<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 01/09/2013 12:45 PM, Chuck Tetlow wrote:
<blockquote cite="mid:20130109174203.M48920@tetlow.net" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<meta content="OPENWEBMAIL" name="GENERATOR">
Interesting Gerald. VERY interesting!
<br>
<br>
Those rules use some stuff that is new to me. And if those rules
work - they'd be a GREAT asset to prevent hacking attempts. Much
better than DFIX or mod_abl, since they do it in real-time and
IPTables runs more efficiently than those programs in user-space.
<br>
<br>
Have you tested these rules Gerald? Because if those rules work
as intended - this could be the answer to our problems with people
trying to hack in via FTP and POP. I'm not concerned about SSH,
because I got tired of hacking attempts years ago and blocked TCP
22 and 23 at our front-door router (and switched SSH to a odd-ball
port for access). But I think we're all still seeing those
multiple-attempt-per-second scans trying to get valid usernames
and guess passwords. These IPTables rules could put a end to
that, and the DOS it causes when Dovecot goes down.
<br>
<br>
Oh, and have you tried to log those actions? Like logging the
DROP before doing it? I'd like to see some logging actions on
what IPTables drops - both so we could know its working and so we
could insure that its not the cause of a user issue.
<br>
<br>
Thanks Gerald. I'm looking forward to playing with these rules
and maybe improving our security.
<br>
<br>
</blockquote>
I use these rules on all the servers I maintain, they work, and log
to /var/log/messages with "Block SSH Attack "<br>
just change the port number and log-prefix<br>
<br>
/sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state
--state NEW -m recent --set --name SSH --rsource<br>
<br>
/sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state
--state NEW -m recent --update --seconds 60 --hitcount 8 --rttl
--name SSH --rsource -j LOG --log-prefix "Block SSH Attack "<br>
<br>
/sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state
--state NEW -m recent --update --seconds 60 --hitcount 8 --rttl
--name SSH --rsource -j DROP<br>
<br>
<div class="moz-signature">-- <br>
Gerald<br>
<br>
</div>
</body>
</html>