Gentoo Logo
Gentoo Spaceship




Note: Due to technical difficulties, the Archives are currently not up to date. GMANE provides an alternative service for most mailing lists.
c.f. bug 424647
List Archive: gentoo-amd64
Navigation:
Lists: gentoo-amd64: < Prev By Thread Next > < Prev By Date Next >
Headers:
To: gentoo-amd64@g.o
From: Gavin Seddon <gavin.m.seddon@...>
Subject: Re: firewall
Date: Fri, 23 Dec 2005 14:00:02 +0000
Hi,
I to have such a script that blocks ip's after 5 'opportunist' attempts.
See below.  How do I rc-update this to default?
Cheers.

#!/bin/sh
# Start fresh
iptables -F

# Deal with SSH connections.
iptables -N sshchain
iptables -N sshscan

# Do the block
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j sshchain
iptables -A sshchain -m conntrack --ctstate NEW -m recent --name
sshattempts --set
iptables -A sshchain -m recent --rcheck --seconds 60 --hitcount 10
--name sshattempts --rsource -j sshscan

# log when it happens,
iptables -A sshscan -m recent --rcheck --hitcount 3 --seconds 600 -j LOG
--log-prefix "SSH to many: "
iptables -A sshscan -j DROP
##################


ps
MERRY CHRISTMAS 

~





On Fri, 2005-12-23 at 05:26 -0600, Justin Krejci wrote:
> Firestarter to me was like using a ZoneAlarm type of windows firewall program. 
> It was very super easy to configure but not very flexible. I could not figure 
> out how to specify UDP vs TCP on rules. This seemed like a great program for 
> your average run of the mill home/desktop user.
> 
> For a GUI I settled on Kmyfirewall as it was extraordinarily easy to configure 
> and use once I learned the basics of how iptables worked. I also wrote a perl 
> script to automatically block IP addresses of hosts that do brute force SSH 
> attempts. The IP addresses are automatically unblocked after 1 day. Every 
> time a change is made it sends out an email. This has really helped to keep 
> my log files cleaner instead of seeing 500 failed login attempts in a 3 hour 
> span from one IP address, then multiply that by 1-5 IP addresses per day.
> 
> Note Kmyfirewall is very nice but is still considered beta and it shows but it 
> is not broken in any way that I can tell, just the interface has a couple of 
> small bugs AFAICT.
> 
> On Thursday 22 December 2005 05:17 am, Gavin Seddon wrote:
> > It's alright for some.  I eat lunch with a couple of dogs (canine).
> > Gavin
> >
> > On Wed, 2005-12-21 at 09:01 -0800, Steve Herber wrote:
> > > I would recommend you use Shorewall for an easy way to configure and
> > > manage you iptables based linux firewall.  The documentation is
> > > excellent. Plus, I like to have lunch with the author.
> > >
> > >  	shorewall.net
> > >
> > > Steve Herber	herber@...		work: 206-221-7262
> > > Security Engineer, UW Medicine, IT Services	home: 425-454-2399
> > >
> > > On Wed, 21 Dec 2005, Gavin Seddon wrote:
> > > > Hi,
> > > > I have merged iptables.  Will they start at boot and is there a link
> > > > for configuring on Gentoo?
> > > > Thanks.
> > > > --
> > > > Dr Gavin Seddon
> > > > School of Pharmacy and Pharmaceutical Sciences
> > > > University of Manchester
> > > > Oxford Road, Manchester
> > > > M13 9PL, U.K.
> > > >
> > > > --
> > > > gentoo-amd64@g.o mailing list
> >
> > --
> > Dr Gavin Seddon
> > School of Pharmacy and Pharmaceutical Sciences
> > University of Manchester
> > Oxford Road, Manchester
> > M13 9PL, U.K.
-- 
Dr Gavin Seddon
School of Pharmacy and Pharmaceutical Sciences 
University of Manchester
Oxford Road, Manchester 
M13 9PL, U.K.

-- 
gentoo-amd64@g.o mailing list


Replies:
Re: firewall
-- Craig Webster
References:
firewall
-- Gavin Seddon
Re: firewall
-- Steve Herber
Re: firewall
-- Justin Krejci
Navigation:
Lists: gentoo-amd64: < Prev By Thread Next > < Prev By Date Next >
Previous by thread:
Re: firewall
Next by thread:
Re: firewall
Previous by date:
Re: Problems at reboot
Next by date:
Re: firewall


Updated Jun 17, 2009

Summary: Archive of the gentoo-amd64 mailing list.

Donate to support our development efforts.

Copyright 2001-2013 Gentoo Foundation, Inc. Questions, Comments? Contact us.