How can I block ssh brute force attempts in OS X 10.11?

Question

My system running OS X 10.11 is constantly getting hammered by failed ssh login attempts by bots. I'm using a secure password and the root account isn't accessible via ssh, but even so it's still a drain on CPU time and it makes me nervous.

Is there a good way I can ban IP addresses that guess the password wrong too many times while still allowing myself to ssh in? Even better if this tool has a nice GUI so I don't have to use the command line.

I tried using sshguard, but I simply cannot get it to work. There's threads in various places about it not working properly in OS X 10.10, and I haven't found any solutions.

Other places have recommended using a VPN so that outsiders can't ssh into your system, but that's not an option for me. It's important that I be able to ssh in from arbitrary systems out in the world, and setting up VPNs on them is generally not feasible.

Answer 1

I've been researching opening up SSH like this on other *nix based systems, and most suggest two things. I'm sorry but I don't know how to do either on MacOS.

• Fail2Ban - Which bans IPs that have too many failed login attempts
• key rather than password based SSH logins. I believe you can take your key around with you if you want to use public machines.

Answer 2

I run sshblack (found via Sebastian Hagedorn's site) as well as a portknocker in macOS Sierra, since the syslog now is accessed via the 'log show' command you'd have to adjust the log config settings below if you're on an earlier version of the os or use fail2ban following the linked instructions above. Also use key based authentication with passwords turned off (How to Set Up a Password-less SSH Login - add a passphrase). Then I download blocklists daily and block IPs in the firewall. Should be safe now...

Settings: /etc/pf.conf

# sshblack
block drop log quick from <ssh-block> to any

sshblack.pl

##  In sshblack
my($LOG) = '/usr/bin/log show --style syslog --last 5s\|';
my($ADDRULE) = '/sbin/pfctl -t ssh-block -T add ipaddress';
my($DELRULE) = '/sbin/pfctl -t ssh-block -T delete ipaddress';
my($REASONS) = '(maximum authentication attempts exceeded|Invalid user|authentication failed|Auth fail)'; 

Add a 5 sec delay to the loop

Change to this (~line 190):

sleep(5);

You do get an error in the log but it seems to work fine anyway.

To add blocklists that automatically updates, do this: Install wget (which requires brew):

brew install wget

In /etc/pf.conf

table <blocklist> persist file "/usr/local/etc/all.txt"
block drop log quick from <blocklist> to any

Create a LaunchDaemon:

sudo nano /Library/LaunchDaemons/blocklist.de.allips.plist

with the content:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>blocklist.de.allips.plist</string>
    <key>Program</key>
    <string>/bin/bash</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/bash</string>
        <string>-c</string>
    <string>/bin/mkdir -p /usr/local/etc ; /usr/local/bin/wget -N -P /usr/local/etc rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt ; /usr/local/bin/wget -N -P /usr/local/etc https://lists.blocklist.de/lists/all.txt ; pfctl -t blocklist -T replace -f /usr/local/etc/all.txt</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartInterval</key>
    <integer>47250</integer>
    <key>ServiceDescription</key>
    <string>Blocklist.de PF Update</string>
    <key>StandardErrorPath</key>
    <string>/var/log/blocklists.log</string>
    <key>StandardOutPath</key>
    <string>/var/log/blocklists.log</string>
</dict>
</plist>

Load the plist

sudo launchctl load -w /Library/LaunchDaemons/blocklist.de.allips.plist

This sshd config may also be useful in combination with the key authentication mentioned above:

File: /etc/ssh/sshd_config

PermitRootLogin no
ChallengeResponseAuthentication no
UsePAM no
PasswordAuthentication no
LoginGraceTime 20
MaxAuthTries 1
MaxSessions 5

Some background: I ran the blocking scripts (Blocking around 50000 IPs) and during approx. 5 days sshblack still detected ~160 IPs with failed login attempts to SSHD or SMTPD. This is why I went down the Portknocking route, now the SSH-attackers are blocked by the firewall instead.

Edit: I went through my sshd-log and spotted that I missed a "reason" in the log. I've added it above (the last one).

Some stats:

Failed ssh logins(with ip-blocklists enabled)
Date       No of unique ips
13-Mar - 31
14-Mar - 29
15-Mar - 30
16-Mar - 39
17-Mar - 43
18-Mar - 41
19-Mar - 35
20-Mar - 44
21-Mar - 24
22-Mar - 18
23-Mar - 17
24-Mar - 20
25-Mar - 7 (portknocking enabled during this date)

Total 378

Most of these guys were banned after 3 failed attempts.