"jdow" <jdow(a)earthlink.net> writes:
I have found, however, that a simple three line iptables addition
seems
to work like a champ, except for filling up the log.
===8<---
iptables -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --set
iptables -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
--rcheck --seconds 120 --hitcount 3 -j LOG --log-prefix 'SSH REJECT: '
$iptables -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
--rcheck --seconds 120 --hitcount 3 -j REJECT --reject-with tcp-reset
===8<---
This is indeed a lovely approach, but has a drawback: it can't tell
the difference between many legit SSH connections and many bogus ones.
For example, if you are getting at a Subversion repository with
'svn+ssh://host/repo-stuff', then whole bunches of ssh connections
will be made in rapid succession. You can always up the hitcount, but
that's just a method waiting to fail (e.g. what if SVN does something
unexpected that needs _lots_ of ssh connections).
Just FYI.
Will