How to detect SSH brute force attacks and protection solutions

What is SSH brute force attack?

When we talk about SSH brute force attack, we are referring to a common form of attack where an attacker tries to gain access to a server by repeatedly trying different usernames and passwords. This form is often performed using automation tools, which speeds up the attack and minimizes the need for human intervention.

Characteristics of SSH brute force attack

SSH brute force attacks typically target servers running Unix or Linux operating systems, where the SSH service provides secure remote connectivity. The attacker will repeatedly try different login credentials until they find the right one. A clear sign that your server is under attack is a large number of failed login attempts in a short period of time.

Impact of brute force attack on server

Brute force attacks not only degrade server performance, but can also result in attackers gaining unauthorized access to critical data. With that access, they can steal financial information, distribute malware, or even hijack the system to conduct illegal activities.

Common brute force attack methods

Some of the typical tools that attackers often use to perform brute force attacks include Hydra, Chaos, CrackMapExec, and PoshC2. These tools are capable of performing rapid attacks on different protocols, making them more difficult to detect and prevent.

Why do attackers use SSH brute force?

Understanding why attackers choose to brute force SSH attacks can help us develop more effective defenses. There are many reasons why attackers perform such attacks.

Explore account information

One of the main reasons attackers perform brute force attacks is to discover account information, including usernames and passwords. If successful, they can gain access to a system and steal sensitive information.

Data Illegalization

Once they have gained access to a system, attackers can easily steal valuable data, causing great damage to businesses or individuals. From financial information to personal data, these can all be exploited for malicious purposes.

Distribute malware or conduct other attacks

Once a system is compromised, attackers don't stop at stealing information. They can distribute malware to other systems, creating a network of infected computers. This can not only cause damage to one organization, but can also spread to many other systems.

How to protect your server from SSH brute force attacks?

To protect your server from SSH brute force attacks, there are several strategies you can adopt. Implementing these measures will not only help protect your information but also increase the reliability of your system.

Switch to SSH key authentication

Using default username and password authentication can make your server more vulnerable to attack. One effective way to increase security is to switch to SSH key authentication.

With SSH key authentication, you use a public and private key pair. The private key is stored on the client computer, while the public key is copied to the server. This makes guessing the password nearly impossible.

During SSH key authentication, the server checks to see if the client has a valid private key. If authentication is successful, a shell session is established between the client and the server.

Limit authentication attempts

Another way to protect SSH from brute force attacks is to limit the number of authentication attempts per connection. You can do this by adjusting the MaxTries variable in the sshd_config configuration file.

Each authentication attempt counts as an attempt to access the server. A starting recommendation is to set MaxTries to 3 to balance security and user experience.

Implement brute force protection with third-party tools

Another option to protect SSH from brute force attacks is to use third-party tools. Some popular tools like DenyHosts, Fail2Ban, and pam_abl can help track and block IP addresses from which failed login attempts are generated.

DenyHosts is a Python-based security tool designed to protect SSH servers from brute-force attacks. It works by monitoring authentication logs for invalid logins and blocking IP addresses.

Fail2Ban is also a powerful tool that uses configuration files to scan your server logs for suspicious activity. When it detects something suspicious, it can trigger one or more actions, including blocking the suspect IP address for a certain amount of time.

Restrict server access using TCP wrappers

Another security method you can use is to restrict access to your server using TCP wrappers. This method allows you to control who can connect to your SSH service.

Install TCP wrappers

To install TCP wrappers, you first need to make sure it is installed on your server. You can then configure the /etc/hosts.allow and /etc/hosts.deny files to specify which IP addresses are allowed or denied access to the SSH service.

Not only does this help you control access, it also increases the security of your server as attackers face an additional barrier.

Monitor and check logs

In addition to restricting access, monitoring and auditing logs is also important. By analyzing system logs, you can detect early signs of brute force attacks and respond promptly.

The logs will give you detailed information about connections to your server, including IP addresses and access attempts. Having this information will give you a better overview of your server's security situation.

Implement two-factor authentication (2FA)

Two-factor authentication (2FA) is a very effective way to increase the security of SSH. With 2FA, users are required to provide a second factor in addition to their username and password, such as an authentication code sent to their phone.

Benefits of 2FA

The biggest benefit of implementing two-factor authentication is that even if an attacker gets your username and password, they still won't be able to access your system without the second factor. This greatly reduces the risk of remote attacks.

How to set up 2FA for SSH

There are several ways to set up 2FA for SSH, such as using Google Authenticator or Authy. Once installed, you just need to add a few lines of code to your sshd_config configuration file to integrate 2FA into your authentication process.

Not only does this increase security, it also gives you peace of mind knowing that your server is better protected.

Using a non-standard port for SSH

Finally, a simple yet effective way to protect your server from brute force attacks is to change the default port for SSH. By default, SSH uses port 22, and that is the port that attackers always target first.

Why use non-standard ports?

By using a non-standard port, you can reduce your exposure to automated attackers. While it won't completely prevent them, it will make them more complicated.

How to change SSH port

To change the SSH port, simply open the sshd_config configuration file and change the "Port" parameter to a different port number. Then, make sure this new port is open on your firewall.

This not only protects you from brute force attacks, but also helps you manage connections to your server more efficiently.

Conclude

SSH brute force attack detection and protection are essential in today's cybersecurity landscape. Understanding the types of attacks and implementing appropriate protection measures will help you protect your system from potential threats. Always improve your knowledge and practice good security measures to ensure that your server is always safe.

Jessica Tanner

Update 01 April 2025