How to block / deny all SSH connections to a FatDog client?

versatile 64-bit multi-user Linux distribution

Moderators: kirk, jamesbond, p310don, JakeSFR, step, Forum moderators

Post Reply
Neo_78
Posts: 407
Joined: Wed Dec 29, 2021 10:45 pm
Has thanked: 232 times
Been thanked: 11 times

How to block / deny all SSH connections to a FatDog client?

Post by Neo_78 »

Is the DenyHosts library supported in FatDog?

https://en.m.wikipedia.org/wiki/DenyHosts

For instance:

Code: Select all

/etc/hosts.deny
ALL:ALL

Code: Select all

/etc/hosts.allow
sshd: ALL : DENY

Would there be any technical reason that DenyHosts or an alternative library like Fail2Ban would have to be used exclusively on a server rather than a desktop client (i.e. not a web application)?

https://en.m.wikipedia.org/wiki/Fail2ban

Or what would be the right approach to protect a system against unwanted SSH connections?

User avatar
Trapster
Posts: 174
Joined: Sat Aug 01, 2020 7:44 pm
Has thanked: 1 time
Been thanked: 44 times

Re: How to block / deny all SSH connections to a FatDog client?

Post by Trapster »

Do you want to block ALL ssh connections or just "unwanted" ssh connections?
I use fail2ban on my puppy media/web server and it seems to do well.

You would not need it on a desktop client if you're not running an ssh server.

step
Posts: 545
Joined: Thu Aug 13, 2020 9:55 am
Has thanked: 56 times
Been thanked: 197 times
Contact:

Re: How to block / deny all SSH connections to a FatDog client?

Post by step »

Neo_78 wrote: Thu Sep 22, 2022 11:13 pm

Is the DenyHosts library supported in FatDog?

https://en.m.wikipedia.org/wiki/DenyHosts

there is no denyhost in the package repo.

For instance:

Code: Select all

/etc/hosts.deny
ALL:ALL

Code: Select all

/etc/hosts.allow
sshd: ALL : DENY

These look like specialized hosts configuration files, for which support is built into Fatdog. Man page https://www.mankier.com/5/hosts_access

Would there be any technical reason that DenyHosts or an alternative library like Fail2Ban would have to be used exclusively on a server rather than a desktop client (i.e. not a web application)?

https://en.m.wikipedia.org/wiki/Fail2ban

I don't understand your question. Anyway, the general picture is, you start the ssh server software on the system that some other PC (the client) needs to access. Then the client PC runs the ssh client software to access said ssh server.
Access requires a password, as a minimum. You can also set up encrypted certificates in lieu of passwords.
To start the ssh server use the Services control panel applet. To start the ssh client software run ssh in a terminal.
If you want to limit access to the ssh server to only some ssh clients you could use the built-in eztables firewall https://distro.ibiblio.org/fatdog/web/f ... ewall.html. The hosts.deny file you brought up is also an option, if you want to experiment.

Neo_78
Posts: 407
Joined: Wed Dec 29, 2021 10:45 pm
Has thanked: 232 times
Been thanked: 11 times

Re: How to block / deny all SSH connections to a FatDog client?

Post by Neo_78 »

@Trapster the idea is to block / prevent ALL incoming and outgoing ssh connections for this system.

@step is there a way to completely disable the ssh service / daemon at boot time that it even cannot be started later?

What's the correct rule to block all ssh connections for any network interfaces in eztables? Something like:

Code: Select all

deny_in any any any 22/tcp
deny_out any any any 22/tcp

?

I sometimes think it would be easier to directly learn iptables... :lol:

User avatar
Keef
Posts: 270
Joined: Tue Dec 03, 2019 8:05 pm
Has thanked: 3 times
Been thanked: 75 times

Re: How to block / deny all SSH connections to a FatDog client?

Post by Keef »

Open the control panel > System > Manage Servers and Services. You can disable it there (if it is even running - not sure if it is on by default).

Neo_78
Posts: 407
Joined: Wed Dec 29, 2021 10:45 pm
Has thanked: 232 times
Been thanked: 11 times

Re: How to block / deny all SSH connections to a FatDog client?

Post by Neo_78 »

Thanks @Keef . Not sure how the ssh module is called exactly, but is it possible to disable it / prohibit loading completely with /etc/modprobe.d/blacklist-ssh.conf, for instance blacklist sshd?

chiron
Posts: 20
Joined: Tue Jul 28, 2020 8:15 am
Location: Frankonia/EU
Has thanked: 4 times
Been thanked: 6 times

Re: How to block / deny all SSH connections to a FatDog client?

Post by chiron »

You could find out which binary is executed when the demon starts, and make it non-executable. No way sshd could be started accidentally then.

Neo_78
Posts: 407
Joined: Wed Dec 29, 2021 10:45 pm
Has thanked: 232 times
Been thanked: 11 times

Re: How to block / deny all SSH connections to a FatDog client?

Post by Neo_78 »

You mean chmod 000 filename or chmod -x filename (without changing other permissions) @chiron?

Does FatDog support chattr?

chiron
Posts: 20
Joined: Tue Jul 28, 2020 8:15 am
Location: Frankonia/EU
Has thanked: 4 times
Been thanked: 6 times

Re: How to block / deny all SSH connections to a FatDog client?

Post by chiron »

Yes, exactly what I meant. When typing chattr --help in terminal, it gives a short usage summary, so FD should support using it.

Neo_78
Posts: 407
Joined: Wed Dec 29, 2021 10:45 pm
Has thanked: 232 times
Been thanked: 11 times

Re: How to block / deny all SSH connections to a FatDog client?

Post by Neo_78 »

Thanks @chiron. What would be the best way to detect the executed binary? Something like ps aux | grep sshd?

User avatar
JakeSFR
Posts: 273
Joined: Wed Jul 15, 2020 2:23 pm
Been thanked: 158 times

Re: How to block / deny all SSH connections to a FatDog client?

Post by JakeSFR »

What would be the best way to detect the executed binary? Something like ps aux | grep sshd?

Even simpler: pidof sshd

Greetings!

[O]bdurate [R]ules [D]estroy [E]nthusiastic [R]ebels => [C]reative [H]umans [A]lways [O]pen [S]ource
Omnia mea mecum porto.
jamesbond
Posts: 713
Joined: Tue Aug 11, 2020 3:02 pm
Location: The Pale Blue Dot
Has thanked: 124 times
Been thanked: 399 times

Re: How to block / deny all SSH connections to a FatDog client?

Post by jamesbond »

iptables -I INPUT -p tcp --dport 22 -j DROP

Post Reply

Return to “FatDog64”