Brute-Force SSH Server Attacks Surge (InformationWeek) [LWN.net]

Brute-Force SSH Server Attacks Surge (InformationWeek)

Posted May 14, 2008 22:50 UTC (Wed) by nowster (subscriber, #67)
In reply to: Brute-Force SSH Server Attacks Surge (InformationWeek) by kssingvo
Parent article: Brute-Force SSH Server Attacks Surge (InformationWeek)

This seems to work very well. It limits the number of connections to the SSH port to three in any three minutes. It's based on a post here a few months ago.

# SSH
# Accept trusted hosts
iptables -A INPUT -s 192.168.0.0/16 -p tcp -m tcp --dport ssh -j ACCEPT
iptables -A INPUT -s 172.16.0.0/14 -p tcp -m tcp --dport ssh -j ACCEPT
iptables -A INPUT -s 127.0.0.0/8 -p tcp -m tcp --dport ssh -j ACCEPT

# For outsiders, rate-limit
iptables -A INPUT -p tcp -m tcp --dport ssh \
        -m state --state NEW \
        -m recent --hitcount 3 --seconds 180 --update -j DROP

iptables -A INPUT -p tcp -m tcp --dport ssh \
        -m state --state NEW \
        -m recent --set -j ACCEPT

(Log in to post comments)