I'm under attack I need help in ssh

tiagom

@coliver said in I'm under attack I need help in ssh:

Would be a good idea to setup fail 2 ban as well.

Agreed.

inroute

there is no config folder in the /etc/ directory but i found dropbear folder in the /etc/ directory and it contain tow files

dropbear _dss_host_key
dropbear _rsa_host_key

any idea

tiagom

What about under /etc/default/dropbear

What distro and pbx are you running so we can stop guessing.

inroute

@tiagom no there no under /etc/default/dropbear

sorry Tiagom im new in Linux
the pbx is Panasonic gsm gateway

inroute

@tiagom Linux version 3.0.76-4.i586 gcc version 4.4.1 ( GCC)

tiagom

It looks like you need to set

 DROPBEAR_EXTRA_ARGS="-s"

in the dropbear init file.

https://github.com/mkj/dropbear/blob/master/debian/dropbear.init

*It states Do not configure this file. Edit /etc/default/dropbear instead! in the latest version. Your version maybe older or modified by panasonic since /etc/default/dropbear doesnt exist..

Arg found here

http://linux.die.net/man/8/dropbear

But honestly, if there is a firewall in front of this pbx box it maybe easier to do it there.

inroute

@tiagom so what do you think i must do to stop hackers and right now one hacker he made the gateway reboots like 100 time

is there a way that i can block him

inroute

@tiagom please see this link
http://manpages.ubuntu.com/manpages/precise/man8/dropbearkey.8.html

do you think it will help and honestly if you can guide me on how to do it .
it will be nice from you

tiagom

Its difficult to suggest without knowing the environment..

The simplest is change passwords if its compromised.

If its behind a firewall you can block traffic on port 22 unless its from your ip..

inroute

@tiagom ummmm....

JaredBusch

@inroute said in I'm under attack I need help in ssh:

@tiagom ummmm....

@tiagom is exactly right. You have a Panasonic device on your network, it should be behind your router/firewall, so just turn off port 22 at your router/firewall.

scottalanmiller

@inroute said in I'm under attack I need help in ssh:

@tiagom GNU/Linux

That's a family but not an OS. OS would be like CentOS, Ubuntu, etc.

scottalanmiller

@inroute said in I'm under attack I need help in ssh:

@tiagom so what do you think i must do to stop hackers and right now one hacker he made the gateway reboots like 100 time

is there a way that i can block him

@inroute said in I'm under attack I need help in ssh:

@tiagom so what do you think i must do to stop hackers and right now one hacker he made the gateway reboots like 100 time

is there a way that i can block him
What is the gateway? It's just an Ubuntu server?

tonyshowoff

@scottalanmiller said in I'm under attack I need help in ssh:

@inroute said in I'm under attack I need help in ssh:

@tiagom GNU/Linux

That's a family but not an OS. OS would be like CentOS, Ubuntu, etc.

GNU/Linux is pig tail riding on behalf of Richard Stallman. If it's GNU/Linux, then this is actually not MangoLassi, but NodeBB/MangoLassi, and WordPress is Zend/WordPress. Funny how nobody else on the entire planet other than Stallman makes a requirement of software using libraries he hasn't contributed to in 30 years.

</my non-contribution to conversation>

tonyshowoff

@JaredBusch said in I'm under attack I need help in ssh:

@inroute said in I'm under attack I need help in ssh:

@tiagom ummmm....

@tiagom is exactly right. You have a Panasonic device on your network, it should be behind your router/firewall, so just turn off port 22 at your router/firewall.

Better yet, do that, and change the port of sshd all together to something much higher. Yes, it's sort of "security through obscurity," but it will avoid constant bot attacks and so forth, but anyone directly wanting to attack the machine can easily find the information if it's open to the public Internet.