How to Prevent SSH Brute Force Attacks: A Comprehensive Guide

How to Prevent SSH Brute Force Attacks: A Comprehensive Guide

SSH (Secure Shell) is a critical protocol for remote server management, but its widespread use makes it a prime target for attackers.

Brute force attacks against SSH services remain one of the most common security threats faced by system administrators.

This guide provides comprehensive strategies to protect your SSH service from unauthorized access attempts.

How to Defend Against Large-Scale DDoS Attacks: A Comprehensive Strategy

Understanding SSH Attack Methods

Before implementing protective measures, it’s important to understand the common attack vectors:

Brute Force Attacks: Automated tools systematically try common username and password combinations
Dictionary Attacks: Attackers use pre-generated password lists to enumerate login credentials
Port Scanning: Malicious actors scan for open SSH ports to identify potential targets
DDoS Attacks: Distributed requests that overwhelm server resources
Exploit Attacks: Targeting known vulnerabilities in outdated SSH versions

How to Prevent Ransomware Infection Risks

Essential SSH Hardening Strategies

1. Change the Default SSH Port

The default SSH port (22) is the first target for automated attacks. Changing it significantly reduces unwanted traffic:

# Edit SSH configuration
vim /etc/ssh/sshd_config

# Change port number
Port 2234

# Restart SSH service
systemctl restart sshd

2. Implement Fail2ban for Automated Protection

Fail2ban is an intrusion prevention framework that monitors log files and automatically bans IP addresses showing malicious behavior.

Installation and Configuration:

# Update package list
apt update

# Install Fail2ban
apt install fail2ban -y

# Verify service status
systemctl status fail2ban

Create Custom Configuration:

# Create local configuration file
vim /etc/fail2ban/jail.local

Add the following configuration:

[sshd]
enabled = true
port = 2234              # Match your actual SSH port
logpath = none
backend = systemd
maxretry = 4             # Ban after 4 failed attempts
bantime = 3600           # Ban duration in seconds (1 hour)
findtime = 600           # Time window for counting failures

Restart and Verify:

# Restart Fail2ban
systemctl restart fail2ban

# Check SSH jail status
fail2ban-client status sshd

# View banned IPs
fail2ban-client banned

3. Use Key-Based Authentication

Password authentication is inherently vulnerable. SSH key authentication provides significantly stronger security:

# Generate SSH key pair (on client)
ssh-keygen -t ed25519 -C "your_email@example.com"

# Copy public key to server
ssh-copy-id -p 2234 user@server_ip

# Disable password authentication (on server)
vim /etc/ssh/sshd_config

# Set these parameters
PasswordAuthentication no
PubkeyAuthentication yes

4. Restrict User Access

Limit SSH access to specific users:

# Edit SSH configuration
vim /etc/ssh/sshd_config

# Allow only specific users
AllowUsers admin user1 user2

# Or allow specific groups
AllowGroups sshusers

# Deny root login
PermitRootLogin no

5. Implement Two-Factor Authentication

Add an extra security layer with Google Authenticator:

# Install Google Authenticator
apt install libpam-google-authenticator -y

# Configure for user
google-authenticator

# Edit PAM configuration
vim /etc/pam.d/sshd
# Add: auth required pam_google_authenticator.so

# Edit SSH configuration
vim /etc/ssh/sshd_config
# Set: ChallengeResponseAuthentication yes

6. Configure Firewall Rules

Use UFW or iptables to restrict SSH access:

# Using UFW
ufw allow from 203.0.113.0/24 to any port 2234
ufw enable

# Using iptables
iptables -A INPUT -p tcp -s 203.0.113.0/24 --dport 2234 -j ACCEPT
iptables -A INPUT -p tcp --dport 2234 -j DROP

Monitoring and Alert Systems

Set Up Real-Time Notifications

Configure alerts for banned IPs using services like PushPlus:

#!/bin/bash
# Fail2ban notification script

token='your_pushplus_token'
URL="https://www.pushplus.plus/send/"

# Get currently banned IPs
banned_ips=$(fail2ban-client banned | grep -A1 "'sshd'" | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}')

if [ -n "$banned_ips" ]; then
    current_time=$(date "+%Y-%m-%d %H:%M:%S")
    title="SSH Ban Alert"
    content="Time: ${current_time}\nBanned IPs: ${banned_ips}"
    
    curl -X POST -H "Content-Type: application/json" \
         -d "{\"token\":\"$token\",\"title\":\"$title\",\"content\":\"$content\"}" \
         "$URL"
fi

Monitor Logs Regularly

# View authentication logs
tail -f /var/log/auth.log

# Check Fail2ban logs
tail -f /var/log/fail2ban.log

# Review SSH access attempts
grep "Failed password" /var/log/auth.log | tail -20

Additional Security Best Practices

Keep Software Updated: Regularly update SSH and system packages to patch vulnerabilities
Use Strong Passwords: If password authentication is necessary, enforce complex password policies
Implement Connection Limits: Configure MaxStartups and MaxSessions in sshd_config
Enable Logging: Ensure comprehensive logging is enabled for forensic analysis
Whitelist IPs: Use ignoreip in Fail2ban configuration to prevent self-lockout
Regular Audits: Periodically review SSH access logs and user permissions
Use VPN: Consider requiring VPN connection before SSH access
Implement Idle Timeout: Automatically disconnect idle sessions

Why VPN Security Should Be Every Enterprise’s Top Priority

Critical Warnings

Avoid Self-Lockout: Always test configurations before disconnecting, and whitelist your management IP addresses
Backup Configurations: Keep copies of working configurations before making changes
Test Port Changes: Ensure firewall rules allow the new SSH port before applying changes
Document Changes: Maintain records of custom ports and configurations
Monitor Legitimate Users: Ensure Fail2ban settings don’t accidentally block valid users

How Do Hackers Gain Administrator Access in Under an Hour?

Conclusion

Protecting SSH from brute force attacks requires a multi-layered approach combining automated tools like Fail2ban, strong authentication methods, proper configuration, and continuous monitoring.

By implementing these strategies, you can significantly reduce the attack surface and protect your servers from unauthorized access attempts.

Remember that security is an ongoing process—regularly review logs, update software, and adjust configurations based on emerging threats and your specific security requirements.

How to Prevent SSH Brute Force Attacks: A Comprehensive Guide