3

I was reading over some of CentOS's documentation in regards to securing SSH and I noticed there was a rule you could implement in IPTables to DROP IP's that attempt to access your SSH port based on a set amount within a certain time frame. It looked something like this :

iptables -A INPUT -p tcp --dport 22 -m recent --set --name ssh --rsource
iptables -A INPUT -p tcp --dport 22 -m recent ! --rcheck --seconds 60 --hitcount 4 --name ssh --rsource -j ACCEPT

I have since moved my SSH port, but I've implemented this rule on the port that SSH was migrated to.

My question is, since this is ideal for SSH, can this not be written for other ports? Should it? Do brute-force attacks come by any other means? Would it be crazy to say that you could implement a rule for IPTables that does this for the entire box?

I suppose a server having high-traffic could almost "trip" over this rule, but I would also guess that brute-force attacks come at such a colossal amount within a small time-frame, there could be some limit put in place to prevent this.

Many thanks SF

Improve this question

3 Answers 3

Reset to default
0

Look at sshguard, it does exactly that. Originally written for ssh only, now it covers other services too. http://www.sshguard.net/

Improve this answer
1
  • ott--, thanks for your response. I will definitely look into this.
    – RCNeil
    Dec 27, 2011 at 16:28
3

You can do this for SSH and for other services, but you need to know the expected number of connections. Otherwise, you may end up denying legitimate traffic.

One important thing to watch for is to have a rule like this before the recent rules.

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Otherwise, you will be limiting all packets not just the new connections.

Improve this answer
6
  • thanks. I'm assuming then it would be wiser to do this individually for each port I have open than one setting for my IP or something universal? I'm the only person accessing any part of this box aside from port 80, so I was hoping there could be just 1 universal rule I could create to deter attacks
    – RCNeil
    Dec 27, 2011 at 16:18
  • If you are the only person accessing this box, then it should be OK to do this for all ports. You should know how many connections you need!
    – Khaled
    Dec 27, 2011 at 16:23
  • what would I write a universal rule as? iptables -A INPUT -p --??? -m recent ....
    – RCNeil
    Dec 27, 2011 at 16:33
  • Yes, you are right. It will be wiser/more accurate to specify port numbers individually. Do you have so many opened ports?
    – Khaled
    Dec 27, 2011 at 18:33
  • I've decided as an easier method I'll simply deny all incoming IPs for these services except for mine because I'm the only person administering this box. That would be a sufficient security measure, no?
    – RCNeil
    Dec 27, 2011 at 21:29
1

I personally use DenyHost for this task. http://denyhosts.sourceforge.net/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .