Prevent Brute Force Attacks on your Server

Prevention is better than cure : Prevent Brute Force Attacks on your Server


May be this should help you , so sharing my knowledge about Brute Force attacks and how to prevent it.

Introduction:

You might notice a large number of failed login attempts. Often, these are brute-force attacks against your SSH server. Blocking and preventing brute force attacks is one of the main things you want to do on your web server to add a layer of security. All UNIX-based servers run a SSH server to allow remote administration across the Internet. Someone might not be targeting your site or server specifically, they will have automated tools that will try to guess random usernames and passwords that are common against your system. They are mainly forcing their way to user only authorized area’s of a system, such as FTP accounts, e-mail accounts, databases, script based administration areas and root or any shell access are most common attempts. They will try multiple login attempts, guessing usernames and passwords, trying to force their way onto your machine.


How to Identify Bruce Force Attack on your Server :

You can easily spot a brute force attempt by checking your servers log files. You will see a series of failed login attempts for the service they’re trying to break into.

# pico /var/log/secure , or
# tail –f /var/log/secure

Check for failed login attempts


How Brute Force affects system :

Hackers can try to get into your system using a few different methods.

1) Manual login attempts, they will try to type in a few usernames and passwords

2) Dictionary based attacks; automated scripts and programs will try guessing thousands of usernames and passwords from a dictionary file, sometimes a file for usernames and another file for passwords.

3) Generated logins, a cracking program will generate random usernames set by the user. They could generate numbers only, a combination of numbers and letters or other combinations.


How to prevent a Brute Force attack :

Brute force attacks are more and more common these days as hacking tools are widely available for script kiddies to play with. Arming yourself with knowledge and tools to deal with such attacks can give you peace of mind knowing your system is relatively protected but it will never be 100% foolproof safe. There are a few main ways to stop a brute force attack :

1) Restricting the amount of login attempts that a user can perform
2) Banning a users IP after multiple failed login attempts
3) Keep a close eye on your log files for suspicious login attempts

4) Change the default port

5) Disable Password Authentication

6) Limit Connections

7) Disable Root Access

Deploy Anti-Brute-Force Tools



Tools for preventing brute force attack :

1. APF & BFD (rfxnetworks.com) - There are many different tools you can use to prevent and stop brute force hackers. The two of them we’ll focus on in this article are APF firewall and BFD (brute force detection) developed by rfxnetworks.

APF is a firewall that works using iptables but has some nice features added and makes it easy to use, including Anti-Dos protection. BFD is a modular shell script for parsing applicable logs and checking for authentication failures. If it finds that your authentication failed the set amount of times for an application, it will ban your IP address using APF firewall.

The two of these make an excellent, automated brute force prevention package. BFD checks your logs every few minutes for multiple failed logins attempts, based on a set of rules, if the person fails to login X amount of times the IP is automatically banned at the firewall, preventing further attacks on your system.

2. LogWatch (logwatch.org) - LogWatch is highly recommended tool that sends you daily reports of system activity including disk space, failed login attempts and much more. If you have a Cpanel server LogWatch *should* be installed by default.

Output can look like the following – which I received in an email report =)

Illegal users failed login attempts sample from LogWatch
anonymous/none from (IP HERE): 8 Time(s)
anonymous/password from (IP HERE): 8 Time(s)
guest/none from (IP HERE): 8 Time(s)
guest/password from (IP HERE): 8 Time(s)
root/password from (IP HERE): 24 Time(s)

3. SSHDFilter – SSHDFilter blocks the frequent brute-force attacks by directly reading the SSH daemon logs and generating firewall rules to block the attack. The blocking firewall policy is defined by a list of block-rules.

4. pam_abl – A Pluggable Authentication Module that provides auto blacklisting of hosts and users responsible for repeated failed authentication attempts.

5. SSHBan – SSHban is simple daemon designed to ban attackers. Instead of scanning SSH logs, SSHBan directly receives data from the logger.

6. IPTables Recent Module – This Linux-kernel module allows you to track seen IP addresses and be able to match against them using some criteria. This module is extremely useful to build up a temporary list of IP addresses that attempt to brute-force your SSH server and drop everything coming from them for a given

7. DenyHost – DenyHosts is a script intended to be run by Linux system administrators to help thwart SSH server brute-force attacks . It observers login attempts to the SSH server and if it determines a possible brute-force attack, it will add the IP address to /etc/hosts.deny.

8. Brute-Force Detection – BFD is a shell script for parsing application logs and checking for authentication failures and block the IP address using custom firewall rules.

9. SSHD_Sentry – SSHD Sentry is a Perl script that monitors SSH server logs, detects repeated failed login attempts and adds the hosts to a black list.

10. SSH Guard – Protects networks from brute force attacks against ssh servers. It detects such attacks and blocks the host’s address with a firewall rule.

11. Almost all Host Intrusion Detection systems has a option to block SSH bruteforce attacks.