Those annoying ssh attacks¶
you know those. you have tried blockhosts, denyhosts, fail2ban, and they can still be annoying.
an alternative is to use some feature or features of iptables.
Two possible uses … examples¶
Your default INPUT chain policy is ACCEPT¶
This is the version that is found online, typically under tags such as Brute-force.
one adds lines to ones iptables
iptables -N SSHSCAN
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j SSHSCAN
iptables -A SSHSCAN -m recent --set --name SSH --rsource
iptables -A SSHSCAN -m recent --update --seconds 3600 --hitcount 5 --name SSH --rsource -j LOG --log-prefix "Anti SSH-Bruteforce: " --log-level 6
iptables -A SSHSCAN -m recent --update --seconds 3600 --hitcount 5 --name SSH --rsource -j DROP
Your default INPUT chain policy is DROP¶
This is a variation of the above, but takes into account the DROP policy. It is a small change, but necessary if you really want to be able to log in via ssh.
iptables -N SSHSCAN
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j SSHSCAN
iptables -A SSHSCAN -m recent --set --name SSH --rsource
iptables -A SSHSCAN -m recent --update --seconds 3600 --hitcount 5 --name SSH --rsource -j LOG --log-prefix "Anti SSH-Bruteforce: " --log-level 6
iptables -A SSHSCAN -m recent --update --seconds 3600 --hitcount 5 --name SSH --rsource -j LogDrp
iptables -A SSHSCAN -j ACCEPT
Discussion¶
The recent module takes a number of options, and the examples above demonstrate some.
- —name xyz give a name to the particular ‘class’ you are defining
- —rsource in the list you keep, use the remote (source) address
- —rcheck see if the address is in the list
- —update like rcheck, but update the timestamp for tracking hits
- —seconds the number of seconds to track the address
- —hitcount the number of hits withing the time defined be —seconds at which point the rule gets activated.
So, in the examples, after the chain is defined to exist ( -N SSHSCAN), we have an INPUT rule that says ‘go to chain SSHSCAN if the destination port is 22’. In that chain, we set the module’s reference to this as SSH; then we tell it how to log this, if we have gotten 5 hits within 3600 seconds (actually more, as the time is updated rather than checked) and after that, DROP the next packets.
If the address has not gone up to 5 hits, it passes through and gets ACCEPTed.
Depending on your kernel and version of iptables, you can find the current list in
/proc/self/net/xt_recent/SSH
or
/proc/net/ipt_recent/SSH
ipsets¶
what does one do when one’s iptables rules start to get long? cpu and memory hit hard? convert a table to an ipset.
here is an example of something i need to test:
ipset -N sshban iphash --hashsize 4096 --probes 2 --resize 50
for i in ` cat /proc/net/xt_recent/SSH | awk '{print $1;}' | cut -d '=' -f 2 `; do
ipset -A sshban $i;
echo -$i > /proc/net/xt_recent/SSH
done
where we also have iptables rule
iptables -I INPUT -m set —set sshban src -j DROP
