iptables in linux

[Roger]

Thank you, much appreciated
Roger
> You might look at this functionality. Check out your man pages for any
> interpretation you need.
>
> ===8<---
> $IPTABLES -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --set
> $IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
>     --rcheck --seconds 180 --hitcount 2 -j LOG --log-prefix 'SSH REJECT: ' \
>     --log-level info
> $IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
>     --rcheck --seconds 180 --hitcount 2 -j REJECT --reject-with tcp-reset
> ===8<---
>
> This means a given address gets one chance every 3 minutes to login.
> Even "fubar" is a (relatively) secure password when there is riper
> fruit for picking when the creep has to wait 3 minutes between trials.
> It can be a pain if I mistype my password. It's a tradeoff in that
> regard.
>
> {^_^}
>
> On 2011/11/12 05:19, Roger wrote:
>> I'm learning about iptables...
>> I find the same ip address sometimes 100 times or more and trying the
>> same user name.
>> After reading and applying much of the help in google I have tried and
>> failed to achieve a successful result.
>>
>> for example: /var/log/btmp shows:
>> user ssh:notty   Thu Nov 10 17:10 - 17:10  (00:00)    hn.vtc.vn
>> some 30 times
>> user ssh:notty   Thu Nov 10 17:10 - 00:20 (1+07:10)   hn.vtc.vn
>> 3 times with varying duration.
>> user ssh:notty   Thu Nov 10 13:14 - 17:07  (03:53)     58.250.71.43
>> 25 times with varying duration.
>> and similar page after page.
>>
>> Is there a way to limit:
>> -number of log in attempts to 2,
>> -the duration of a log in attempt to 3 seconds or less
>> -the number of times a username can be tried, prefer it set at 2 and
>> then not again for 24 hours if it fails.
>>
>> Also is there a way to DROP ip addresses after 2 attempts and not allow
>> that ip address for say 24 hours?
>>
>> I did not find anything about this in the tutorials.
>> iptables does not seem difficult to grasp but I am completely stumped on
>> how to create tighter limits.
>>
>> in part I have:
>> DROP  tcp  --  anywhere   anywhere  tcp dpt:ssh state NEW recent: UPDATE
>> seconds: 90 hit_count: 4 TTL-Match name: SSH1 side: source
>>
>> And have tried seconds between 5 and 90 but find even login attempts of
>> 2-5 minutes are not dropped.
>> hit_count set between 1 and 4 I still see 30+ attempts using the same
>> username attempt.
>>
>> Help gratefully appreciated
>> thanks
>> Roger
>>
>>