Enable bruteforce protection for SSH service

[Timur Nurlygayanov]

Enable bruteforce protection for SSH: we should be ready for production environments and we need to protect SSH service.
Right now we allow any numbers of login attempts for SSH, and it's non secure.

On our environment we configured SSH service to block IP address after 3 incorrect login attempts, and we can do this in vanilla Fuel, 'from the box'.

Need enable this feature on Fuel master node and on all OpenStack nodes too.

[Max Mazur (mmaxur)]

e.g. add
- fail2ban
or something like
iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m hashlimit --hashlimit 1/hour --hashlimit-burst 2 --hashlimit-mode srcip --hashlimit-name SSH --hashlimit-htable-expire 60000 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
iptables -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
or
iptables -A INPUT -p tcp –dport 22 -m recent –set –name SEC –syn -m state –state NEW -j ACCEPT
iptables -A INPUT -p tcp –dport 22 -m recent –update –seconds 60 –hitcount 3 –rttl –name SEC -j LOG –log-prefix “BRUTE_FORCE“
iptables -A INPUT -p tcp –dport 22 -m recent –update –seconds 60 –hitcount 3 –rttl –name SEC -j DROP

[Matthew Mosesohn (raytrac3r)]

Timur, is this for Fuel Master or deployed nodes?

Also, the more typical method to implement limits on login is usually with PAM, which will log in the very conspicuous place, /var/log/secure, instead of in /var/log/messages with all the other miscellaneous attempts. Documentation here http://www.linux-pam.org/Linux-PAM-html/sag-pam_tally2.html

[Timur Nurlygayanov (tnurlygayanov)]

Matthew, for Fuel master node and for all OpenStack nodes too.

[Mike Scherbakov (mihgen)]

I'm in favor of using auth by keys.

> for all OpenStack nodes too.
pass auth is disabled for openstack nodes, so it doesn't affect it.

[Bogdan Dobrelya (bogdando)]

Superseded by https://blueprints.launchpad.net/fuel/+spec/ssh-pam-tally2