iptables « recent » module and hit limits
iptables « recent » module and hit limits
iptables « recent » module and hit limits
Those annoying ssh attacks
You know those. you have tried blockhosts, denyhosts, fail2ban, and they can still be annoying.
an alternative is to use some feature or features of iptables.
Two possible uses … examples
Your default INPUT chain policy is ACCEPT
This is the version that is found online, typically under tags such as Brute-force.
one adds lines to ones iptables
iptables -N SSHSCAN iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j SSHSCAN iptables -A SSHSCAN -m recent --set --name SSH --rsource iptables -A SSHSCAN -m recent --update --seconds 3600 --hitcount 5 --name SSH --rsource -j LOG --log-prefix "Anti SSH-Bruteforce: " --log-level 6 iptables -A SSHSCAN -m recent --update --seconds 3600 --hitcount 5 --name SSH --rsource -j DROP
Your default INPUT chain policy is DROP
This is a variation of the above, but takes into account the DROP policy. It is a small change, but necessary if you really want to be able to log in via ssh.
iptables -N SSHSCAN iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j SSHSCAN iptables -A SSHSCAN -m recent --set --name SSH --rsource iptables -A SSHSCAN -m recent --update --seconds 3600 --hitcount 5 --name SSH --rsource -j LOG --log-prefix "Anti SSH-Bruteforce: " --log-level 6 iptables -A SSHSCAN -m recent --update --seconds 3600 --hitcount 5 --name SSH --rsource -j LogDrp iptables -A SSHSCAN -j ACCEPT
Discussion
The recent module takes a number of options, and the examples above demonstrate some.
—namexyz give a name to the particular ‘class’ you are defining—rsourcein the list you keep, use the remote (source) address—rchecksee if the address is in the list—updatelike rcheck, but update the timestamp for tracking hits—secondsthe number of seconds to track the address—hitcountthe number of hits withing the time defined be—secondsat which point the rule gets activated.
So, in the examples, after the chain is defined to exist ( -N SSHSCAN), we have an INPUT rule that says ‘go to chain SSHSCAN if the destination port is 22’. In that chain, we set the module’s reference to this as SSH; then we tell it how to log this, if we have gotten 5 hits within 3600 seconds (actually more, as the time is updated rather than checked) and after that, DROP the next packets.
If the address has not gone up to 5 hits, it passes through and gets ACCEPTed.
Depending on your kernel and version of iptables, you can find the current list in
/proc/self/net/xt_recent/SSHor
/proc/net/ipt_recent/SSHipsets
what does one do when one’s iptables rules start to get long? cpu and memory hit hard? convert a table to an ipset.
here is an example of something i need to test:
ipset -N sshban iphash --hashsize 4096 --probes 2 --resize 50
for i in ` cat /proc/net/xt_recent/SSH | awk '{print $1;}' | cut -d '=' -f 2 `; do
ipset -A sshban $i;
echo -$i > /proc/net/xt_recent/SSH
done
where we also have iptables rule
iptables -I INPUT -m set —set sshban src -j DROP
Source: we.riseup.net
If you have customized iptables rules, and would like to load the customized iptables rules persistently across reboots on Debian, you can leverage 
Ce guide va vous apprendre à sécuriser un serveur et donc vous initier aux thématiques de la sécurité informatique. En quoi est-ce important ? Par définition, un serveur est ouvert sur le monde, un minimum de sécurité est donc intéressant afin de se prémunir des attaques les plus simplistes.