ssh security

[Knute Johnson]

Below are the iptables rules that I use to block connections from the 
same address in a 30 second period.  I get a couple of hits a day to 
this but not the thousands of attempts like before.  You can set the 
timeout to whatever you want.  The only drawback to this method is if 
you accidently fail to log in then you can't for 30 seconds.  I also 
restrict root login, use Allow Users and I disabled all password 
authentication.  I did leave it on port 22 though.

# this rule logs
-A RH-Firewall-1-INPUT -m state --state NEW -m recent --name ssh-
limit --update --seconds 30 -m tcp -p tcp --dport 22 -j LOG --log-
level WARNING --log-prefix "ssh-limit  "
# this rule drops the packet if connection is already in list
-A RH-Firewall-1-INPUT -m state --state NEW -m recent --name ssh-
limit --update --seconds 30 -m tcp -p tcp --dport 22 -j DROP
# this rule sets the list
-A RH-Firewall-1-INPUT -m state --state NEW -m recent --name ssh-
limit --set -m tcp -p tcp --dport 22 -j ACCEPT

-- 
Knute Johnson
Molon Labe...