I've nearly eliminated the problem with brute force attacks, but it's quite multilayered. I use public key authentication with strong passphrases, but leave pa

I've nearly eliminated the problem with brute force attacks, but it's quite multilayered. I use public key authentication with strong passphrases, but leave password authentication enabled for the standard port, so I'll focus on that as the weak link. Assuming high quality passwords and nonobvious user names on systems where password authentication is allowed, set "PermitRootLogin no", "MaxAuthTries 3", and explicitly list users: "AllowUsers fooz1 barx2 cary3" in sshd_config. This is usually enough to foil most random brute force attacks seeking low hanging fruit. After that, the main problem is log noise and the fact that the attack has been slowed, but not stopped. My next line of defense is a short-lived block using the recent module in my iptables startup script (on Linux): IPTABLES=/usr/sbin/iptables # only allow up to 2 connections in a 15 second period $IPTABLES -A INPUT -p tcp --dport 22 \ -m state --state NEW \ -m recent --update --seconds 15 --hitcount 2 \ -j DROP $IPTABLES -A INPUT -p tcp --dport 22 \ -m state --state NEW \ -m recent --set \ -j ACCEPT That's enough to really slow down brute force attacks without locking out fat-fingered users for too long. Finally, I use fail2ban to block persistent attacks for 6 hours after 8 failures/hr in jail.conf: # Failed login attempts against SSH (port 22) [ssh-iptables] enabled = true filter = sshd logpath = /var/log/messages maxretry = 8 bantime = 21600 findtime = 3600 action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois-lines[name=SSH, dest=admin, logpath=/var/log/messages] This allows me to identify attacks and penalize them hard without affecting real users. This basically leaves a DoS as the only threat, and only if you're using the same IP address as the attacker. It may look complicated, but it only takes a few minutes to set up and doesn't require using a nonstandard port (which you can do to further harden the system, along with other things). In my experience, this has been enough to thwart brute force attacks against ssh.