<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 01/09/2013 04:30 PM, Gerald Waugh wrote:
<blockquote cite="mid:50EDEF8F.3010708@frontstreetnetworks.com"
type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
On 01/09/2013 12:45 PM, Chuck Tetlow wrote:
<blockquote cite="mid:20130109174203.M48920@tetlow.net"
type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<meta content="OPENWEBMAIL" name="GENERATOR">
Interesting Gerald. VERY interesting! <br>
<br>
Those rules use some stuff that is new to me. And if those
rules work - they'd be a GREAT asset to prevent hacking
attempts. Much better than DFIX or mod_abl, since they do it in
real-time and IPTables runs more efficiently than those programs
in user-space. <br>
<br>
Have you tested these rules Gerald? Because if those rules work
as intended - this could be the answer to our problems with
people trying to hack in via FTP and POP. I'm not concerned
about SSH, because I got tired of hacking attempts years ago and
blocked TCP 22 and 23 at our front-door router (and switched SSH
to a odd-ball port for access). But I think we're all still
seeing those multiple-attempt-per-second scans trying to get
valid usernames and guess passwords. These IPTables rules could
put a end to that, and the DOS it causes when Dovecot goes down.
<br>
<br>
Oh, and have you tried to log those actions? Like logging the
DROP before doing it? I'd like to see some logging actions on
what IPTables drops - both so we could know its working and so
we could insure that its not the cause of a user issue. <br>
<br>
Thanks Gerald. I'm looking forward to playing with these rules
and maybe improving our security. <br>
<br>
</blockquote>
I use these rules on all the servers I maintain, they work, and
log to /var/log/messages with "Block SSH Attack "<br>
just change the port number and log-prefix<br>
<br>
/sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state
--state NEW -m recent --set --name SSH --rsource<br>
<br>
/sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state
--state NEW -m recent --update --seconds 60 --hitcount 8 --rttl
--name SSH --rsource -j LOG --log-prefix "Block SSH Attack "<br>
<br>
/sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state
--state NEW -m recent --update --seconds 60 --hitcount 8 --rttl
--name SSH --rsource -j DROP<br>
<br>
</blockquote>
Oops, I have mine logging to /var/log/iptables<br>
IIRC changed in rsyslog.conf<br>
<br>
kern.warning
/var/log/iptables<br>
<br>
example for SMTP Attack<br>
<br>
Dec 20 21:00:02 mail kernel: <b>Block 25 SMTP Attack</b> IN=eth0
OUT= MAC=d6:f7:c7:cc:13:6b:00:23:04:96:58:46:08:00 SRC=75.75.244.19
DST=12.181.146.20 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=11242 DF
PROTO=TCP SPT=41147 DPT=25 WINDOW=14600 RES=0x00 SYN URGP=0 <br>
<br>
<br>
<br>
<blockquote cite="mid:50EDEF8F.3010708@frontstreetnetworks.com"
type="cite">
<div class="moz-signature">-- <br>
Gerald<br>
<br>
</div>
</blockquote>
<br>
<br>
<div class="moz-signature">-- <br>
Gerald Waugh<br>
Front Street Networks<br>
(318) 734-4779<br>
(318) 401-0428
</div>
</body>
</html>