Weak-Password Brute-Force Defense: SSH Hardening and fail2ban

Defense against weak-password guessing on SSH, RDP, and web logins: fail2ban, account lockout, and key-based SSH. Unauthorized password spraying is illegal.

Scope

Weak-password risk checks are common in enterprise testing and compliance self-assessment. Scope: verify account-lockout policy, and whether SSH/RDP/web logins are internet-exposed. Written authorization is required. Unauthorized testing is illegal.

Prerequisites

• Linux host with fail2ban
• Inventory of SSH (22), RDP (3389), and web login exposure
• Written authorization on file

Internals

Online password guessing replays username/password pairs over SSH, RDP, or HTTP and scores success from protocol responses. Hit rate tracks dictionary quality, concurrency, and whether the target locks accounts or rate-limits. Unhardened servers fall to good dictionaries in minutes. Treat that as a password-policy signal.

Procedure

Won't provide Hydra, crunch, john, or other password-spraying commands for SSH, RDP, or web forms.

fail2ban lockout

apt install -y fail2ban
cat > /etc/fail2ban/jail.local <<'EOF'
[sshd]
enabled = true
port = ssh
maxretry = 5
bantime = 3600
EOF
systemctl restart fail2ban

Disable SSH password authentication; use keys. Enable PAM lockout (`pam_tally2` or equivalent). Do not expose management services to the internet.

Verification

• `/var/log/auth.log`: source IP banned after `maxretry=5` failures
• `fail2ban-client status sshd` shows the ban list
• Confirm lockout (`pam_tally2`) fires as configured
• Rotate any production account still on a weak password

FAQ

FAQ 1: Will password guessing get detected?

Yes. Burst failed logins leave auth logs. fail2ban, WAF, and IDS all flag it.

FAQ 2: Password policy is already strict. Why do guesses still work?

Usual causes: no lockout, dictionaries include prior dumps (rockyou, etc.), or one password reused across accounts. Defense is three-way: strong passwords + lockout + key auth (disable SSH password logins).

Summary

Password-policy strength is a lockout and credential-hygiene problem. Pair fail2ban, account lockout, and key auth. Close the loop: find weak credentials, fix them, retest lockout. That cuts weak-password abuse.