<div class="gmail_quote">On Fri, Jun 3, 2011 at 4:05 AM, sguazt <span dir="ltr"><<a href="mailto:marco.guazzone@gmail.com" target="_blank">marco.guazzone@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>On Sun, May 29, 2011 at 3:30 PM, sguazt <<a href="mailto:marco.guazzone@gmail.com" target="_blank">marco.guazzone@gmail.com</a>> wrote:</div>
<br>
Hi,<br>
Still have problems. Under /var/log/messages I've this message:<br>
<br>
fail2ban.comm : WARNING Invalid command: ['add', 'ssh-iptables', 'auto']<br>
<br>
Don't know if it is related to my problem.<br>
<br>
Anyway, I am the only one that has this problem (or that runs fail2ban ;) )?<br>
<div><div></div><div><br></div></div></blockquote><div> </div><div>Hi there. Although I do not use fail2ban this sure looks like a bug. You should probably file a bug report.<br><br>If you want some protection from ssh intruders here are a couple of iptables rules you can use until the fail2ban problem is resolved.<br>
<br>-A local_input_filter -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m recent --set --name SSH --rsource <br>-A local_input_filter -m recent --update --seconds 40 --hitcount 3 --name SSH --rsource -j DROP<br>
<br>If someone tries to login to your system via ssh more than 3 times in 40 seconds any further packets will be dropped. I've been using these rules for about 5 years and they work well.<br><br>Mike<br><br><br></div>
</div>