Re: bruteforce protection howto

On 20Mar2010 17:25, Craig White <craigwhite@xxxxxxxxxxx> wrote:
| On Sat, 2010-03-20 at 23:17 +0100, Vadkan Jozsef wrote:
| > Two pc's:
| >
| > 1 - router
| > 2 - logger
| >
| > Situation: someone tries to bruteforce into a server, and the logger
| > get's a log about it [e.g.: ssh login failed].
| >
| > What's the best method to ban that ip [what is bruteforcig a server]
| > what was logged on the logger?
| > I need to ban the ip on the router pc.
| >
| > How can i send the bad ip to the router, to ban it?
| >
| > Just run a cronjob, and e.g.: scp the list of ip's from the logger to
| > the router, then ban the ip from the list on the router pc?
| >
| > Or is there any "offical" method for this?
| >
| > I'm just asking for docs/howtos.. :\ to get started..
| ----
| personally, I always use 'denyhosts' package which can be either single
| system or can share data with other systems.
|
| yum search denyhosts

I block this stuff with a firewall rule limiting the number of inbound
ssh connections in a period of time. It usually cuts this kind of thing
off fairly promptly. I'm using pf on an openbsd firewall:

# let admin sites in anyway
pass log quick proto tcp from <admins> to any port 22 flags S/SA keep state

# discard already blocked IPs
block drop quick proto tcp from <evil> to any port 22

# allow ssh in unless an IP connects too often, adding it to the
# <evil> table used above
pass log quick proto tcp from any to any port 22 flags S/SA keep state (max-src-conn-rate 20/60, overload <evil> flush)

I believe you can do the same kind of thing in iptables these days if
that's what you've got.

Cheers,
--
Cameron Simpson <cs@xxxxxxxxxx> DoD#743
http://www.cskk.ezoshosting.com/cs/
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Relevant Pages