cPHulk and botnet

[Esky]

For a few days now tons of IP's have been trying to gain access to our servers via ssh, so I suspect a botnet. every morning my mailbox is filled with hundreds of mails per server from cPHulk saying it banned IP's.

What I'm wondering is if there is a way to stop or prevent this kind of botnet attacks.

 

[TSJaysonG]

You could use tcpwrappers to protect the SSHd service and only allow certain IPs access. This would prevent them from being able to even authenticate to the server and would just discard their connection.

You could also change the SSH port to a different port.

Other than that you would need some sort of network firewall to filter the connections out at the network level before it reaches the server.

 

[jerrybell]

I am having this problem as well. I implemented ssh guard (Sshguard), which updates the firewall rules as brute force attacks are identified. It works quite well.