How to foil ssh brute force cyber attacks on your fedora linux server

I ssh logged into my home network fedora 19 linux server as root today and was told that there had been 2000 failed login attempts since my last login.
My fedora 20 cloud server had 54516 failed login attempts!

So I looked in /var/log/secure and saw that there was a brute force attack on my root login obviously probing for weak passwords.

Jun 22 03:43:51 localhost sshd[13226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.10.191.222  user=root
Jun 22 03:43:51 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:43:53 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:43:53 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:43:56 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:43:56 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:43:59 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:43:59 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:44:01 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:44:02 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:44:04 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:44:04 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:44:06 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:44:06 localhost sshd[13226]: Disconnecting: Too many authentication failures for root [preauth]
Jun 22 03:44:06 localhost sshd[13226]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.10.191.222  user=root
Jun 22 03:44:06 localhost sshd[13226]: PAM service(sshd) ignoring max retries; 6 > 3

Google research revealed that it is normal for any server with exposed ports such as the ssh port 22 to be attacked 100s of times a day.

It will not be the attacker performing the attack from his own machine but rather it will be a robot he installed on the machine of the last sucker that had a weak password.

So the solution is not to get mad or waste any innocent persons time by reporting it to a human, rather just :-

• say 'thankyou for testing my security and keeping me vigilent'
• '5 attempts was more than enough and I value my cpu time so ...'
• I am disconnecting you from all ports for 100 hours!

The package that will do this is installed as follows:-

yum install fail2ban
cd /etc/fail2ban
ls

You  read jail.conf and for fedora 19 (fail2ban 0.8) it will tell you to create a new file jail.local with the following contents:-

[DEFAULT]
bantime = 360000

[ssh-iptables]
enabled = true

but for fedora 20 (fail2ban 0.9) it will tell you to create a new file jail.local with the following contents :-

[DEFAULT]
bantime = 360000

[sshd]
enabled = true


Next you can enable the fail2ban service and start it:-

systemctl enable fail2ban
systemctl start fail2ban


Happily for me I did not have to test it since my attacker conveniently continued to do it for me. Each ip address he used was added to the banned list until he ran out of ip addresses.

You can see the list by using:-
iptables -L

and see that the last few lines of the rules list (fedora 19) have a section like:-
Chain fail2ban-SSH (1 references)
target     prot opt source               destination        
REJECT     all  --  224.51.174.61.dial.wz.zj.dynamic.163data.com.cn  anywhere             reject-with icmp-port-unreachable
REJECT     all  --  116.10.191.221       anywhere             reject-with icmp-port-unreachable
REJECT     all  --  184.50.174.61.dial.wz.zj.dynamic.163data.com.cn  anywhere             reject-with icmp-port-unreachable
REJECT     all  --  113.17.171.80        anywhere             reject-with icmp-port-unreachable
RETURN     all  --  anywhere             anywhere           
 
for fedora 20 the output looks like this :-

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
f2b-sshd   tcp  --  anywhere             anywhere             multiport dports ssh

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        

Chain f2b-sshd (1 references)
target     prot opt source               destination        
REJECT     all  --  222.186.26.122       anywhere             reject-with icmp-port-unreachable
RETURN     all  --  anywhere             anywhere       

fail2ban has features for many other ports such as mail and ftp but I felt that the ssh port 22  was good enough as an irresistible honey pot as once banned, all ports are closed to the attacker. I will wait and see and enable them if needed.

If I had time it would be fun to allow the attacker in as apparent root with any password to a sandbox and record what he tries to do with his root access. But make sure it really is a sandbox! and that he can't sniff the local network or call out.