bruteforce protection howto

[Cameron Simpson]

On 20Mar2010 17:25, Craig White <craigwhite at azapple.com> wrote:
| On Sat, 2010-03-20 at 23:17 +0100, Vadkan Jozsef wrote:
| > Two pc's:
| > 
| > 1 - router
| > 2 - logger
| > 
| > Situation: someone tries to bruteforce into a server, and the logger
| > get's a log about it [e.g.: ssh login failed].
| > 
| > What's the best method to ban that ip [what is bruteforcig a server]
| > what was logged on the logger?
| > I need to ban the ip on the router pc.
| > 
| > How can i send the bad ip to the router, to ban it?
| > 
| > Just run a cronjob, and e.g.: scp the list of ip's from the logger to
| > the router, then ban the ip from the list on the router pc?
| > 
| > Or is there any "offical" method for this?
| > 
| > I'm just asking for docs/howtos.. :\ to get started..
| ----
| personally, I always use 'denyhosts' package which can be either single
| system or can share data with other systems.
| 
| yum search denyhosts

I block this stuff with a firewall rule limiting the number of inbound
ssh connections in a period of time. It usually cuts this kind of thing
off fairly promptly. I'm using pf on an openbsd firewall:

  # let admin sites in anyway
  pass log quick proto tcp from <admins> to any port 22 flags S/SA keep state

  # discard already blocked IPs
  block drop quick proto tcp from <evil> to any port 22

  # allow ssh in unless an IP connects too often, adding it to the
  # <evil> table used above
  pass log   quick proto tcp from any    to any port 22 flags S/SA keep state (max-src-conn-rate 20/60, overload <evil> flush)

I believe you can do the same kind of thing in iptables these days if
that's what you've got.

Cheers,
-- 
Cameron Simpson <cs at zip.com.au> DoD#743
http://www.cskk.ezoshosting.com/cs/