1

I am ubuntu and i have the iptable rules so that packets should be dropped if i have 5 logins in one minute.

This is working fine but after 20 minutes again that hacker starts brute forcing.

I want that if there are brute force attempts then that ip should go to hosts.deny.

Is it possible to do that without using any third party software

Improve this question
5
  • 1
    You could just change your SSH port to something out of the first 1000. You should immediately see those brute force attempts disappear
    – Dan McClain
    Sep 8, 2010 at 0:18
  • +1 to phsr, while not a direct answer to the question, it'd be a good idea.
    – David Z
    Sep 8, 2010 at 0:23
  • but i just want to do without chnaging port , just for my knowledge
    – John
    Sep 8, 2010 at 0:24
  • 1
    serverfault.com/questions/17870/hundreds-of-failed-ssh-logins
    – Zoredache
    Sep 8, 2010 at 0:26
  • Do you have the option of disallowing password logins?
    – Alex Holst
    Jan 30, 2011 at 21:51

4 Answers 4

Reset to default
9

What is your aversion to 3rd party software?

Denyhosts is package for Ubuntu and works out of the box, and is frequently recommended here. If you wanted you could write your own script that does exactly what denyhosts does, but what would be the point of that?

Improve this answer
3

I would definitely recommend using something like Fail2ban or DenyHosts to do this. It's exactly what they're made for, and like Zoredache says, I can't imagine why you would have a problem with using a third-party program.

That being said, you could use the recent module for IPtables, which exists in newer versions of the software. (I'm not sure how new exactly, but if you've kept up to date, I think you should have it.) It's not as easy to configure or as well-featured as the third-party programs, but it is a possibility. A set of rules like this:

iptables -A INPUT -m recent --name nobruteforce --rcheck -j DROP
iptables -A INPUT -m recent <other options> --name nobruteforce --set -j DROP

will add all packets which match the <other options> to a blacklist, and will block any further packets coming from the same source IP address. You would replace <other options> with whatever IPtables options you normally use to identify brute-force attacks; for example, it might be something like

iptables -A INPUT -m recent -p tcp --dport 22 --name nobruteforce --set -j DROP

although do note that every packet which comes to port 22 (that hasn't matched an earlier rule) would trigger this. Be careful with the recent module, because it could seriously mess things up if your rules ever produce a false positive. If you must use it, to limit the consequences, I'd suggest adding a time limit and/or a minimum hit requirement to the second rule:

iptables -A INPUT -m recent --name nobruteforce --rcheck --seconds 7200 --hitcount 5 -j DROP

This would block packets only after 5 brute-force packets are received, and at the end of 2 hours (7200 seconds) it will remove the source address from the blacklist.

More information about ipt_recent is available at http://snowman.net/projects/ipt_recent/

Improve this answer
0

An alternative solution to blocking the ip is to move the port that sshd is listening on. Most script kiddies won't bother with trying to find SSH on another port.

You could also turn off password authentication, using only public key authentication.

Another option is a port knocker (like knockd).

One thing you should do, if you haven't already, is disable root login

Improve this answer
0

There is a package known as denyhosts install it.This will work for your situation and after finding a threshold no of login attempts it will block the attacker. apt-get install denyhosts will do.

Improve this answer

You must log in to answer this question.