Blocking unauthorized SSH access
SSH attacks are among the most prevalent types of attacks against servers accessible via the internet. Automated bots that regularly monitor the internet for SSH servers with inadequate security setups carry out the major share of SSH attacks. Because attack sources are frequently scattered globally, with no single country dominating, it is a global cybersecurity threat. Organizational losses, data breaches, and compromised servers are all possible outcomes of successful SSH attacks. In this section, we will learn how to automatically block unauthorized SSH access to a victim’s machine.
We will learn about the following:
- Lab setup
- Setting up active response
- Testing
Lab setup
In this lab setup, we require three things: an Ubuntu Server with a Wazuh agent installed, an attacker machine (Kali Linux), and, finally, our Wazuh server (we have used a Virtual Machine OVA file for Lab purposes only). The lab is designed as...
