Making your SSH server more secure with fail2ban

Today, when I was checking the logs on my server, I noticed that someone was trying to hack it by quessing usernames and passwords.

The command
cat /var/log/auth.log

Returned something like this:
Invalid user danica from (attacker ip)
input_userauth_request: invalid user danica [preauth]
pam_unix(sshd:auth): check pass; user unknown
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=(attacker ip)
Failed password for invalid user danica from (attacker ip) port 20135 ssh2
Received disconnect from (attacker ip): 11: Bye Bye [preauth]
reverse mapping checking getaddrinfo for (attacker host) [(attacker ip)] failed - POSSIBLE BREAK-IN ATTEMPT!
Invalid user daniela from (attacker ip)
input_userauth_request: invalid user daniela [preauth]
pam_unix(sshd:auth): check pass; user unknown
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=(attacker ip)
Failed password for invalid user daniela from (attacker ip) port 12037 ssh2
Received disconnect from (attacker ip): 11: Bye Bye [preauth]
reverse mapping checking getaddrinfo for (attacker host) [(attacker ip)] failed - POSSIBLE BREAK-IN ATTEMPT!
Invalid user daniele from (attacker ip)
input_userauth_request: invalid user daniele [preauth]
pam_unix(sshd:auth): check pass; user unknown
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=(attacker ip)
Failed password for invalid user daniele from (attacker ip) port 28710 ssh2
Received disconnect from (attacker ip): 11: Bye Bye [preauth]
reverse mapping checking getaddrinfo for (attacker host) [(attacker ip)] failed - POSSIBLE BREAK-IN ATTEMPT!


Of course, I wanted this to stop. After a quick google search I found two good ways of preventing this: change the ssh server port number to something else than 22 or to use fail2ban to ban the ip address of the attacker with iptables.

I didn't want to change the SSH port, since I've configured it on multiple computers and applications, so fail2ban was my solution of choice.

I'm using ubuntu, so fail2ban could be installed with the commands
apt-get update
apt-get install fail2ban

After the installation, running the command
fail2ban-client status
showed me that fail2ban was running with the default settings (ssh jail was active).

Typing
fail2ban-client status ssh 
showed that one IP address was already blocked by the program.

The "BREAK-IN ATTEMPT!" messages stopped appearing /var/log/auth.log, and the iptables directive list
iptables -L
showed that the attacker's IP was automatically added to the firewall table.

You can also monitor the fail2ban log at /var/log/fail2ban.log

I didn't stop there, though. I edited the fail2ban configuration file /etc/fail2ban/jail.conf so that also some of the apache-related jails were enabled, and I changed the maxretries to a lower value and the ban time to be longer.

In addition, I added a line to /etc/fail2ban/action.d/iptables-multiport.conf that notifies badips.com of each ip that gets banned. This way I get nice graphs and the ips are added to badips.com blocklist, automatically blocking them from other sites as well. Here's a nice tutorial on how to do that.

Comments

Post a Comment

Popular posts from this blog

How to fix the weird audio bug in Kingdom Come: Deliverance

Image
  Kingdom Come: Deliverance has a bug which makes the sound come out muffled or like the characters were talking far away or through a tunnel. This seems to be because the game thinks you are using multichannel surround sound. There seems to be no option to change the audio mode in-game. Instead, you should change your audio settings in Windows by following these directions: Press the windows key Type "Choose your output device" and select the search result. Select "Device properties" under the Output caption. Select "Additional device properties" This dialog will differ depending on your audio hardware. Go to the Advanced tab. There should be a selection for the default audio format. You should select something like this: 2 channel 44100 Hz audio. I had my Focusrite audio interface set up with 8 channels 24bit 44100 Hz, and that caused Kingdom Come to think I have surround sound. After changing the channel amount to 2 the audio started working correctly.
Read more

How to install and play Curse of Monkey Island on Android

Image
There are some great adventure games on Android already. I can warmly recommend Thimbleweed Park or The Silent Age for example. But what if you wanted to play an old classic that cannot be found on Google Play? ScummVM is an app that can emulate these games, if you have the data files. And Curse of Monkey Island is one of these classics. Installation Purchase Curse of Monkey Island from gog.com or Steam (costs about 5€) Download and install it with the GOG Galaxy launcher ... Or Steam Locate the Curse of Monkey Island install directory on your PC Copy the directory to your Android phone, either with a USB cable or on the SD card with an adapter Install the ScummVM app on your phone Start ScummVM and press "Add game" Find the game folder on your phone, select it and click OK.  If you have trouble finding the folder, I made a separate guide for that. Now you can start enjoying Curse of Monkey Island! These instructions should also work on an iPhone. Controls The game is or...
Read more

How to get rid of coil whine just by tweaking BIOS

Finally. No more ringing in my ears! I had a really bad case of coil whine with my computer. In the end I fixed it just by tweaking the BIOS! The coil whine was at it's worst when the PC was idling or under a light load.  Coil whine is a high-pitched sound that is produced by coils resonating at a high frequency. It is really hard to sense where exactly it's coming from. This is because humans cannot sense direction for high-pitched sounds. At first I thought it was my graphics adapter. So I bought a new used one. But the ringing was still there after the upgrade. Next up, I suspected my PSU was the culprit. So I changed the power supply to a newer 80 Plus Platinum model. I hate changing the PSU. And it didn't help. So it looked like my motherboard was the cause. It's an older ASUS motherboard, P8H67-V.  After googling around a bit, I found people talking about ASUS motherboards and coil whine when power-saving features are on in the BIOS . The so-called "C-state...
Read more

Minecraft recv failed error... fixed!

Image
OK. A lot of people seem to have this problem. Finally, I managed to fix it for myself! This problem is quite common with Minecraft Survival Multiplayer. Basically, the problem goes like this: you connect to a server, maybe manage to do something for some minutes, and then you eventually hang up with the message: Internal exception: java.netSocketException: Software caused connection abort: recv failed For some, this comes instantly. Some fall straight into the void and cannot communicate through the chat, although they see the others talk. Some even get to mine something for a while. But then it all ends with this message. It seems that this problem is due to two things: certain integrated network adapters and their old / buggy drivers, and the current buggy state of Minecraft multiplayer mode. Also, some people report that the problem may occur due to incorrect port forwarding. With me, this was not the case. Solutions that work for some people (but didn't work...
Read more

Where does uTorrent keep its .torrent files?

NOTE: uTorrent cannot be trusted anymore. It is known to install Yandex, Ask Toolbar, a bitcoin miner and displayed ads among other fishy stuff. Don't use uTorrent! I recommend using qBittorrent instead, which is an open-source alternative. If you deleted uTorrent and want to remove all of its files, you might want to know where it stores them. On Windows 7, uTorrent stores .torrent files by default in: C:\Users\%USERNAME%\AppData\Roaming\uTorrent ...where %USERNAME% is your Win7 username, and assuming your Windows 7 installation is on C: drive. If you can't browse to this directory, write it on the address bar of Explorer. Another way is to show hidden files by going to Win7 control panel's "folder options" - then you can see the AppData folder.
Read more

Stop the CxUiUSvc service from eating your RAM

Many people seem to have a problem on their PC where a process called CxUiUSvc is eating all the RAM memory. This is caused by a faulty audio driver that seems to be totally useless. The problem seems to appear on HP and Lenovo laptops among others. A driver update might help you, but that is unlikely, since Conexant has stopped operations and will no longer provide updates. The fix to the problem is to stop the CxUiUSvc service and disable it in Windows Services. Stopping the service has seemingly no effect your audio will continue working normally.  Some sites and people recommend setting the service to start manually. This however is reported to cause the service to start again automatically after a few days. Setting the service to disabled should stop it from starting again by itself. Here is a good tutorial on how to disable services. Use the instructions in the tutorial to change the startup type of the CxUiUSvc service to disabled. Some sources: HP forums discussing this iss...
Read more