<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
Interesting Gerald. VERY interesting!
<br />
<br />Those rules use some stuff that is new to me. And if those rules work - they'd be a GREAT asset to prevent hacking attempts. Much better than DFIX or mod_abl, since they do it in real-time and IPTables runs more efficiently than those programs in user-space.
<br />
<br />Have you tested these rules Gerald? Because if those rules work as intended - this could be the answer to our problems with people trying to hack in via FTP and POP. I'm not concerned about SSH, because I got tired of hacking attempts years ago and blocked TCP 22 and 23 at our front-door router (and switched SSH to a odd-ball port for access). But I think we're all still seeing those multiple-attempt-per-second scans trying to get valid usernames and guess passwords. These IPTables rules could put a end to that, and the DOS it causes when Dovecot goes down.
<br />
<br />Oh, and have you tried to log those actions? Like logging the DROP before doing it? I'd like to see some logging actions on what IPTables drops - both so we could know its working and so we could insure that its not the cause of a user issue.
<br />
<br />Thanks Gerald. I'm looking forward to playing with these rules and maybe improving our security.
<br />
<br />
<br />
<br />Chuck
<br />
<br />
<br /><font size="2">
<br />
<br /><b>--------- Original Message
-----------</b>
<br />
From: Gerald Waugh <gwaugh@frontstreetnetworks.com>
<br />
To: BlueOnyx General Mailing List <blueonyx@mail.blueonyx.it>
<br />
Sent: Wed, 09 Jan 2013 11:23:41 -0600
<br />
Subject: [BlueOnyx:11950] Re: Blocking brute force SSH login attempts
<br />
<br />>
On 01/09/2013 08:07 AM, James
wrote:
<blockquote type="cite" cite="mid:023601cdee72$ab3852d0$01a8f870$@slor.net">
<!-- style
begin
style end
-->
<br />>
<br />> Is there a simple way in BlueOnyx
to
auto-block hosts that fail to login via SSH too many times?
Something similar to the Failed Logins settings for
the
BlueOnyx login page but for
SSH?<o:p />
</blockquote>
I use catches attacks in real times, below uses 8 attempts in
60
seconds, of course you can change those parameters
<br />>
<br />>
/sbin/iptables -A INPUT -i eth0 -p tcp --dport 22 -m state
--state
NEW -m recent --set --name SSH
<br />>
<br />>
/sbin/iptables -A INPUT -i eth0 -p tcp --dport 22 -m state
--state
NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name
SSH
-j DROP
<br />>
<br />>
--
<br />>
Gerald
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>