Categories:
For anyone using LogWatch and is worried about sshd Authentication
Failures then you need to understand that there are thousands of robots
and scripts that will scan random IPs for easy login access to servers.
This is nothing to worry about.
Logwatch Authentication Failures
sshd:
Authentication Failures:
unknown (202.172.251.200): 251 Time(s)
Invalid Users:
Unknown Account: 499 Time(s)
All you need to do is block the IP that’s scanning your system. You can
do this automatically by following my tutorial on Preventing Brute Force
Attacks http://www.webhostgear.com/240.html
Changing your SSH port number will sometimes help for scanners that are
not targetted but anyone can still do a port scan and run the bot on the
different port. Blocking them with your firewall is be best method.
Once BFD and APF are setup you dont’ need to worry about LogWatch
Authentication Failures anymore.
Steve
May 25th, 2006 at 6:20 pm
Hello, I prefer to use TCPWrappers,
Enter to your server, then
vi /etc/hosts.allow
Insert sshd: your IP or your ISP, for ex. : .aol.com, (don’t forget the period at the begin) the file looks :
sshd:aaa.bbb.ccc.ddd,.aol.com,
Save the file and then edit /etc/hosts.deny
Insert the following text,
sshd:ALL,
Save the file and logout.
After a time you can see in /var/log/secure
the refused connections.
Note, if you have Dynamic IP don’t forget to put your ISP!
Marco