You might look at this functionality. Check out your man pages for any
interpretation you need.
===8<---
$IPTABLES -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --set
$IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
--rcheck --seconds 180 --hitcount 2 -j LOG --log-prefix 'SSH REJECT: ' \
--log-level info
$IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
--rcheck --seconds 180 --hitcount 2 -j REJECT --reject-with tcp-reset
===8<---
This means a given address gets one chance every 3 minutes to login.
Even "fubar" is a (relatively) secure password when there is riper
fruit for picking when the creep has to wait 3 minutes between trials.
It can be a pain if I mistype my password. It's a tradeoff in that
regard.
{^_^}
On 2011/11/12 05:19, Roger wrote:
I'm learning about iptables...
I find the same ip address sometimes 100 times or more and trying the
same user name.
After reading and applying much of the help in google I have tried and
failed to achieve a successful result.
for example: /var/log/btmp shows:
user ssh:notty Thu Nov 10 17:10 - 17:10 (00:00) hn.vtc.vn
some 30 times
user ssh:notty Thu Nov 10 17:10 - 00:20 (1+07:10) hn.vtc.vn
3 times with varying duration.
user ssh:notty Thu Nov 10 13:14 - 17:07 (03:53) 58.250.71.43
25 times with varying duration.
and similar page after page.
Is there a way to limit:
-number of log in attempts to 2,
-the duration of a log in attempt to 3 seconds or less
-the number of times a username can be tried, prefer it set at 2 and
then not again for 24 hours if it fails.
Also is there a way to DROP ip addresses after 2 attempts and not allow
that ip address for say 24 hours?
I did not find anything about this in the tutorials.
iptables does not seem difficult to grasp but I am completely stumped on
how to create tighter limits.
in part I have:
DROP tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: UPDATE
seconds: 90 hit_count: 4 TTL-Match name: SSH1 side: source
And have tried seconds between 5 and 90 but find even login attempts of
2-5 minutes are not dropped.
hit_count set between 1 and 4 I still see 30+ attempts using the same
username attempt.
Help gratefully appreciated
thanks
Roger