-3

I see thousands of failed login attempts on our servers and want to do what I can to prevent a successful one from the bad guys. I want to block anyone not originating from a /29 block we own from being allowed to SSH into our servers.

I have disabled root login, password authentication, installed fail2ban, and instituted SSH keys. Is this a redundant step or a decent layer of protection? If the later, what is a way I can achieve this?

1
  • Old! It doesn't matter for this, but update your software sometimes. It's fun and secure. Aug 29, 2015 at 1:41

2 Answers 2

2

Add the logic to your firewall such as:

iptables -I INPUT -s 10.0.0.0/29 -p tcp --dport 22 -j ACCEPT
iptables -I INPUT -p tcp --dport 22 -j DROP
2
  • When I tried that first line I got, iptables v1.4.21: Couldn't load target `ALLOW':No such file or directory Aug 28, 2015 at 20:10
  • 1
    It should be ACCEPT, not ALLOW. I've edited the answer.
    – womble
    Aug 29, 2015 at 0:05
1

Just create two sections Match in the config that define required behaviour:

Match Address 11.22.33.44/29
   AllowUsers *

Match Address *
   AllowUsers

Not the answer you're looking for? Browse other questions tagged .