Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have blocked all connection with iptables and allowed only the loopback:

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

next I want to allow only ssh connections, and also I want to record the IP address of each attempt to access port 22 using the recent module.then I want to to see if that IP address has attempted to connect 2 or more times within the last 60 seconds, and if not then the packet is accepted:

iptables -A INPUT -p tcp --dport 22 -m recent --set --name ssh --rsource
iptables -A INPUT -p tcp --dport 22 -m recent ! --rcheck --seconds 60 --hitcount 2 --    name ssh --rsource -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT 
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT 
iptables -A INPUT -p tcp --sport 22 -j ACCEPT 
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP

the problem that probably didn't write it right so can someone show me whhat is my problem

share|improve this question
    
Somewhat unrelated to your question, but you probably don't want to do this iptables -A INPUT -p tcp --sport 22 -j ACCEPT. With a rule like this, I can use netcat and set the source port nc -p 22 and connect to any listening port on your server. –  slillibri Jun 1 '11 at 11:26
add comment

migrated from stackoverflow.com Jun 1 '11 at 9:49

This question came from our site for professional and enthusiast programmers.

1 Answer

You mean... something like ....

iptables -N BADGUY
iptables -t filter -I BADGUY -m recent --set --name badguys

iptables -A INPUT -i $OUTS -p tcp --syn --dport ssh -m recent --name ssh --set
iptables -A INPUT -i $OUTS -p tcp --syn --dport ssh -m recent --name ssh --rcheck --seconds 300 --hitcount 6 -j BADGUY
iptables -A INPUT -i $OUTS -p tcp --syn --dport ssh -m recent --name ssh --rcheck --seconds  30 --hitcount 2 -j DROP

?

You may also want to look at fail2ban wich does exacly what you want.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.