Re: ssh under attack - sessions in accepted state hogging CPU

2010-08-11 Thread Matt Emmerton
On 10/08/10 05.13, Matt Emmerton wrote: I'm in the middle of dealing with a SSH brute force attack that is relentless. I'm working on getting sshguard+ipfw in place to deal with it, but in the meantime, my box is getting pegged because sshd is accepting some connections which are getting

Re: ssh under attack - sessions in accepted state hogging CPU

2010-08-10 Thread Rocky Borg
One thing I don't see mentioned a lot is port knocking. It's not perfect but it does have it's uses. Since it sounds like you have a lot of users that need to connect you might be able to adapt it to your situation. I haven't tried this specific port knocking sequence but you could setup a

Re: ssh under attack - sessions in accepted state hogging CPU

2010-08-10 Thread Chuck Swiger
Hi, Matt-- On Aug 9, 2010, at 8:13 PM, Matt Emmerton wrote: I'm in the middle of dealing with a SSH brute force attack that is relentless. I'm working on getting sshguard+ipfw in place to deal with it, but in the meantime, my box is getting pegged because sshd is accepting some

Re: ssh under attack - sessions in accepted state hogging CPU

2010-08-10 Thread Dave
On 8/9/2010 8:13 PM, Matt Emmerton wrote: Hi all, I'm in the middle of dealing with a SSH brute force attack that is relentless. I'm working on getting sshguard+ipfw in place to deal with it, but in the meantime, my box is getting pegged because sshd is accepting some connections which are

Re: ssh under attack - sessions in accepted state hogging CPU

2010-08-10 Thread Ian Smith
In freebsd-questions Digest, Vol 323, Issue 3, Message: 35 On Mon, 9 Aug 2010 23:36:57 -0400 Matt Emmerton m...@gsicomp.on.ca wrote: I know there's not much I can do about the brute force attacks, but will upgrading openssh avoid these stuck connections? 1. switch over to using

Re: ssh under attack - sessions in accepted state hogging CPU

2010-08-10 Thread Paul Macdonald
On 10/08/2010 15:25, Dave wrote: On 8/9/2010 8:13 PM, Matt Emmerton wrote: Hi all, I'm in the middle of dealing with a SSH brute force attack that is relentless. I'm working on getting sshguard+ipfw in place to deal with it, but in the meantime, my box is getting pegged because sshd is

Re: ssh under attack - sessions in accepted state hogging CPU

2010-08-10 Thread Matt Emmerton
On 8/9/2010 8:13 PM, Matt Emmerton wrote: Hi all, I'm in the middle of dealing with a SSH brute force attack that is relentless. I'm working on getting sshguard+ipfw in place to deal with it, but in the meantime, my box is getting pegged because sshd is accepting some connections which are

Re: ssh under attack - sessions in accepted state hogging CPU

2010-08-10 Thread Erik Norgaard
On 10/08/10 05.13, Matt Emmerton wrote: I'm in the middle of dealing with a SSH brute force attack that is relentless. I'm working on getting sshguard+ipfw in place to deal with it, but in the meantime, my box is getting pegged because sshd is accepting some connections which are getting stuck

ssh under attack - sessions in accepted state hogging CPU

2010-08-09 Thread Matt Emmerton
Hi all, I'm in the middle of dealing with a SSH brute force attack that is relentless. I'm working on getting sshguard+ipfw in place to deal with it, but in the meantime, my box is getting pegged because sshd is accepting some connections which are getting stuck in [accepted] state and

Re: ssh under attack - sessions in accepted state hogging CPU

2010-08-09 Thread Matt Emmerton
I know there's not much I can do about the brute force attacks, but will upgrading openssh avoid these stuck connections? 1. switch over to using solely RSA keys In the works; I have too many users to convert :( 2. switch to a non-standard port This is not attractive, even though it

Re: ssh under attack - sessions in accepted state hogging CPU

2010-08-09 Thread Matt Emmerton
I know there's not much I can do about the brute force attacks, but will upgrading openssh avoid these stuck connections? 1. switch over to using solely RSA keys In the works; I have too many users to convert :( 2. switch to a non-standard port This is not attractive, even though it

Re: ssh under attack - sessions in accepted state hogging CPU

2010-08-09 Thread James Harrison
Hi Matt, I know there's not much I can do about the brute force attacks, but will upgrading openssh avoid these stuck connections? 1. switch over to using solely RSA keys 2. switch to a non-standard port 3. what version of openssh are you currently using? Best