Andrii IURLOV, 123RF.com
Targeted defense against brute force attacks
Goalkeeper
To protect your system, sshguard takes a simple and effective approach, similar to that of a small intrusion detection system. The tool continually monitors logfiles for selected services. If it discovers questionable network access, it temporarily blocks the presumed attacker by introducing firewall rules (Figure 1).
Figure 1: The SSH daemon logs client requests (1) in the auth.log file (2). Then sshguard (3) monitors the file and creates a firewall rule (4) that blocks the client (5) if it notices to many login attempts.
If the attacker doesn't stop at this point, sshguard will block the connection for increasingly long periods. This intelligent strategy has the advantage of not accidentally locking out forgetful users, and it provides effective protection against automated password crackers.
The Usual Suspects
As the name suggests, sshguard was originally designed to monitor failed SSH login attempts. But now, it can help you with any of the services listed in the "Supported Services" box. For other services, you can send attack patterns to the developers on a
...
Buy this article as PDF
(incl. VAT)
Buy ADMIN Magazine
US / Canada
UK / Australia
Related content
-
Port Knocking
To ensure that the data on your computers remains accessible only by you and those with whom you want to share, we look at the advantages of combining TCP Wrappers and port knocking. -
Manage logs with logrotate
Take charge of your installation's logfiles with logrotate. -
DNSSEC-aware DNS caching with Unbound
If you don't have access to a DNSSEC-aware name server, you can set up your own with Unbound. -
Building a defense against DDoS attacks
Targeted attacks such as distributed denial of service, with thousands of computers attacking your servers until one of them caves in, cannot be prevented, but they can be effectively mitigated. -
A script for strict packet filter updates
Automatically create restrictive rules in Linux iptables packet filters.
Subscribe to our ADMIN Newsletters
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Most Popular
Support Our Work
ADMIN content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
