Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite

I was reading over some of CentOS's documentation in regards to securing SSH and I noticed there was a rule you could implement in IPTables to DROP IP's that attempt to access your SSH port based on a set amount within a certain time frame. It looked something like this :

iptables -A INPUT -p tcp --dport 22 -m recent --set --name ssh --rsource
iptables -A INPUT -p tcp --dport 22 -m recent ! --rcheck --seconds 60 --hitcount 4 --name ssh --rsource -j ACCEPT

I have since moved my SSH port, but I've implemented this rule on the port that SSH was migrated to.

My question is, since this is ideal for SSH, can this not be written for other ports? Should it? Do brute-force attacks come by any other means? Would it be crazy to say that you could implement a rule for IPTables that does this for the entire box?

I suppose a server having high-traffic could almost "trip" over this rule, but I would also guess that brute-force attacks come at such a colossal amount within a small time-frame, there could be some limit put in place to prevent this.

Many thanks SF

share|improve this question

3 Answers

up vote 0 down vote accepted

Look at sshguard, it does exactly that. Originally written for ssh only, now it covers other services too. http://www.sshguard.net/

share|improve this answer
ott--, thanks for your response. I will definitely look into this. – RCNeil Dec 27 '11 at 16:28
up vote 3 down vote

You can do this for SSH and for other services, but you need to know the expected number of connections. Otherwise, you may end up denying legitimate traffic.

One important thing to watch for is to have a rule like this before the recent rules.

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Otherwise, you will be limiting all packets not just the new connections.

share|improve this answer
thanks. I'm assuming then it would be wiser to do this individually for each port I have open than one setting for my IP or something universal? I'm the only person accessing any part of this box aside from port 80, so I was hoping there could be just 1 universal rule I could create to deter attacks – RCNeil Dec 27 '11 at 16:18
If you are the only person accessing this box, then it should be OK to do this for all ports. You should know how many connections you need! – Khaled Dec 27 '11 at 16:23
what would I write a universal rule as? iptables -A INPUT -p --??? -m recent .... – RCNeil Dec 27 '11 at 16:33
Yes, you are right. It will be wiser/more accurate to specify port numbers individually. Do you have so many opened ports? – Khaled Dec 27 '11 at 18:33
I've decided as an easier method I'll simply deny all incoming IPs for these services except for mine because I'm the only person administering this box. That would be a sufficient security measure, no? – RCNeil Dec 27 '11 at 21:29
show 1 more comment
up vote 1 down vote

I personally use DenyHost for this task. http://denyhosts.sourceforge.net/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.