Suspect SSH activity in server logs | Comments (0)
Posted in Linux/Unix on 31st August 2004, 7:40 pm by Stuart
Having seen a load of failed attempted SSH logins for the Linux boxes I look after, I have locked down what IP addresses SSHD accepts using iptables.
The failed attempts are trying to log in using GUEST/GUEST, ADMIN/ADMIN and other various combinations with no password. It seems like these are pretty lightweight attempts, but unless you have a reason to do otherwise, locking down access to SSH is probably a good idea!
Here’s how to do this with iptables:
-A RH-Lokkit-0-50-INPUT -s xxx.xxx.xxx.xxx -p tcp --dport 22 -j ACCEPT
Replace xxx.xxx.xxx.xxx with the IP address of the box you wish to allow to connect to the server you are securing.
