0

I use certificate/key based ssh authentication with sshd running on non standard port.

Do I still need to install denyhosts/fail2ban or log analysis based detection?. Do I get any advantage?

appuser
  • 3
  • 1

2 Answers2

1

If you have completely disabled password-based login (PasswordAuthentication = no in sshd_config) then brute-force attacks become a lot harder if not impossible - the client would have to supply a large number of keys, none of which are related to an account or to each other.

Nevertheless, you may still want to block IPs that originate large amounts of invalid login traffic - a possible DoS attack vector.

Denyhosts is a "log analysis based detection" solution; it scans the sshd auth log for login attempts. This works for both passwords and public keys.

Fail2ban goes one step further and allows you to update firewall rules with these results; it is better suited to prevent DoS attacks than denyhosts is.

adaptr
  • 16,576
  • 23
  • 34
  • I now understand the benefit of fail2ban as it also takes care of other services. I am going to install it. Thanks for your help!. – appuser Feb 10 '12 at 13:10
1

Do you really need ssh access from anywhere on the Internet? If you can narrow it down to a couple of fixed IP ranges like work or home and limit SSH access only to them, you'll be better off.

I realise that isn't great if you're out and about and need access from a random wireless network on a random IP range. That's what a vpn is for, say openvpn with two factor auth (one of which is a signed client cert) to get to an environment you can access your boxes from using SSH.

Two factor vpn, will give you more security than cert based SSH and gives you only one place to have to do emergency security updates if, for example, a huge hole in Openssl was found. Then you can just update your openvpn server rather than a panicky, rushed fix to all your hosts running ssh.

goo
  • 2,868
  • 19
  • 15
  • I agree with your idea of narrowing down to fixed IP ranges. I will also install openvpn for additional security. Thanks a lot for your additional ideas. – appuser Feb 10 '12 at 13:13
  • what i do is narrow it down to only a few known ip addresses, but also enable port knocking (with knockd) to allow access to the port from anywhere if i need it. It works very well in my experience. – Sirex Feb 10 '12 at 13:44