Several tools exist to block ssh attempts via updating yours hosts or iptables/ipfw rules. These are all postpurtom. Linux netfilter has the recent module which allows realtime blackholing. Also using passphrases, deny Root ssh or atleast without-password and allowing wheel group su or limited sudo access helps. Page and Port knocking are other ideas as well as running your own rbl service [honeypot collects ips] and running ssh through tcpserver [see DJB's ucspi-tcp] which uses that rbl.

Changing the port is anti RFC and doesn't really solve the problem, though it does block over 90% of attacks.

-m1ha5

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/infocus/1876/734#734