iptables in linux

[jdow]

You might look at this functionality. Check out your man pages for any
interpretation you need.

===8<---
$IPTABLES -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --set
$IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
   --rcheck --seconds 180 --hitcount 2 -j LOG --log-prefix 'SSH REJECT: ' \
   --log-level info
$IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
   --rcheck --seconds 180 --hitcount 2 -j REJECT --reject-with tcp-reset
===8<---

This means a given address gets one chance every 3 minutes to login.
Even "fubar" is a (relatively) secure password when there is riper
fruit for picking when the creep has to wait 3 minutes between trials.
It can be a pain if I mistype my password. It's a tradeoff in that
regard.

{^_^}

On 2011/11/12 05:19, Roger wrote:
> I'm learning about iptables...
> I find the same ip address sometimes 100 times or more and trying the
> same user name.
> After reading and applying much of the help in google I have tried and
> failed to achieve a successful result.
>
> for example: /var/log/btmp shows:
> user ssh:notty   Thu Nov 10 17:10 - 17:10  (00:00)    hn.vtc.vn
> some 30 times
> user ssh:notty   Thu Nov 10 17:10 - 00:20 (1+07:10)   hn.vtc.vn
> 3 times with varying duration.
> user ssh:notty   Thu Nov 10 13:14 - 17:07  (03:53)     58.250.71.43
> 25 times with varying duration.
> and similar page after page.
>
> Is there a way to limit:
> -number of log in attempts to 2,
> -the duration of a log in attempt to 3 seconds or less
> -the number of times a username can be tried, prefer it set at 2 and
> then not again for 24 hours if it fails.
>
> Also is there a way to DROP ip addresses after 2 attempts and not allow
> that ip address for say 24 hours?
>
> I did not find anything about this in the tutorials.
> iptables does not seem difficult to grasp but I am completely stumped on
> how to create tighter limits.
>
> in part I have:
> DROP  tcp  --  anywhere   anywhere  tcp dpt:ssh state NEW recent: UPDATE
> seconds: 90 hit_count: 4 TTL-Match name: SSH1 side: source
>
> And have tried seconds between 5 and 90 but find even login attempts of
> 2-5 minutes are not dropped.
> hit_count set between 1 and 4 I still see 30+ attempts using the same
> username attempt.
>
> Help gratefully appreciated
> thanks
> Roger
>
>