1 |
Hi, |
2 |
I to have such a script that blocks ip's after 5 'opportunist' attempts. |
3 |
See below. How do I rc-update this to default? |
4 |
Cheers. |
5 |
|
6 |
#!/bin/sh |
7 |
# Start fresh |
8 |
iptables -F |
9 |
|
10 |
# Deal with SSH connections. |
11 |
iptables -N sshchain |
12 |
iptables -N sshscan |
13 |
|
14 |
# Do the block |
15 |
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j sshchain |
16 |
iptables -A sshchain -m conntrack --ctstate NEW -m recent --name |
17 |
sshattempts --set |
18 |
iptables -A sshchain -m recent --rcheck --seconds 60 --hitcount 10 |
19 |
--name sshattempts --rsource -j sshscan |
20 |
|
21 |
# log when it happens, |
22 |
iptables -A sshscan -m recent --rcheck --hitcount 3 --seconds 600 -j LOG |
23 |
--log-prefix "SSH to many: " |
24 |
iptables -A sshscan -j DROP |
25 |
################## |
26 |
|
27 |
|
28 |
ps |
29 |
MERRY CHRISTMAS |
30 |
|
31 |
~ |
32 |
|
33 |
|
34 |
|
35 |
|
36 |
|
37 |
On Fri, 2005-12-23 at 05:26 -0600, Justin Krejci wrote: |
38 |
> Firestarter to me was like using a ZoneAlarm type of windows firewall program. |
39 |
> It was very super easy to configure but not very flexible. I could not figure |
40 |
> out how to specify UDP vs TCP on rules. This seemed like a great program for |
41 |
> your average run of the mill home/desktop user. |
42 |
> |
43 |
> For a GUI I settled on Kmyfirewall as it was extraordinarily easy to configure |
44 |
> and use once I learned the basics of how iptables worked. I also wrote a perl |
45 |
> script to automatically block IP addresses of hosts that do brute force SSH |
46 |
> attempts. The IP addresses are automatically unblocked after 1 day. Every |
47 |
> time a change is made it sends out an email. This has really helped to keep |
48 |
> my log files cleaner instead of seeing 500 failed login attempts in a 3 hour |
49 |
> span from one IP address, then multiply that by 1-5 IP addresses per day. |
50 |
> |
51 |
> Note Kmyfirewall is very nice but is still considered beta and it shows but it |
52 |
> is not broken in any way that I can tell, just the interface has a couple of |
53 |
> small bugs AFAICT. |
54 |
> |
55 |
> On Thursday 22 December 2005 05:17 am, Gavin Seddon wrote: |
56 |
> > It's alright for some. I eat lunch with a couple of dogs (canine). |
57 |
> > Gavin |
58 |
> > |
59 |
> > On Wed, 2005-12-21 at 09:01 -0800, Steve Herber wrote: |
60 |
> > > I would recommend you use Shorewall for an easy way to configure and |
61 |
> > > manage you iptables based linux firewall. The documentation is |
62 |
> > > excellent. Plus, I like to have lunch with the author. |
63 |
> > > |
64 |
> > > shorewall.net |
65 |
> > > |
66 |
> > > Steve Herber herber@×××××.com work: 206-221-7262 |
67 |
> > > Security Engineer, UW Medicine, IT Services home: 425-454-2399 |
68 |
> > > |
69 |
> > > On Wed, 21 Dec 2005, Gavin Seddon wrote: |
70 |
> > > > Hi, |
71 |
> > > > I have merged iptables. Will they start at boot and is there a link |
72 |
> > > > for configuring on Gentoo? |
73 |
> > > > Thanks. |
74 |
> > > > -- |
75 |
> > > > Dr Gavin Seddon |
76 |
> > > > School of Pharmacy and Pharmaceutical Sciences |
77 |
> > > > University of Manchester |
78 |
> > > > Oxford Road, Manchester |
79 |
> > > > M13 9PL, U.K. |
80 |
> > > > |
81 |
> > > > -- |
82 |
> > > > gentoo-amd64@g.o mailing list |
83 |
> > |
84 |
> > -- |
85 |
> > Dr Gavin Seddon |
86 |
> > School of Pharmacy and Pharmaceutical Sciences |
87 |
> > University of Manchester |
88 |
> > Oxford Road, Manchester |
89 |
> > M13 9PL, U.K. |
90 |
-- |
91 |
Dr Gavin Seddon |
92 |
School of Pharmacy and Pharmaceutical Sciences |
93 |
University of Manchester |
94 |
Oxford Road, Manchester |
95 |
M13 9PL, U.K. |
96 |
|
97 |
-- |
98 |
gentoo-amd64@g.o mailing list |