iptables in linux

Reindl Harald h.reindl at thelounge.net
Sat Nov 12 19:45:56 UTC 2011


Am 12.11.2011 11:19, schrieb Roger:
> Is there a way to limit:
> -number of log in attempts to 2, 
> -the duration of a log in attempt to 3 seconds or less
> -the number of times a username can be tried, prefer it set at 2 and
> then not again for 24 hours if it fails.

trivial

iptables -A INPUT -p tcp --sport 1024: -m state --syn --state NEW --dport 22 -m limit --limit 15/minute
--limit-burst 10 -j ACCEPT
iptables -A INPUT -p tcp --sport 1024: -s YOUR-IP-RANGE --dport 22 -m state --state NEW --syn -j ACCEPT
iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j REJECT

but you should also configrue sshd on a non-standard-port to get rid of 95% of the noises

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 262 bytes
Desc: OpenPGP digital signature
Url : http://lists.fedoraproject.org/pipermail/users/attachments/20111112/faeea17d/attachment.bin 


More information about the users mailing list