<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}
p.MsoNormal,p.MsoNoSpacing{margin:0}
p.MsoNormal,p.MsoNoSpacing{margin:0}
p.MsoNormal,p.MsoNoSpacing{margin:0}
p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div><br></div><div>this was given to me by Mark Davis from the Tidewater Unix User Group (TWUUG.ORG). A fancier method is <br></div><div>sshguard. I have not tried that yet.<br></div><div><br></div><div><br></div><div>blackbird:~> cat /etc/rc.local <br></div><div># Added by Mark A. Davis<br></div><div># Use iptables to slow the amount of connections by the same ipaddress<br></div><div># to sshd. When the attacker reaches 4 hit counts it will be blocked<br></div><div># for 60 seconds before resetting. If the attacker keeps attacking<br></div><div># before the 60 seconds are up it will reset the the time limit to<br></div><div># another 60 seconds.<br></div><div><br></div><div>/sbin/iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH<br></div><div>/sbin/iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j LOG --log-prefix "sshd_brute_force_block "<br></div><div>/sbin/iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP<br></div><div>blackbird:~><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div id="sig60527865"><div class="signature">-- <br></div><div class="signature"> Jörg Kewisch<br></div><div class="signature"> <a href="mailto:jorg@mellifera.buzz">jorg@mellifera.buzz</a><br></div><div class="signature"><br></div></div><div><br></div><div><br></div></body></html>