From 3ef1ed7e4d5f73884361d5d9660196ef79e3ce46 Mon Sep 17 00:00:00 2001 From: Daniel Kempkens Date: Mon, 22 Dec 2014 19:46:23 +0100 Subject: [PATCH] Add SSH bots post --- ...2-ssh-bots-do-not-know-about-my-ciphers.md | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 _posts/2014-12-22-ssh-bots-do-not-know-about-my-ciphers.md diff --git a/_posts/2014-12-22-ssh-bots-do-not-know-about-my-ciphers.md b/_posts/2014-12-22-ssh-bots-do-not-know-about-my-ciphers.md new file mode 100644 index 0000000..5f22d30 --- /dev/null +++ b/_posts/2014-12-22-ssh-bots-do-not-know-about-my-ciphers.md @@ -0,0 +1,28 @@ +--- +layout: post +title: SSH Bots Don't Know about My Ciphers +description: "Choosing a small number of newer ciphers prevents SSH bots from connecting." +date: 2014-12-22 19:45:00 CET +category: posts +tags: [ssh, ops, english] +comments: true +--- + +Last weekend I decided to update my `sshd_config` to include a very limited set of ciphers, MACs and key exchange algorithms. I did this to tighten the security of my `sshd` and not because I wanted to prevent bots from trying (and failing) to log in to my servers. I'm already using [fail2ban](http://www.fail2ban.org) for that. +However, after I updated my configuration I noticed failed login attempts basically dropped to zero, because all these bots do not support my very restrictive set of ciphers. + +{% highlight text %} +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com +KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256 +{% endhighlight %} + +In order to use these settings, you need a recent version of [OpenSSH](http://www.openssh.com). I'm running 6.6 locally and on my servers, the minimum version that supports these settings is 6.4. + +After these changes your `auth.log` will probably contain this line rather often: + +{% highlight text %} +fatal: no matching cipher found: client aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc server chacha20-poly1305@openssh.com,aes256-gcm@openssh.com [preauth] +{% endhighlight %} + +Please keep in mind that this will not prevent bots from attacking you (in the future) and that you have to prevent these attacks by other means. I only wrote this post because I thought it is kind of interesting that SSH bots do not support these settings *right now*.