Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I added the following firewall rules in order to defend against ssh attacks.

iptables -N LOGNDROP
iptables -A LOGNDROP -j LOG --log-prefix "SSH attack! " --log-level 7
iptables -A LOGNDROP -j DROP
iptables -A INPUT -i eth0 -p tcp -m state --dport 22 --state NEW -m recent --set
iptables -A INPUT -i eth0 -p tcp -m state --dport 22 --state NEW -m recent --update --seconds 3600 --hitcount 4 -j LOGNDROP

Is it possible to reset that counter after a successful login attempt? Altough this solution works fine, I'm restricted to 3 successful login per hour too!

share|improve this question
    
This doesn't directly answer your question, but I would install Fail2Ban, and move SSH to a nonstandard port. (Be sure to edit the Fail2Ban jail config to monitor the correct port.) –  jlehtinen Dec 27 '13 at 17:48
    
@jlehtinen Thank you for your reply. I know about Fail2Ban, but if possible I try to avoid third party tools. Otherwise it would be a feasible solution. –  My-Name-Is Dec 27 '13 at 17:52
    
Fair enough. Off the top of my head, you could add a login script that purges the count. Look here for example (in Ubuntu): askubuntu.com/questions/10294/… I don't think this would be a good solution, as if someone brute-forced your SSH port after you logged in, the count wouldn't be reset. Maybe a scheduled cron job? –  jlehtinen Dec 27 '13 at 17:59

1 Answer 1

Yes, sort of. You can use something like fail2ban that processes the logs and removes the IP addresses from the /proc/net/xt_recent/DEFAULT:

Something like this as a (minutely?) cronjob would be a good first approximation:

for ip in $(sed -ne 's/^.*sshd.*Accepted.*from \([^ ]*\).*$/\1/p' /var/log/auth.log | sort -u); do echo -$ip > /proc/net/xt_recent/DEFAULT; done
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.