I was reading over some of CentOS's documentation in regards to securing SSH and I noticed there was a rule you could implement in IPTables to DROP IP's that attempt to access your SSH port based on a set amount within a certain time frame. It looked something like this :
iptables -A INPUT -p tcp --dport 22 -m recent --set --name ssh --rsource iptables -A INPUT -p tcp --dport 22 -m recent ! --rcheck --seconds 60 --hitcount 4 --name ssh --rsource -j ACCEPT
I have since moved my SSH port, but I've implemented this rule on the port that SSH was migrated to.
My question is, since this is ideal for SSH, can this not be written for other ports? Should it? Do brute-force attacks come by any other means? Would it be crazy to say that you could implement a rule for IPTables that does this for the entire box?
I suppose a server having high-traffic could almost "trip" over this rule, but I would also guess that brute-force attacks come at such a colossal amount within a small time-frame, there could be some limit put in place to prevent this.
Many thanks SF