How do I stop bruteforce SSH login attempt?
jason at jeetkunedomaster.net
Wed Apr 12 12:12:47 UTC 2006
On Wednesday 12 April 2006 07:30, Soo-Hyun Choi wrote:
> A few days ago, I have noticed that my system is under constant
> attack(?) with a bruteforce SSH login - e.g., from a single IP
> address, it tries like 100 ~ 200 ssh login trial with all different
> user names, and go away.
> I know how to block it in a FreeBSD system with "denyhost" or
> "bruteforceblocker" from the ports, but I have little knowledge in my
> Ubuntu 5.10 box.
> Would there be anyone who could tell me something about it?
> Thank you.
It's probably a zombie machine, what do zombies do? They scan for the open
port they want to attack, in your case 22. Change your ssh port to 2022 or
something and you won't have a problem any more.
| Jason Straight
| SkyCon.net 231-627-3528
| Jabber: leejunfan at jabber.org
| ICQ: 1796276 / AIM: JasonRStraight
| MSN: glock21-45cal at hotmail.com / Yahoo: jasonrstraight
More information about the ubuntu-users