<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><base href="x-msg://1211/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Absolutely a good solution... but there are so many attack vectors. DFIX does an aggregate analysis of SSH attacks, and FTP attacks, and SMTP, and IMAP and POP, and even some web attack vectors etc etc... The threshold to block a user is a combination of all of the above. Yes it does take some CPU cycles - but it was designed to be fairly light weight over all. I still agree the iptables rules are good as a first line of defence - but there's more to look at than just the frequency of SYN requests to keep your server secure.</div><div><br></div><div>Regards,</div><div>Greg.</div><div><br></div><br><div><div>On 10/01/2013, at 6:32 AM, James <<a href="mailto:james@slor.net">james@slor.net</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div bgcolor="white" lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">I’m with you Chuck. Sticking those rules in an init script seems like a nice clean way to monitor and block.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Thanks Gerald<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="border-style: none none none solid; border-left-width: 1.5pt; border-left-color: blue; padding: 0in 0in 0in 4pt; "><div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0in 0in; "><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:blueonyx-bounces@mail.blueonyx.it" style="color: purple; text-decoration: underline; ">blueonyx-bounces@mail.blueonyx.it</a><span class="Apple-converted-space"> </span>[mailto:blueonyx-<a href="mailto:bounces@mail.blueonyx.it" style="color: purple; text-decoration: underline; ">bounces@mail.blueonyx.it</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Chuck Tetlow<br><b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, January 09, 2013 1:46 PM<br><b>To:</b><span class="Apple-converted-space"> </span>BlueOnyx General Mailing List<br><b>Subject:</b><span class="Apple-converted-space"> </span>[BlueOnyx:11952] Re: Blocking brute force SSH login attempts<o:p></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">Interesting Gerald. VERY interesting!<span class="Apple-converted-space"> </span><br><br>Those rules use some stuff that is new to me. And if those rules work - they'd be a GREAT asset to prevent hacking attempts. Much better than DFIX or mod_abl, since they do it in real-time and IPTables runs more efficiently than those programs in user-space.<span class="Apple-converted-space"> </span><br><br>Have you tested these rules Gerald? Because if those rules work as intended - this could be the answer to our problems with people trying to hack in via FTP and POP. I'm not concerned about SSH, because I got tired of hacking attempts years ago and blocked TCP 22 and 23 at our front-door router (and switched SSH to a odd-ball port for access). But I think we're all still seeing those multiple-attempt-per-second scans trying to get valid usernames and guess passwords. These IPTables rules could put a end to that, and the DOS it causes when Dovecot goes down.<span class="Apple-converted-space"> </span><br><br>Oh, and have you tried to log those actions? Like logging the DROP before doing it? I'd like to see some logging actions on what IPTables drops - both so we could know its working and so we could insure that its not the cause of a user issue.<span class="Apple-converted-space"> </span><br><br>Thanks Gerald. I'm looking forward to playing with these rules and maybe improving our security.<span class="Apple-converted-space"> </span><br><br><br><br>Chuck<span class="Apple-converted-space"> </span><br><br><br><span style="font-size: 10pt; "><br><br><b>--------- Original Message -----------</b><span class="Apple-converted-space"> </span><br>From: Gerald Waugh <<a href="mailto:gwaugh@frontstreetnetworks.com" style="color: purple; text-decoration: underline; ">gwaugh@frontstreetnetworks.com</a>><span class="Apple-converted-space"> </span><br>To: BlueOnyx General Mailing List <<a href="mailto:blueonyx@mail.blueonyx.it" style="color: purple; text-decoration: underline; ">blueonyx@mail.blueonyx.it</a>><span class="Apple-converted-space"> </span><br>Sent: Wed, 09 Jan 2013 11:23:41 -0600<span class="Apple-converted-space"> </span><br>Subject: [BlueOnyx:11950] Re: Blocking brute force SSH login attempts<span class="Apple-converted-space"> </span><br><br>> On 01/09/2013 08:07 AM, James wrote:<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 10pt; "><br>><span class="Apple-converted-space"> </span><br>> Is there a simple way in BlueOnyx to auto-block hosts that fail to login via SSH too many times? Something similar to the Failed Logins settings for the BlueOnyx login page but for SSH?<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 10pt; ">I use catches attacks in real times, below uses 8 attempts in 60 seconds, of course you can change those parameters<span class="Apple-converted-space"> </span><br>><span class="Apple-converted-space"> </span><br>> /sbin/iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH<span class="Apple-converted-space"> </span><br>><span class="Apple-converted-space"> </span><br>> /sbin/iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP<span class="Apple-converted-space"> </span><br>><span class="Apple-converted-space"> </span><br>> --<span class="Apple-converted-space"> </span><br>> Gerald<span class="Apple-converted-space"> </span><br><b>------- End of Original Message -------</b></span><o:p></o:p></div></div></div>_______________________________________________<br>Blueonyx mailing list<br><a href="mailto:Blueonyx@mail.blueonyx.it" style="color: purple; text-decoration: underline; ">Blueonyx@mail.blueonyx.it</a><br><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx" style="color: purple; text-decoration: underline; ">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a></div></blockquote></div><br></body></html>