Re: I need to allow to login to Linux pc from particular IP addr only - Can I do that with IPtables command?

d wrote: 
This web page might give you some ideas.

http://www.itc.virginia.edu/unixsys/sec/hosts.html


Blocking with hosts.deny can be much too late if someone is exploiting a security hole. (e.g. the SSH V1 exploit from a few years back.) My personal take on this is
1) Only allow SSH through my hardware firewall. Nothing else. No telnet, rlogin, ftp,...
2) Only allow SSH V2.
3) Use iptables to restrict access. (Before I did this, the number of breakin attempts was scary.) Here is the relevant fragment:

-A INPUT -p tcp -m tcp --dport 22 --syn -j ssh-rules
# SSH rules.
-A ssh-rules -s 192.168.1.0/24 -j ACCEPT
-A ssh-rules -j DROP

Without a hardware firewall I would be much tougher on SYN packets.
.

Relevant Pages

  • Re: possibly hacked? Need some ideas please!
    ... > a small office behind a hardware firewall. ... It responds to ping! ... Hopefully this is tunneled through ssh. ... I have seen systems responding to pings in the ...
    (alt.os.linux)
  • Re: possibly hacked? Need some ideas please!
    ... >> office behind a hardware firewall. ... Must say I haven't seen any distro to use xinetd to run sshd, ... but it seems like Andy can't even ssh to the machine. ...
    (alt.os.linux)
  • Re: Need advice about breakin attempt
    ... >> firewall would do nothing for eliminating these bogus ssh requests. ... >- an hardware firewall. ... >through re-doing of iptables and the kernel set up. ...
    (alt.os.linux)
  • Re: Running FreeBSD server behind a firewall with nat
    ... > Now I need to put it on the Internet, so that the developers can take ... > control over it (ssh, ... sendmail doesn't start at ... What hardware firewall are you using? ...
    (freebsd-questions)
  • Re: PPTP and VPN connection not compatible?
    ... protocol, I think. ... If I could use SSH -- it looks so much better than ... you need to set up split tunneling which is generally considered a ... security hole. ...
    (comp.sys.mac.system)