Re: ssh scans

[Steven Bellovin <smb%cs.columbia.edu@localhost>]

On Oct 27, 2009, at 2:22 AM, Jukka Ruohonen wrote:

> On Mon, Oct 26, 2009 at 12:42:57PM -0700, David Wetzel wrote:
> > I am seeing a lot of ssh scans and I am wondering if somebody has a
> > solution like adding the bad hosts temporary to pf.conf or so?
>
> If you are from a smaller country and login only from that location,
> something like
>
> ALL     : localhost     : ALLOW
> sshd    : .fi           : ALLOW
> ALL     : ALL           : DENY
>
> in hosts.allow(5) and "ALL : ALL" in hosts.deny(5) works quite  
> reasonably.
>
> - Jukka.
>
> P.S. I believe that often this eternal issue is more about log spam  
> rather
> than about any real security threat. As for the special tools others  
> have
> proposed, keep in mind that these tools have historically introduced
> security issues themselves.
That depends on how bad your users are with password choices.  Some of  
my students lost some VMs to attackers who got in via just this  
mechanism.

Me -- I permit public key authentication only.

                --Steve Bellovin, http://www.cs.columbia.edu/~smb