ltsOver9000

User Tools

Site Tools

Trace:
system:ssh:security

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
system:ssh:security [2020/07/26 20:36] – ltsover9000system:ssh:security [2020/07/27 05:30] (current) – ltsover9000
Line 2: Line 2:
 ``` ```
 watch -n 1 tail -n 50  /var/log/auth.log  watch -n 1 tail -n 50  /var/log/auth.log 
 +```
 +
 +# View successful login attempts
 +```
 +last
 +```
 +
 +# Custom rolled commands 
 +```
 +# /security
 +logs  # general logs /w watch
 +llogs # live logs
 ``` ```
  
Line 64: Line 76:
 ``` ```
   - https://www.oreilly.com/library/view/linux-security-cookbook/0596003919/ch03s14.html#:~:text=Discussion,listed%20cannot%20receive%20SSH%20connections.&text=means%20%E2%80%9Callow%20the%20remote%20system,to%20my%20local%20account%20user%20.%E2%80%9D   - https://www.oreilly.com/library/view/linux-security-cookbook/0596003919/ch03s14.html#:~:text=Discussion,listed%20cannot%20receive%20SSH%20connections.&text=means%20%E2%80%9Callow%20the%20remote%20system,to%20my%20local%20account%20user%20.%E2%80%9D
 +
 +## Fail2Ban
 +
 +https://blog.mypapit.net/2011/07/how-to-secure-ssh-server-from-brute-force-and-ddos-with-fail2ban-ubuntu.html
 +
 +### Step 1
 +```
 +sudo apt-get install fail2ban
 +```
 +### Step 2: Setting up Fail2ban
 +Next, you need to configure fail2ban by creating a copy of ‘jail.conf’ to ‘jail.local’
 +```
 +cd /etc/fail2ban
 +sudo cp jail.conf jail.local
 +```
 +
 +### Step 3
 +Edit fail2ban configuration file using your favorite text-edito (I personally use ‘nano’)
 +```
 +sudo nano /etc/fail2ban/jail.local
 +```
 +You can set IP address for fail2ban to ignore, IP addresses can be separated by space.
 +
 +Bantime is the duration of time that you want fail2ban to block suspicious attempt, the value is in seconds
 +Maxretry is the number of failed attempts before fail2ban block the IP-address, in this case 3600 means 1-hour ban
 +
 +```
 +# "ignoreip" can be an IP address, a CIDR mask or a DNS host
 +ignoreip = 127.0.0.1 192.168.1.1
 +bantime  = 3600
 +maxretry = 3 
 +```
 +
 +### Step 4
 +Find ssh configuration under [ssh] heading, and enable it.
 +
 +```
 +[ssh]
 +enabled = true
 +port    = ssh
 +filter  = sshd
 +logpath  = /var/log/auth.log
 +maxretry = 3 
 +```
 +Similarly, you can also enable [ssh-dos] protection by changing the enabled value to “enabled = true”
 +
 +```
 +[ssh-ddos]
 +enabled = true
 +port    = ssh
 +filter  = sshd-ddos
 +logpath  = /var/log/auth.log
 +maxretry = 2
 +```
 +### Step 5
 +After all is done, you may save the file, and (re)start the fail2ban service
 +```
 +sudo /etc/init.d/fail2ban restart
 +```
  
system/ssh/security.1595795769.txt.gz · Last modified: by ltsover9000

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki