How to deny suspicious hosts

Question

Hello everyone!
Lately We have been getting ssh errors such as this:
Invalid user tky from 222.73.216.8
fatal: initgroups: NOUSER: No such file or directory
/etc/sshd_config line 74: Unsupported option KerberosGetAFSToken
Invalid user tkz from 222.73.216.8
fatal: initgroups: NOUSER: No such file or directory
/etc/sshd_config line 74: Unsupported option KerberosGetAFSToken
But several 100s of them. We have OSX server 10.5 and from what I understand this has an adaptive firewall. Well it doesn't seem to be doing much. We also have a hosts.allow file with just the ip address that are allowed to connect. That doesn't seem to be stopping these attacks either.
What can I do to prevent these attacks?

Answer 1

Would this be something I could use?
No. This will not stop dictionary attacks against your ssh server. What it could do is be used as a DOS against your directory server. Any Internet facing system that employs a directory backend could easily be used as way to deny service to your internal clients simply by way of overwhelming it with requests. Vulnerabilities in the Pluggable Authentication Module (PAM) could possibly lead to privilege escalation that might be used to take over the box, also.
And if I set up that, does that mean that only those computers which are authenticated to OD are allowed to access ssh?
Yes. Even employing the GSSAPI-with-MIC method of login would limit the ability to login to the server to OD bound clients only.
Does this mean I will not be able to ssh into the server form home?
Yes.
Your best course of action is to employ key-based authentication -denying password authentication and 'root' user logins- by employing a method of blocking password-based attacks such as one of the software solutions posted earlier. Manually adding hosts to the /etc/hosts.deny file will soon become a daily task for you to protect your ssh server.