Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been checking my /var/log/secure log recently and have seen the same bot trying to brute force onto my Centos server running webmin.

I created a chain + rule in Networking -> Linux Firewall:

Drop    If source is 113.106.88.146

But I'm still seeing the attempted logins in the log:

Jun  6 10:52:18 CentOS5 sshd[9711]: pam_unix(sshd:auth): check pass; user unknown
Jun  6 10:52:18 CentOS5 sshd[9711]: pam_succeed_if(sshd:auth): error retrieving information about user larry
Jun  6 10:52:19 CentOS5 sshd[9711]: Failed password for invalid user larry from 113.106.88.146 port 49328 ssh2

Here is the contents of /etc/sysconfig/iptables:

# Generated by webmin
*filter
:banned-ips - [0:0]
-A INPUT -p udp -m udp --dport ftp-data -j ACCEPT
-A INPUT -p udp -m udp --dport ftp -j ACCEPT
-A INPUT -p udp -m udp --dport domain -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport https -j ACCEPT
-A INPUT -p tcp -m tcp --dport http -j ACCEPT
-A INPUT -p tcp -m tcp --dport imaps -j ACCEPT
-A INPUT -p tcp -m tcp --dport imap -j ACCEPT
-A INPUT -p tcp -m tcp --dport pop3s -j ACCEPT
-A INPUT -p tcp -m tcp --dport pop3 -j ACCEPT
-A INPUT -p tcp -m tcp --dport ftp-data -j ACCEPT
-A INPUT -p tcp -m tcp --dport ftp -j ACCEPT
-A INPUT -p tcp -m tcp --dport domain -j ACCEPT
-A INPUT -p tcp -m tcp --dport smtp -j ACCEPT
-A INPUT -p tcp -m tcp --dport ssh -j ACCEPT
-A banned-ips -s 113.106.88.146 -j DROP
COMMIT
# Completed
# Generated by webmin
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
# Generated by webmin
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
share|improve this question
1  
Your chain banned-ips doesn't seem to be linked to the INPUT chain. Try iptables -I INPUT -j banned-ips –  ripat Jun 6 '12 at 15:00
    
Any reason you put both "-m tcp" and "-p tcp"? One of them should be enough, shouldn't it? –  shayan Jun 8 '12 at 19:54
add comment

2 Answers 2

I would :

1.doublechechk if it's the same ip

2.allow only from your IP

3.change webmin port to a random one

share|improve this answer
    
1: Yes - you can see yourself the log IP is the same as the rule IP 2: Not something I'd like to do - I access my server from multiple machines, one of which is a dynamic IP 3: Webmin GUI is currently running on port 10000 - the bot is trying 3~ ports none of which are that port Ideally I just want to lock a host out after 5 - 10 failed attempts for a day. I know cPanel had better brute force protection. This is just a temporary stopgap till I find something similar –  Dan J Jun 6 '12 at 13:45
    
2. You could allow a hole range of ip's that you currently use on the specific port , and deny all others (-A INPUT -p tcp -m tcp --dport ssh -j ACCEPT 193.x.x.x and drop all others on the webmin port . It's a good general rule to have the firewall on deny all and allow only the ports that you are using from specific IP ranges - like country / provider specific if you can't give only one IP . . Then he can test all the ports that he wants :) . –  Alex H Jun 6 '12 at 14:01
add comment
up vote 0 down vote accepted

I went and installed ConfigServer Firewall - the bot got banned within minutes of installing it.

http://www.configserver.com/free/csf/install.txt

@ripat You may be correct in why my rule was not being picked up - I think Webmin's UI is at a disjoint to what iptables requires.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.