Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am having trouble limiting the connection to SSH from a unique ip address. I tried the following rules to restrict an ip address from logging to SSH for more than 3 times in 100 seconds, but it didn't work.

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

-A LOGDROP -m limit --limit 4/minute --limit-burst 3 -j LOG --log-prefix "LOGDROP: " --log-level info
-A LOGDROP -j DROP
-A INPUT -s 192.168.1.12/32 -p tcp --dport 22 -m state --state NEW -m recent --set
-A INPUT -s 192.168.1.12/32 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 --hitcount 3 --rttl -j LOGDROP
-A INPUT -s 192.168.1.12/32 -p tcp --dport 22 -j ACCEPT

What could be the problem?

share|improve this question
    
The line -m recent --set was there, I just missed it out when copy and paste. Sorry for that. –  Question Overflow Jan 6 '13 at 10:18
add comment

2 Answers

This will help you:

sudo iptables -s 192.168.1.12 -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
sudo iptables -s 192.168.1.12 -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent  --update --seconds 100 --hitcount 3 -j DROP
share|improve this answer
    
Can you explain what is wrong with my configuration? Your proposal doesn't log the dropped connection. –  Question Overflow Jan 6 '13 at 10:11
add comment

I figured there is nothing wrong with the configuration. My understanding of SSH connection is flawed. A wrong login password does not cause the SSH connection to be dropped. Hence the hit count limit is not affected until I do a reconnect.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.