block some ip -illegal try by ssh

[sf433]

How to block some ip / domain, if I found they were trying illegally ssh to my machine?

[Vergil83]

with route you can

/sbin/route add -host ip_address reject

Man Route

with iptables you can

iptables -I INPUT -s ip_address -j DROP

Man Iptables

[sf433]

1. Thanx, It works.

2. How to restrict
a) some users using ssh login
b) some users using telnet login
c) block others servces except dns, ftp, www. ssh - They are for temporay use, After I go thru the details, I will config them for my purpose. I want to do something at this moment.

3. Drop me some links for iptables you recomend.

[spoon!]

How to restrict some users using ssh login

Perhaps use the "DenyUsers" option in your /etc/ssh/sshd_config (see "man sshd_config")?

Also as a side note, if someone hacked into your computer, perhaps you should run the chkrootkit and rkhunter programs to check for rootkits.

[Cool Surfer]

hi, just wanted to ask a quick question here.....

how will i come to know that someone is hooked to my pc or is
trying to hook using ssh / telnet ?

[deek]

You can always check your access logs, which will list every attempt to login through ssh or telnet...

If you have sshd running, I would probably disable telnet and close that port on your router...

[Cool Surfer]

Any visual firewall thing ??!! like in windows zone alarm etc.

[anomie]

Another option is tcp wrappers. If you're launching sshd via the inetd server, you can modify allowed / blocked networks using /etc/hosts.allow and /etc/hosts.deny. If you're launching sshd via xinetd I believe each service has its own file (rather than a general file with many entries like inetd uses).

[loft306]

1. Thanx, It works.

2. How to restrict
a) some users using ssh login
b) some users using telnet login
c) block others servces except dns, ftp, www. ssh - They are for temporay use, After I go thru the details, I will config them for my purpose. I want to do something at this moment.

3. Drop me some links for iptables you recomend.

just dont allow root login and 90% of the problem is gone!

and in the sshd config file you can allow only certais users to login with ssh

you can also switch authentication to a private 'key' and only the approved users are given that key! instead of using there user password

[anomie]

how will i come to know that someone is hooked to my pc or is
trying to hook using ssh / telnet ?

What distro? As was mentioned, /var/log/messages (for SuSE anyway) contains your SuSEfirewall2 messages along with accepted and failed logins.

You can use

w

to see who is doing what on your system.

You can use

netstat -atun

to look at active and listening ports.