SRX

SRX-240, I was looking at the var/log/messages.

This goes on for many tries, seems like Hong Kong is very busy trying to access our box.

The 

Aug 19 16:39:31 CORPVPN01 sshd: SSHD_LOGIN_ATTEMPTS_THRESHOLD: Threshold for unsuccessful authentication attempts (3) reached by user 'root'
Aug 19 16:39:31 CORPVPN01 sshd[2713]: Disconnecting: Too many password failures for root [preauth]
Aug 19 16:39:31 CORPVPN01 sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '43.229.53.79'
Aug 19 16:39:31 CORPVPN01 sshd[2721]: Failed password for root from 43.229.53.79 port 35649 ssh2
Aug 19 16:39:32 CORPVPN01 sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '218.65.30.61'
Aug 19 16:39:32 CORPVPN01 sshd[2719]: Failed password for root from 218.65.30.61 port 42938 ssh2

Hi, starlog

I see this often, you can off root-login for ssh and use only users login

Hello,

The below should discourage all but most determined bruteforcers:

system {
    services {
        ssh {
            root-login deny;
            rate-limit 2;
        }
    }
    login {
        retry-options {
            tries-before-disconnect 2;
            backoff-threshold 3;
            backoff-factor 5;
            maximum-time 20;
        }
    }
}

If tweaking the above, make sure You don't accidentlaly lock out Yourself for too long, i.e. don't raise "maximum-time" too high.

HTH

Thanks

Alex

The usual brute force password...

I'm waiting for the crack a password of 30 characters. 

show log messages.0.gz | match SSHD_LOGIN_FAILED | count
Count: 2762 lines

Use a simply filter:

set firewall family inet filter local_acl term terminal_access from address 192.168.1.0/24
set firewall family inet filter local_acl term terminal_access from protocol tcp
set firewall family inet filter local_acl term terminal_access from port ssh
set firewall family inet filter local_acl term terminal_access from port telnet
set firewall family inet filter local_acl term terminal_access then accept
set firewall family inet filter local_acl term terminal_access_denied from protocol tcp
set firewall family inet filter local_acl term terminal_access_denied from port ssh
set firewall family inet filter local_acl term terminal_access_denied from port telnet
set firewall family inet filter local_acl term terminal_access_denied then log
set firewall family inet filter local_acl term terminal_access_denied then reject
set firewall family inet filter local_acl term default-term then accept
set interfaces lo0 unit 0 family inet filter input local_acl
set interfaces lo0 unit 0 family inet address 127.0.0.1/32

Or http://kb.juniper.net/InfoCenter/index?page=content&id=KB21265&actp=RSS&smlogin=true

It is the best way!