> [email protected] mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "[email protected]"
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[email protected]"
