I have a question about the setting up/modus operandi of SSHGuard.
I would like to block ssh brute force attacks that happens about 3 times every second. I am on an Amazon instance, password login is disabled and ssh only works with public/private keys.
I would like to use SSHGuard to block the IPs, but I need SSH, HTTP, HTTPS, DNS to be open. The question is, does SSHGuard recognize and block(depending on logfiles) the attack with the following configuration(taken from doc), or does this mean ssh is still open? The documentation is not helpful for me, that is why I am askig.
iptables -N sshguard # block whatever SSHGuard says be bad ... iptables -A INPUT -j sshguard # enable ssh, dns, http, https iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p udp --dport 53 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT # and block everything else (default deny) iptables -P INPUT DROP
Thanks in advance.