I also found failed2ban had much less work to do, banning handful a day, not a thousand, by stopping ssh password authentication and using private key authentication. Something I should have done from the start anyway. It seems when if a server sends public key on attempted login and refuses password it stops the kiddies/robots from trying anymore.

Gerry

-----Original Message----- From: tor-relays tor-relays-bounces@lists.torproject.org On Behalf Of Toralf Förster Sent: 21 September 2020 14:53 To: tor-relays@lists.torproject.org Subject: Re: [tor-relays] SSH

On 9/21/20 1:52 PM, Logforme wrote:

Change the SSH default port.

AFAICT that helped but only fore a while. After few weeks/months the non-default port is discovered by (a probably more extensible port scan) and the failed login attempts continued.

On 9/21/20 7:52 AM, Logforme wrote:

On 2020-09-21 11:19:20, "Андрей Гвоздев" andrejgvozdev55@gmail.com wrote:

...

Hello I'm running a TOR relay, every time I SSH to my server I see a message that there were thousands of failed login attempts Do you see this message too?

Exposing a SSH server to the internet will get you lots of login attempts.

Yes, this is normal for anyone running internet-facing systems, and there are as many mitigations as there are sysadmins.

Here are some things you SHOULD do to help the situation: Change the SSH default port.

Yes, this will lessen the number of entries in the relevant log file until the brute force attackers get more intelligent. Just understand this is not a security measure. It's more like a dose of obscurity to make log files less noisy.

Disable the root login.

+1

Use key-based authentication.

+1

Those are important and vital security measures, as is employing some sort of multi-factor authentication methods like Yubikey. (no, officially key-based SSH auth is not formally MFA...)

But the two ways to actually address the problem is either:

* network or host-based firewalling to limit connections based on the same source, rate, etc., which depends on the operating system you're running.

* there are also tools like fail2ban and so on that are popular.

* if you're running FreeBSD or NetBSD, try Christo's blacklistd. It might be ported to other OSs. If it's not, it should be...

HTH

g

breaking the top-post....

Hello I'm running a TOR relay, every time I SSH to my server I see a message that there were thousands of failed login attempts Do you see this message too?

This is one of those issues that you figure out your own preferred method over time as you run public services over the internet.

First, where do you see the message? Not sure about your operating system, but if it's dumping the failed logins to your screen on you're on a Unix-like operating system, you should probably check your /etc/syslog.conf. Dumping failed ssh logins to a file like /var/log/authlog makes more sense.

Second, make sure you're following the basics with SSHD security. Require keys or Yubikey etc and don't rely on password security for SSH access.

You could consider fail2ban and similar tools, but consider either your host-based firewall or better yet, an upstream network firewall. Rate-limiting SSH attempts, blacklisting based on bogon addresses, etc, will bring you part of the way.

IMHO, the less third-party software you install on a Tor relay, the better off you are. More code means more surface area and more bugs.

The standard tenet of "there's no security with obscurity" rings true, but we're talking about log noise here, not security. Therefore, you might want to consider changing the TCP port SSHD is listening on. It will likely decrease the noise level.

The great secret SSHD security hack that I feel uncomfortable mentioning on a public list is... do SSH over IPv6 if you can. Seems like the bots haven't caught up to that yet.

g