Jtdylktuy

A very insistent individual is trying continuously to gain (unauthorized) access to my system for the last few days... There are a gazillion of entries, like in /var/log/auth.log:

Jun 21 03:55:15 cloudy sshd[32487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.20  user=root

Jun 21 03:55:16 cloudy sshd[32487]: Failed password for root from 116.31.116.20 port 30629 ssh2

Jun 21 03:55:19 cloudy sshd[32487]: Failed password for root from 116.31.116.20 port 30629 ssh2

Jun 21 03:55:21 cloudy sshd[32487]: Failed password for root from 116.31.116.20 port 30629 ssh2

Jun 21 03:55:21 cloudy sshd[32487]: Received disconnect from 116.31.116.20: 11:  [preauth]

Jun 21 03:55:21 cloudy sshd[32487]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.20  user=root

I would like to ask for some advice on how to block this individual from consuming resources from the computer, is there a possibility to "hard block" the IP from even opening an ssh connection? Please note, I use Debian 8 as OS.

From http://www.linuxquestions.org/questions/linux-newbie-8/how-to-configure-ssh-to-allow-or-deny-specify-host-ip-address-610246/

Add sshd: 116.31.116.20 to /etc/hosts.deny

You can also use iptables

Create a file with ip addresses you want to block as blocked.ips.txt

Now create and run a script containing the following:

blocked=$(egrep -v -E "^#|^$" ./blocked.ips.txt)

for ip in $blocked

do

    iptables -I INPUT -s $ip -p tcp --dport ssh -j DROP

done

Running iptables -L should give output of dropped packets

iptables approach is the most direct way. Erik Handriks proposed it as a script.

Two but-s:
- the script would have to be started after every restart, (if tables not backed up internally with iptables).
- calling the script as is, twice or more will duplicate entries.

Try simply nailing the bad guy with:

iptables -I INPUT -s BAD_IP -p tcp --dport ssh -j DROP

In most distributions, iptables has own rules-save-restore mechanism.
See if '/var/lib/iptables/rules-save' is present. For your distro, it might sit somewhere else (gentoo here).

After you add every single BAD IP, try:

iptables-save > /var/lib/iptables/rules-save

After restart, check with 'iptables -L' what's out there...

You may want to use Fail2Ban to monitor logs and block IP automagically. It is possible to specify time period and fail count to block IP address, inform administrator, send complain to IP owner etc.

See for more info: https://www.upcloud.com/support/installing-fail2ban-on-debian-8-0/

On my server (Ubuntu 16.04) I use UFW (UncomplicatedFireWall), a simplification layer over iptables) which seems to be pretty much standard issue on Ubuntu servers (but should be available for other distros). For these cases I use:

ufw insert 1 deny from nnn.nnn.nnn.nnn

UFW also allows you to limit the number of connections

ufw limit ssh/tcp

Note that this also applies to successful connections, so if you use scripts that use multiple ssh command, you have to disable this limit for your IP by issuing:

ufw insert 1 allow in from nnn.nnn.nnn.nnn